Self-encryption drive (SED)

1. A method for crypto-erasing a self-encryption drive (SED) by deleting all instances of a media encryption key (MEK) stored by the SED, wherein the SED comprises (i) a volatile memory and (ii) non-volatile storage media, the method comprising:

receiving the MEK from a key management server;

storing the MEK received from the key management server only in the volatile memory of the SED;

encrypting data for storage in the non-volatile storage media of the SED based on the;

erasing the MEK in the volatile memory of the SED to crypto-erase the SED,

wherein receiving the MEK comprises receiving a timestamp associated with the MEK from the key management server which indicates whether the MEK is expired; and

determining whether a difference between the timestamp associated with the MEK and another timestamp is less than a certain duration and wherein storing the MEK only in the volatile memory of the SED comprises storing the MEK if the difference is less than the certain duration.

2. The method of claim 1 , wherein the MEK stored only in the volatile memory of the SED is erased when the SED is not powered by a host computer coupled to the SED.

3. The method of claim 1 , further comprising receiving the other timestamp from a timestamp authority server remote to the SED or a timer counter register of the SED.

4. The method of claim 1 , wherein the MEK is generated by the key management server.

5. The method of claim 4 , wherein the stored MEK is wrapped by a key associated with a password of a user associated with the SED.

6. A method for crypto-erasing a self-encryption drive (SED) by deleting all instances of a media encryption key (MEK) stored by the SED, wherein the SED comprises (i) a volatile memory and (ii) non-volatile storage media, the method comprising:

receiving the MEK from a key management server;

storing the MEK received from the key management server only in the volatile memory of the SED;

encrypting data for storage in the non-volatile storage media of the SED based on the;

erasing the MEK in the volatile memory of the SED to crypto-erase the SED; and

accessing a block chain which stores an indication of whether the SED is decommissioned and wherein storing the MEK on the SED only in the volatile memory of the SED comprises storing the MEK only in the volatile memory of the SED if the indication indicates that the SED is not decommissioned.

7. A non-transitory computer-readable medium storing instructions for crypto-erasing a self-encryption drive (SED) by deleting all instances of a media encryption key (MEK) stored by the SED, the instructions when executed by one or more processors, cause the one or more processors to at least:

receive the MEK from a key management server;

store the MEK received from the key management server only in volatile memory of the SED, wherein no version of the MEK is stored in non-volatile memory in either an encrypted or unencrypted format;

encrypt data for storage in non-volatile storage media of the SED based on the MEK stored only in the volatile memory;

erase the MEK in the volatile memory of the SED to crypto-erase the SED,

wherein the MEK is associated with a timestamp which indicates whether the MEK is expired; and

determine whether a difference between the timestamp associated with the MEK and another timestamp is less than a certain duration and wherein the instructions to store the MEK only in the volatile memory of the SED comprise instructions to store the MEK if the difference is less than the certain duration.

8. The non-transitory computer-readable medium of claim 7 , wherein the MEK stored only in the volatile memory of the SED is erased when the SED is not powered by a host computer coupled to the SED.

9. The non-transitory computer-readable medium of claim 7 , further comprising instructions to receive the other timestamp from a timestamp authority server remote to the SED or a timer counter register of the SED.

10. The non-transitory computer-readable medium of claim 7 , wherein the MEK is associated with a range addressed by logical block addresses (LBAs) of the non-volatile storage media of the SED.

11. A non-transitory computer-readable medium storing instructions for crypto-erasing a self-encryption drive (SED) by deleting all instances of a media encryption key (MEK) stored by the SED, the instructions when executed by one or more processors, cause the one or more processors to at least:

receive the MEK from a key management server;

store the MEK received from the key management server only in volatile memory of the SED, wherein no version of the MEK is stored in non-volatile memory in either an encrypted or unencrypted format;

encrypt data for storage in non-volatile storage media of the SED based on the MEK stored only in the volatile memory;

erase the MEK in the volatile memory of the SED to crypto-erase the SED; and

access a block chain which stores an indication of whether the SED is decommissioned and wherein the instructions to store the MEK on the SED only in the volatile memory of the SED comprises instructions to store the MEK only in the volatile memory of the SED if the indication indicates that the SED is not decommissioned.

12. A self-encryption drive (SED) arranged to delete all instances of a media encryption key (MEK) stored by the SED to crypto-erase the SED, the SED comprising:

a volatile memory;

a non-volatile storage media;

instructions stored in memory of the SED, when executed by one or more processors of the SED, cause the SED to at least:

receive the MEK from a key management server;

store the MEK received from the key management server only in the volatile memory of the SED;

encrypt data for storage in the non-volatile storage media of the SED based on the MEK; and

erase the MEK in the volatile memory of the SED to crypto-erase the SED,

wherein the MEK is associated with a timestamp which indicates whether the MEK is expired; and

instructions to determine whether a difference between the timestamp associated with the MEK and another timestamp is less than a certain duration and wherein the instructions to store the MEK only in the volatile memory of the SED comprises instructions to store the MEK if the difference is less than the certain duration.

13. The SED of claim 12 , wherein the MEK is associated with a timestamp which indicates whether the MEK is expired.

14. The SED of claim 12 , further comprising instructions to receive the other timestamp from a timestamp authority server remote to the SED or a timer counter register of the SED.

15. A self-encryption drive (SED) arranged to delete all instances of a media encryption key (MEK) stored by the SED to crypto-erase the SED, the SED comprising:

a volatile memory;

a non-volatile storage media;

instructions stored in memory of the SED, when executed by one or more processors of the SED, cause the SED to at least:

receive the MEK from a key management server;

store the MEK received from the key management server only in the volatile memory of the SED, wherein no version of the MEK is stored in the non-volatile storage media in either an encrypted or unencrypted format;

encrypt data for storage in the non-volatile storage media of the SED based on the MEK;

erase the MEK stored only in the volatile memory of the SED to crypto-erase the SED; and

access a block chain which stores an indication of whether the SED is decommissioned and wherein the instructions to store the MEK on the SED only in the volatile memory of the SED comprises instructions to store the MEK only in the volatile memory of the SED if the indication indicates that the SED is not decommissioned.