Seagate Technology Incorporated

Monty Aaron Forehand

Manuel A Offenberg

Christopher J DeMattio

Mark A Gaertner

Laszlo Hars

Donald Preston Matthews, Jr

Jon David Trantham

William Erik Anderson

David R Kaiser

Nino Wicaksono

Krishna Rameshwara Malakapalli

William C Little

Muhammad Jawad Alam Wahla

Dallas W Meyer

Robert Wayne Moss

Navneeth Kankani

Abhay Tejmal Kataria

Michael B Danielson

Rodney Virgil Bowman

Mark Alan Heath

Donald Rozinak Beaver

Charles William Thiesfeld

David Bruce Anderson

David R Street

William Preston Goodwill

Paul William Burnett

Jack W Flinsbaugh

Robert Edward Weinstein

Mukund Channagiri Rao

Tong Shirh Stone

Paul Michael Wiggins

Clyde Everett Goodner, Iii

Brian W Sudman

Anthony Ramon Duran

Joseph S Stoutenburgh

James Carl Hatfield, Jr

Meherzad Firoze Aga

Ronald D Metzner

Wajahat Ali

Todd Phillip Fracek

Donald B Douglas

YiNan Zhang

KianBeng Lim

Robert W Norman, Jr

Florence F Kung

Charles E Skeldon

Jason R Cox

Gopinath K Bendigeri

Hong Liu

Jimmie R Shaver, Jr

Chao Chen

WeiWei Feng

A distributed ledger is used by one or more parties executing a ledger node to document a lifecycle of a device. When devices are manufactured, shipped, and used, attestation transactions are recorded to the distributed ledger that identify the devices and include attestation information about the device. The distributed ledger further supports command transactions that are used to change the behavior of the device, such as unlocking capabilities on the device. The distributed ledger provides a history of device attestation and activation.

Device lifecycle distributed ledger

Apparatus and method for distributed authentication in a data storage system using block chain technology. In some embodiments, a requested transaction is generated to perform a selected security operation upon a data processing device in a computer network. The requested transaction is validated and propagated to a plurality of nodes. The nodes use a consensus mechanism to quasi-randomly select a particular node to generate a new block listing the requested transaction. The new block is validated, propagated among the plurality of nodes, and added to a block chain data structure. A processing node processes the requested transaction from the block chain data structure to authorize the selected security operation. Credits may be debited and credited between requesting nodes and the processing node for each transaction. Different types of credits may be used for different types of security operations.

Block chain based trusted security infrastructure

Apparatus and method for data security using adaptive selection of intrusion traps in relation to workload. In some embodiments, a data storage device has a non-volatile memory (NVM). A device controller circuit services data transfer commands received from a host device to transfer data between the host device and the NVM. A security controller circuit monitors the received data transfer commands and enacts a change in security policy to implement one or more intrusion traps associated with the NVM in response to the received data transfer commands. The intrusion traps constitute memory locations that are configured to normally store user data, but are not normally accessed during the servicing of the currently received data transfer commands.

Adaptive intrusion detection based on monitored data transfer commands

A method includes adding a key version tag to an encryption key store that stores encryption keys. The key version tag is inserted into a data stream. The data stream including the key version tag is written to media. The data in the data stream is erased by scrambling the encryption keys and incrementing the key version tag in the encryption store by a digit. The data stream is replaced with a replacement data pattern when the key version tag stored in the encryption store and the key version tag located in the data stream mismatch.

Tracking of data erasures

Apparatus and method for detecting unauthorized tampering with a data storage device having a housing and a memory. A first identifier value is stored on an external surface of the housing and a second identifier value is stored within the memory. The first and second identifier values are combined in a predetermined order to form a combined identifier value for which a digital signature is generated using a private key, and the digital signature is stored on the storage device. The digital signature, the first and second identifier values, and one or more dummy identification values are retrieved from the storage device and stored in a memory of a verification device, which combines the retrieved first and second identifier values in the predetermined order to generate a retrieved combined identifier value. The storage device is authenticated using the retrieved combined identifier value, the digital signature and a public key.

Storage device tampering detection

Apparatus and method for in situ authentication and diagnostic repair of a data storage device in a multi-device user environment. In accordance with some embodiments, the method includes detecting an error condition associated with a selected data storage device in the multi-device user environment. A first level of user authentication is established by providing a challenge value generated by the selected data storage device to a remote device over a network associated with the selected data storage device. A first diagnostic tool stored on the selected data storage device is executed responsive to receipt of the first level of user authentication. A second level of user authentication is established by providing a second challenge value generated by the selected data storage device to the remote device. An output from the first diagnostic tool is used to execute a second diagnostic tool stored on the selected data storage device.

