Western Digital Technologies, Inc.

Sandisk Technologies Inc.

Matthew Harris Klapman

Brian Edward Mastenbrook

Ramanathan Muthiah

Nitin Jain

David Robert Arnold

Michael William Webster

John So

Ronak Jain

Taninder Singh Sijher

Pongsanat Karmpeeraparpsontorn

David Ross

Suksan Yaowaphak

Thantham Panyayodrat

This disclosure a smart card device that provides a bus interface, such as a USB-C bus interface, printed on a portion of a PCB that forms a base layer of the smart card device. The smart card device can provide the bus interface without having to mount a traditional socket. By leveraging the portion of the PCB to provide a printed bus interface and excluding the traditional socket, the bus interface can be easily manufactured using well-known PCB manufacturing techniques while significantly reducing manufacturing costs. Furthermore, the smart card device can have a thickness that conforms to known card form factor standards, enabling the smart device to fit within a standard wallet. To enhance durability of the portion of the PCB from wear-and-tear, a metal core can be added to the PCB as an additional layer. The portion may also be reinforced with edge plating.

Smart card with bus interface receptacle printed as part of PCB

A data storage device includes storage media and control circuitry and is configured to enable the creation of partitions with different performance levels. The storage media includes a first set and a second set of memory blocks having different performance levels. The control circuitry is configured to: in response to a request from a host system, provide performance data from the first set of memory blocks and the second set of memory blocks to the host system. The control circuitry is further configured to: receive partition settings from the host system, the partition settings creating a first partition including at least part of the first set of memory blocks and a second partition including at least part of the second set of memory blocks, wherein the first partition has a better performance level than the second partition; and save the partition settings to the storage media.

Selectable performance-based partitioning

A data storage device comprises a non-volatile storage medium configured to store user data, a data port configured to transmit data between a host computer system and the data storage device, an energy harvesting component configured to produce electrical energy from an ambient energy source, and a beacon component, configured to wirelessly transmit a signal. The beacon component is configured to consume the electrical energy to wirelessly transmit the signal. The data storage device may further comprise an energy store configured to store the electrical energy produced by the energy harvesting component as stored energy.

Wireless device loss prevention and discovery

Disclosed herein is a data storage device. A data port transmits data between a host computer system and the data storage device. A non-volatile storage medium stores encrypted user content data and a cryptography engine connected between the data port and the storage medium uses a cryptographic key to decrypt the encrypted user content data. The access controller generates authorization request data indicative of multiple devices to be authorized, and stores the authorization request data on non-volatile configuration memory of the data storage device. Upon approval of the authorization request data by a manager device that is registered with the access controller as a manager device, the access controller locates the authorization request data of one of the multiple devices to be authorized and registers the one of the multiple devices to be authorized as an authorized device.

Multiple authorization requests from a data storage device

A data storage device including a biometric reader for biometric authentication to enable access to a storage medium. The data storage device is configured for remote registration of a remote user of the data storage device, wherein registration includes receiving a record of a biometric authentication data set of the remote user from a secure database. Alternatively, a secure authorizing command is received remotely from an authorization server to enable the data storage device to directly read and store biometric data of the remote user. The data storage device can be unlocked by biometric authentication to enable a host device to access user data in the storage medium.

Remote registration of a data storage device with biometric authentication

This disclosure relates to data storage device (DSD) hardware and, more specifically, to systems and methods for encrypting data stored on a DSD. A DSD comprises a non-volatile storage medium to store multiple file system data objects using block addressing. The multiple file system data objects are addressable by respective ranges of blocks. A device controller is integrated with the DSD and comprises hardware circuitry configured to encrypt data to be stored on the storage medium and decrypt data stored on the storage medium based on different cryptographic keys, and to use each of the different cryptographic keys for one of the ranges of blocks addressing a respective file system data object. The decryption part of the hardware circuitry can be deactivated so that the data can be read in encrypted form.

Data storage device encryption

This disclosure relates to data storage device (DSD) hardware and, more specifically, to systems and methods for encrypting data stored on a DSD. A DSD comprises a non-volatile storage medium to store multiple file system data objects using block addressing. A device controller is integrated with the DSD and comprises hardware circuitry configured to encrypt data to be stored on the storage medium. The controller receives a request for an encrypted file system data object from a host computer system, identifies one of the ranges of blocks where the requested encrypted file system data object is stored on the storage medium, and sends the file system data object stored in the identified range of blocks to the host computer system in encrypted form as stored on the storage medium.

