Seagate Technology Incorporated

Elektrikgreen, Inc.

Christopher Nicholas Allo

Saheb Biswas

Kevin Gautam Sternberg

Richard O Weiss

A distributed data storage system can have an attestation module that is connected to the data storage device to disconnect the device from a distributed data storage network or prevent the data storage device from being initialized into the distributed data storage network. A first security evaluation of the data storage device can be conducted with the attestation module to verify an authenticity of the data storage device. The attestation module may then disconnect the network controller from the distributed data storage network and verify an authenticity of the network controller to allow the network controller and data storage device to service a data access request from a host of the distributed data storage network.

Distributed data storage system with backward attestation

A data storage device can employ a front end bus for boot operations. The physical connection of a secure boot assembly to the front end bus can provide efficient and reliable booting of the data storage device without a connection to a remote host or network. A secure boot assembly can provide a security module that connects to the boot module of the data storage device to authenticate a trustworthiness of the data storage device while the data storage device is disconnected from any remote host.

Secure booting in a data storage device with front end bus

A data storage system can consist of a network controller connected to a data storage device and a remote host. An attack mitigation strategy may be generated with an attack module connected to the network controller in response to detected data storage conditions in the data storage device. The attack mitigation strategy can be executed with the attack module by sending separate first and second security queries to the data storage device over time. At least a powered move attack can then be identified based on the second security query.

Data storage system with powered move attack protection

Apparatus and method for local authentication of a collection of processing devices, such as but not limited to storage devices (e.g., SSDs, etc.). In some embodiments, an edge computing device is coupled between the collection of processing devices and an external network. The edge computing device performs a network authentication over the external network with a remote server using an edge token. The edge computing device further performs a local authentication of the collection using storage tokens of the respective processing devices, with the local authentication not utilizing the external network or the remote server. Both the edge token and the storage tokens may be generated from a client token of a client device.

Promoting system authentication to the edge of a cloud computing network

Method and apparatus for generating green electrical power. During a hydrogen gas storage mode, an electrolyzer generates a stream of hydrogen gas from water supplied by a water source and using power from an input power source. A hydrogen tank temporarily stores the stream of hydrogen. During a power generation mode, a fuel cell converts the stream of hydrogen gas from the tank into output electrical power by combining the hydrogen with oxygen. An inverter conditions and supplies the electrical power to a local load. A controller circuit uses a system parameter to adaptively switch between the storage mode and the power generation mode. In some cases, external power is supplied during the generation and storage of the hydrogen gas from an electrical grid or a local renewable source such as a set of solar panels. Respective grid-tied, solar-tied, grid-only, off-grid, and electric vehicle charging configurations are provided.

Autonomous power generation system

A distributed data storage system can connect a customization module to at least one host and a second data storage device via a network controller. The customization module may disconnect the first data storage device from the host and second data storage device prior to assessing a security operation of the first data storage device with the customization module, generating an optimization strategy with the customization module based on the assessed security operation, implementing the optimization strategy in the first data storage device to alter at least one security parameter of the first data storage device, and then connecting the first data storage device to the host and second data storage device to allow at least one data access to be executed to the first data storage device with the altered at least one security parameter.

Distributed data storage system with offline optimization

Security of computers, data storage devices, and servers can be improved with a multiple key access system. In some embodiments, a local key management device can be a locally (or virtually) located data storage device such as a HDD or SDD. The key management device may be part of a computer or server system and can have a first secure area protected by a cryptographic module (e.g. hardware integrated circuit). The first secure area can store a key to access a second secure area, which may function as a local key management server (LKMS) and store access information to securely communicate with and unlock another data storage device coupled to the computer. For example, the LKMS may store an access key to provide the computer with access to another data storage device. Communications between the LKMS and the other data storage device may be encrypted using a communication key.

Systems and methods for unlocking self-encrypting data storage devices

A data storage device can transition a functional data storage medium into a read only data surface. Data can be written to a data storage medium with a data writer of a transducing head prior to a security threat being identified. A write head of the transducing head is deactivated in response to the security threat by selecting a permanent deactivation mechanism.

Data storage device with data writer deactivation responsive to security threats

A data storage system can employ at least one data storage device having a supplemental processing bus that connects a first controller to a second controller with the supplemental bus being exposed to an exterior surface of a housing. The second controller may be positioned on a portable computing component connected to the supplemental bus while the portable computing component is positioned external to the housing. The computing capabilities of the portable computing component are identified with the first controller to allow a supplementation strategy to be generated with the first controller in response to connection of the portable computing component to the supplemental bus. The supplementation strategy can then be executed by assigning at least one processing task from the first controller to the second controller.

Data storage system with supplemental processing bus

A data storage device can have one or more timestamps to indicate chronological information associated with data stored in the data storage device. A controller may be connected to a timestamp module and a transducing head to allow a timestamp to be written to a magnetic data storage medium as directed by the timestamp module. The timestamp can consist of chronological information relating to user-generated data stored on the data storage medium.

Time-stamped data in a data storage device

A data storage device can employ a front end bus to optimize data storage performance. A first controller may be connected to a first memory via a first bus and to a second memory via a second bus with the first bus and first memory housed within an internal cavity of an enclosure while the second bus is exposed to an exterior surface of the housing and the second memory is separated from the internal cavity. The first controller can be configured to substitute the second memory for the first memory in response to a front end controller identifying a type of data storage of the second memory.

Data storage device with front end bus

Implementations and methods herein provide a networked storage system including a plurality of physical storage devices configured to store data on a plurality of virtualized volumes, a key store configured to store a plurality of encryption keys, and a security manager configured to encrypt data stored on each of the plurality of virtualized volumes using a different key.

Virtualized volume level security

Security of data storage devices and servers can be improved by the system and methods described herein. In some embodiments, a key management server may be locally or externally located. An encryption key may be used for locking a portion or the entirety of a storage device. The key management server may communicate with data storage devices regarding encryption keys using secure protocols. For example, the key management server may generate a communication key that may be used to securely encrypt messages between the server and a data storage device.

Removable circuit for unlocking self-encrypting data storage devices

Systems and methods for wireless enabled security in relation to a storage drive are described. In one embodiment, the systems and methods may include receiving, at a storage drive, a request from a host of the storage drive. In some cases, the request may be received via a wired connection between the storage drive and the host. In some embodiments, the systems and methods may include determining whether the request is flagged by the host as a secure connection request, processing the request upon determining the request is not flagged as a secure connection request, and establishing a wireless connection with the host upon determining the request is flagged by the host as a secure connection request.

Wireless enabled secure storage drive

Implementations and methods herein provide a networked storage system including a plurality of physical storage devices configured to store data on a plurality of virtualized volumes, a key store configured to store a plurality of encryption keys, and a secure messaging manager configured to encrypt a message to each of the plurality of virtualized volumes using a different encryption key.

Growing community of inventors

Lyons, CO, United States of America

Christopher Nicholas Allo