Mechanism to manage access to user data area with bridged direct-attached storage devices
View Patent ↗The present invention provides a bridged, direct-attached storage device that can be secured and work with any host system. In one embodiment, the storage device is configured with a secured user area and an unlocking mechanism for access to the secured user area. The storage device may comprise a translation module having a bridge that presents multiple logical units to a host. In addition, the storage device may comprise a controller having its own encryption engine to encrypt the entire user area of the storage media. In one embodiment, the storage device presents the unlocking mechanism via a second logical device as a read-only device, such as a CD/DVD-ROM, or virtual CD device. The secondary logical device comprises executable code, which allows the user, for example, to enter, change, or remove the password and unlock the user area.
1. A method of accessing a storage device by a host device, wherein the storage device comprises at least one disk drive, and wherein the at least one disk drive comprises a user data area and a reserved area, said method comprising:
receiving a request for access to the user data area of the at least one disk drive, the user data area being encrypted;
mapping, through a translation module of the storage device, a logical device to the reserved area of the at least one disk drive, the logical device emulating another storage device;
routing the request to the logical device;
providing, to the host device, executable program code for receiving authentication information for access to the user data area, the executable program code stored on the reserved area, accessible by the host device through the logical device and executable by the host device; and
allowing access to the user data area based on the authentication information.
2. The method of claim 1 , wherein receiving the request for access to the user data area comprises receiving a serial ATA request that has been translated from a SCSI request.
3. The method of claim 1 , further comprising protecting the user data area of the at least one disk drive based on a password.
4. The method of claim 1 , further comprising protecting the user data area of the at least one disk drive based on an ATA password.
5. The method of claim 1 , further comprising protecting the user data area of the at least one disk drive based on encrypting the user data area.
6. The method of claim 1 , further comprising protecting the user data of the at least one disk drive based on encrypting the user data area with an encryption engine in a controller of the at least one disk drive.
7. The method of claim 1 , wherein receiving the request for access to the reserved area comprises receiving a request to an area of the at least one disk drive that is not addressable by the host device.
8. The method of claim 1 , wherein receiving the request for access to the reserved area comprises receiving an ATA log request.
9. The method of claim 1 , wherein receiving the request for access to the reserved area comprises receiving a request configured in a proprietary format.
10. A storage device configured to provide access by a host device to at least a secured portion of the storage device, said storage device comprising:
an interface configured for communications with a host device;
at least one storage medium comprising a reserved area and a user data area the user data area being encrypted;
a bridge circuit, coupled to the interface, configured to present the reserved area as a first logical unit and the user data area as a second logical unit; and
a controller, coupled to the bridge circuit, configured to process requests from the bridge circuit and provide access to the at least one storage medium, the controller comprising a translation module configured to map the first logical unit to the reserved area and provide program code from the reserved area to the host device for receiving authentication information and access the user data area via the second logical unit based on the authentication information, the program code executable by the host device.
11. The storage device of claim 10 , wherein the at least one storage medium comprises a user data area that is addressable based on logical block addresses provided from the host device.
12. The storage device of claim 10 , wherein the at least one storage medium comprises a user data area that is encrypted.
13. The storage device of claim 12 , wherein the controller comprises an encryption engine for encrypting the user data area of the at least one storage medium.
14. The storage device of claim 10 , wherein the bridge circuit is configured to present the first logical unit as a read-only device providing program code executable on the host device for receiving an ATA password.
15. The storage device of claim 10 , wherein the bridge circuit is configured to present the first logical unit as a virtual CD device.
16. The storage device of claim 10 , wherein the interface is configured to receive SCSI communications from the host device.
17. The storage device of claim 16 , wherein the bridge circuit is configured to translate the SCSI communications from the host device into SATA commands for the second logical unit.
18. The storage device of claim 16 , wherein the bridge circuit is configured to translate the SCSI communications from the host device into ATA Log commands for the first logical unit.
19. The storage device of claim 16 , wherein the bridge circuit is configured to translate the SCSI communications from the host device into proprietary commands for the first logical unit, wherein the commands are unique based on the bridge circuit.
20. A method of recovering access to a storage device by a host device, wherein the storage device comprises at least one disk drive, and wherein the at least one disk drive comprises a user data area and a reserved area, said method comprising:
receiving a request for access to the user data area of the at least one disk drive, the user data area being encrypted;
determining when an authentication attempt by a host device has failed for access to the user data area of the at least one disk drive;
receiving a request for access to the reserved area of the at least one disk drive;
presenting, through a translation module of the storage device, the reserved area of the at least one disk drive as a logical device that is independent of the user data area; and
providing, from the reserved area to the host device, executable program code for recovering access to the user data area, the executable program code executable by the host device.