A data storage devicecomprising: a non-volatile storage mediumconfigured to store user data; a data portconfigured to transmit data and power between a host computer systemand the data storage device; a data access state indicator; and a controllerconfigured to: selectively set a data access state of the data storage deviceto either: an unlocked state to enable access to the user data; or a locked state to disable access to the user data; and generate an indicator control signal to cause the data access state indicatorto indicate the data access state, wherein the data access state indicatoris configured to indicate the data access state irrespective of whether the data storage deviceis powered through the data port

Lock or unlock indicator on a data storage device

Data storage devices, methods, and systems for passcode authentication based on automatically generated and dynamically changing unlock passcodes are described. An access controller of a data storage device is configured to receive a first passcode based on an externally generated input passcode that is synchronized with internal generation of an unlock passcode by the access controller. The access controller generates a second passcode based on the internally generated unlock passcode, and unlocking the data storage device is responsive to the first passcode matching the second passcode.

Passcode authentication based data storage device

An in-line security device to transfer cryptographic key material, the device comprising: a first connector configured to connect, via wire, with a host device; a second connector configured to connect, via wire, with a data storage device; a pass-through circuit between the first connector and the second connector to facilitate data communication between the host device and the data storage device; and a communication interface to send cryptographic key material to the data storage device via the second connector.

Security device for a data storage device

Disclosed herein is a data storage device comprising a data path and an access controller. The access controller generates a recovery private key, generates encrypted authorization data based on the recovery private key, stores the encrypted authorization data, and sends the recovery private key to a manager device. When recovery is desired, access controller receives a recovery public key, calculated based on the recovery private key, from a recovery manager device, decrypts the encrypted authorization data based on the recovery public key, generates a challenge for the recovery manager device based on the decrypted authorization data, sends the challenge to the recovery manager device over the communication channel that is different from the data path, receives a response to the challenge from the recovery manager device over the communication channel, and based at least partly on the response, enables decryption of the encrypted user content data.

Recovery key for unlocking a data storage device

Disclosed herein is a data storage device with storage medium that stores encrypted user content data. A cryptography engine uses a cryptographic key to decrypt the encrypted user content data. An access controller receives, from a user device, a request to register the user device and generates a challenge for a manager device. The manager device is located remotely from the data storage device. The controller sends, to the user device, the challenge for the manager device; receives, from the user device, a response calculated by the manager device to approve the request to register; calculates the cryptographic key based at least partly on the response calculated by the manager device; and creates and stores authorization data associated with the user device. The authorisation data indicates the cryptographic key, to register the user device with the data storage device.

Remote grant of access to locked data storage device

Disclosed herein is a data storage device comprising a data path and an access controller. The data path comprises a data port configured to transmit data between a host computer and the data storage device and registers with the host computer system as a block data storage device. A non-volatile storage medium stores encrypted user content data. A cryptography engine is connected between the data port and the storage medium and uses a key to decrypt the encrypted user content data. A data store stores multiple entries comprising authorization data associated with respective authorized devices. The access controller receives from a manager device a public key associated with a private key stored on a device to be authorized, creates the authorization data, and stores the authorization data in association with the public key in the data store, thereby registering the device to be authorized as one of the authorized devices.

Multi-device unlocking of a data storage device

Disclosed herein is a data storage device comprising a data path, an access controller, and a data store. The data path comprises a data port configured to transmit data between a host computer system and the data storage device; a non-volatile storage medium configured to store encrypted user content data; and a cryptography engine connected between the data port and the storage medium and configured to use a cryptographic key to decrypt the encrypted user content data stored on the storage medium in response to a request from the host computer system. The access controller is configured to store on the data store multiple entries associated with multiple respective registered devices. The multiple entries comprise authorization data indicative of cryptographic keys that selectively provide user access or manager access for each of the multiple registered devices.

Multi-role unlocking of a data storage device

Disclosed here is a data storage device comprising a non-transitory storage medium configured to store user content data, a data port configured to transfer the user content data between the storage medium and a host computer system over a data channel, and a controller. The controller is configured to select one of multiple file system formats, format the storage medium by creating a file system in accordance with the selected file system format on the storage medium, and register with the host computer system as a block data storage device.

Growing community of inventors

San Jose, CA, United States of America

Matthew Harris Klapman