In situ device authentication and diagnostic repair in a host environment

Systems and methods are disclosed for performing data sanitization at a data storage device (DSD). In an embodiment, an apparatus may comprise a controller configured to receive a data sanitization command from a host, perform a data sanitization operation to securely erase data from a memory, produce an attestation including information related to the data sanitization operation, and sign the attestation to produce a signed attestation. In another embodiment, a memory device may store instructions that cause a processor to perform a method comprising performing a data sanitization operation to securely erase data from a data storage medium, generating an attestation including information related to the data sanitization operation, and digitally signing the attestation using an authentication key.

Attestation of data sanitization

The present disclosure relates to feature activation using near field communication. In an embodiment, a device may include a chip to receive and store wireless communications. An activation package may be stored to the chip, and identify a set of features to enable or disable on the device. The device may include a processor to detect the activation package and initiate device operations based on the identified set of features. In some embodiments, the chip may receive and store information while the device is in a powered-off state, and the processor may detect the activation package at a power on event.

Feature activation using near field communication

The present disclosure relates to remote feature activation. In an embodiment, a device may be manufactured having firmware configured to implement multiple unique features on the device. Features may be enabled and disabled on the device later or at a remote location. Enabled features may allow the device to perform corresponding functions, and disabled features may not allow the device to perform corresponding functions. Remote feature activation may include exchanging security information between an activation entity and the device.

Remote feature activation

Apparatus and method for generating random numbers. In accordance with some embodiments, the apparatus comprises a random number generator circuit that generates a random number responsive to a total number of programming pulses used to transition a solid-state memory cell from a first programming state to a second programming state.

Random number generation using pulsed programming parameters

Apparatus and method for controlling access to protected functionality of a data storage device. In some embodiments, a plurality of identification (ID) values associated with a data storage device are combined to form a combined ID value. The combined ID value is cryptographically processed using a secret symmetric encryption key in combination with a hash function or a key derivation function to generate a unique device credential for the data storage device. The unique device credential is used as an input to a selected cryptographic function to control access to a protected function of the data storage device.

Device functionality access control using unique device credentials

Apparatus and method for data security through the use of an encrypted keystore data structure. In accordance with some embodiments, first and second sets of input data are respectively encrypted using first and second encryption keys to form corresponding first and second encrypted data sets. The first and second encryption keys are combined to form a string. A hidden key stored within a system on chip (SOC) is used to encrypt the string to form an encrypted keystore data structure, and the first and second encrypted data sets and the encrypted keystore data structure are stored in a memory.

Device security using an encrypted keystore data structure

Systems and methods are disclosed for performing data sanitization at a data storage device (DSD). In an embodiment, a controller may direct a memory device to sanitize data by securely erasing the data, generate an attestation confirming that the data was successfully sanitized, and sign the attestation using an authentication key to create a signed attestation. In another embodiment, a circuit may direct a memory device to sanitize data based on the data sanitization instruction, generate a sanitization confirmation indicating that the data was successfully sanitized, and provide the sanitization confirmation including a first thumbprint and a second thumbprint to another device. Generating the sanitization confirmation may include processing a first storage encryption key to produce the first thumbprint, directing the memory device to obliterate the first storage encryption key, and processing a second storage encryption key to produce the second thumbprint.

Random numbers are generated according to a variety of solutions. A particular solution relates to a method for generating the random number. A common start signal is provided to each of a plurality of inverter components of a ring oscillator circuit. This causes the ring oscillator circuit to enter a metastable mode. At least a first bit and a second bit of a random number are both generated in parallel. The parallel generation of the bits involves the generation of the first bit from entropic properties of a signal of a first one of the plurality of inverter components and the generation of the second bit from entropic properties of a signal of a second one inverter components.

Random number generation using startup variances

The disclosure is related systems and methods for using operation durations of a data storage medium to generate random numbers. In one embodiment, a device may comprise a random number generator circuit configured to store a value representing a duration of an operation on the data storage medium, and generate a random number based on the value. Another embodiment may be a method comprising recording durations of access operations to a data storage medium, and generating a random number based on the durations.

Using memory access times for random number generation

Growing community of inventors

Loveland, CO, United States of America

Monty Aaron Forehand