Method and system for secure data storage
View Patent ↗A secure storage device includes a storage medium configured to securely store data received from a host. The storage device further includes a host interface configured to transfer data between the host and the storage device and an encryption engine. The encryption engine is configured to encrypt data received from a host using a key and provide the encrypted data to the storage medium for storage. The encryption engine is further configured to decrypt encrypted data received from the storage medium and provide the data to the host via the host interface. In response to a predetermined condition, the storage device is configured to disable the encryption engine thereby preventing the encrypted data stored thereon from being decrypted.
1. A storage device comprising:
a host interface configured to transfer data between a host and said storage device;
a storage medium configured to store data transferred from the host;
a seed interface configured to access a seed value; and
an encryption engine configured to receive data from the host via said host interface, access the seed value via the seed interface, generate a key based on the seed value, encrypt the data using the key, and provide the encrypted data to said storage medium for storage, said encryption engine further configured to receive the encrypted data from said storage medium, decrypt the encrypted data using the key, and provide the data to the host via said host interface,
wherein the storage device is configured to instruct the seed interface to become inoperable, in response to a predetermined condition corresponding to a security risk to the storage device,
wherein said storage device further comprises a storage location for storing the seed value,
wherein said storage device is further configured to erase the seed value from said storage location in response to the predetermined condition, and
wherein said storage device is configured to disable at least part of the key in response to the predetermined condition.
2. The storage device of claim 1 , wherein said encryption engine is configured to generate the key based on a password.
3. The storage device of claim 2 , wherein the password is received from the host via said host interface.
4. The storage device of claim 1 , wherein the key is generated by said encryption engine for each access by the host to said storage device.
5. The storage device of claim 1 , wherein said encryption engine comprises a plurality of functional logic blocks, wherein said encryption engine is further configured to modify one or more of the functional logic blocks in response to the predetermined condition.
6. The storage device of claim 1 , wherein said encryption engine comprises executable code, wherein said encryption engine is further configured to modify a portion of the executable code in response to the predetermined condition.
7. The storage device of claim 1 , wherein said storage medium is a Flash memory.
8. A secure storage system, comprising:
a host; and
a storage device, said storage device further comprising:
a host interface configured to transfer data between said host and said storage device;
a storage medium configured to store data transferred from said host;
a seed interface configured to access a seed value; and
an encryption engine configured to receive data from the host via said host interface, access the seed value via the seed interface, generate a key based on the seed value, encrypt the data using the key, and provide the encrypted data to said storage medium for storage, said encryption engine further configured to receive the encrypted data from said storage medium, decrypt the encrypted data using the key, and provide the data to the host via said host interface,
wherein the storage device is configured to instruct the seed interface to become inoperable, in response to a predetermined condition corresponding to a security risk to the storage device,
wherein said storage device further comprises a storage location for storing the seed value,
wherein said storage device is further configured to erase the seed value stored in said storage location in response to predetermined condition, and
wherein said storage device is configured to disable at least part of the key in response to the predetermined condition.
9. The secure storage system of claim 8 , wherein said encryption engine is configured to generate the key based on a password.
10. The secure storage system of claim 9 , wherein the password is received from said host via said host interface.
11. The secure storage system of claim 8 , wherein the key is generated by said encryption engine for each access by said host to said storage device.
12. The secure storage system of claim 8 , wherein said encryption engine comprises a plurality of functional blocks, wherein said encryption engine is further configured to modify one or more of the functional blocks in response to the predetermined condition.
13. The secure storage system of claim 8 , wherein said encryption engine comprises executable code, wherein said encryption engine is further configured to modify a portion of the executable code in response to the predetermined condition.
14. The secure storage system of claim 8 , wherein said storage medium is a Flash memory.
15. A method for securely storing data, the method comprising the steps of:
receiving a command from a host;
accessing a seed value via a seed interface;
generating a key based on the seed value;
if the command is a read command, decrypting encrypted data retrieved from a storage medium using the key and providing the decrypted data to the host;
if the command is a write command, encrypting data received from the host using the key and storing the encrypted data within a storage medium; instructing the seed interface to become inoperable, in response to a predetermined condition corresponding to a security risk to storage;
storing the seed value in a storage location;
erasing the seed value stored in the storage location in response to the predetermined condition; and
disabling at least part of the key in response to the predetermined condition.
16. The method of claim 15 , wherein the key is generated based on a password.
17. The method of claim 15 , wherein the key is generated for each read and write command received from the host.
18. The method of claim 15 , further comprising the step of modifying, in response to the predetermined condition, at least one of a plurality of functional blocks used to encrypt and decrypt data.
19. The method of claim 15 , further comprising the step of modifying, in response to the predetermined condition, at least one portion of software used to encrypt and decrypt data.
20. The method of claim 15 , wherein the storage medium is Flash memory.