Apparatus and method for securing data on a portable storage device
View Patent ↗A portable storage device including a microprocessor and a secure user data area, the microprocessor operable to perform on-the-fly encryption/decryption of secure data stored on the storage device under a user password, the microprocessor also operable to exclude access to the secure user data area unless the user password is provided.
1. A method for accessing a secure user area of a physical storage device, the method comprising:
performing by a physical storage device that has a physical storage medium including a clear user area and a secure user area, wherein the clear user area is in a first range of physical addresses in the storage medium, wherein the secure user area is in a second range of physical addresses in the storage medium, wherein the clear user area and the secure user area are physically separate areas in the storage medium, and wherein the physical storage device is operative to allow access to the clear user area without requiring a user password and to allow access to the secure user area only upon receiving the user password:
receiving the user password from a host device in communication with the physical storage device; and
performing at least one of (a) and (b):
(a) receiving data from the host device, performing on-the-fly encryption of the data, and storing the encrypted data in the secure user area; and
(b) reading encrypted data from the secure user area, performing on-the-fly decryption of the encrypted data, and sending the decrypted data to the host device.
2. The method of claim 1 further comprising determining that the user password is valid by comparing the user password with a stored password.
3. The method of claim 1 further comprising determining that the user password is valid by hashing the user password and comparing the hashed user password to a stored hashed password.
4. The method of claim 1 , wherein the physical storage device stores a key used for at least one of on-the-fly encryption and on-the-fly decryption.
5. The method of claim 4 , wherein the key is encrypted with the user password.
6. The method of claim 1 , wherein the physical storage device is operative to access the secure user area by offsetting a logical address received from the host device by an offset parameter before transforming the logical address to a physical address.
7. The method of claim 6 , wherein the offsetting is performed after the host device remounts the physical storage device.
8. The method of claim 1 further comprising configuring a size of the secure user area based on a request by a user.
9. The method of claim 8 , wherein the configuring is performed by a program stored in the physical storage device and executed by the physical storage device.
10. The method of claim 8 , wherein the configuring is performed only after determining that the user password is valid.
11. A physical storage device comprising:
an interface to a host device; and
a physical storage medium including a clear user area and a secure user area, wherein the clear user area is in a first range of physical addresses in the storage medium, wherein the secure user area is in a second range of physical addresses in the storage medium, and wherein the clear user area and the secure user area are physically separate areas in the storage medium;
wherein the physical storage device is operative to allow access to the clear user area without requiring a user password and to allow access to the secure user area only upon receiving the user password; and
wherein the physical storage device is further operative to:
receive the user password from the host device via the interface; and
perform at least one of (a) and (b):
(a) receive data from the host device, perform on-the-fly encryption of the data, and store the encrypted data in the secure user area; and
(b) read encrypted data from the secure user area, perform on-the-fly decryption of the encrypted data, and send the decrypted data to the host device.
12. The physical storage device of claim 11 , wherein the physical storage device is operative to determine that the user password is valid by comparing the user password with a stored password.
13. The storage device of claim 11 , wherein the physical storage device is operative to determine that the user password is valid by hashing the user password and comparing the hashed user password to a stored hashed password.
14. The storage device of claim 11 , wherein the physical storage medium stores a key used for at least one of on-the-fly encryption and on-the-fly decryption.
15. The storage device of claim 14 , wherein the key is encrypted with the user password.
16. The storage device of claim 11 , wherein the physical storage device is operative to access the secure user area by offsetting a logical address received from the host device by an offset parameter before transforming the logical address to a physical address.
17. The storage device of claim 16 , wherein the offsetting is performed after the host device remounts the physical storage device.
18. The storage device of claim 11 , wherein the physical storage device is operative to configure a size of the secure user area based on a request by a user.
19. The storage device of claim 18 , wherein the physical storage device is operative to configure the size of the secure user area by executing a program stored in the physical storage device.
20. The storage device of claim 18 , wherein the physical storage device is operative to configure the size of the secure user only after determining that the user password is valid.