Secure control of self-encrypting storage devices
View Patent ↗Generally, this disclosure provides systems, devices, methods and computer readable media for secure control of access control enablement and activation on self-encrypting storage devices. In some embodiments, the device may include a non-volatile memory (NVM) and a secure access control module. The secure access control module may include a command processor module configured to receive a request to enable access controls of the NVM from a user, and to enable the access controls. The secure access control module may also include a verification module configured to verify a physical presence of the user. The secure access control module may further include an encryption module to encrypt at least a portion of the NVM in response to an indication of success from the verification module.
1. A storage device comprising:
a non-volatile memory (NVM); and
secure access control circuitry configured to:
store a Manufacturer Security Identifier (MSID) having a MSID value;
store a Security Identifier (SID) having an SID value, wherein said SID value is initially equal to said MSID value;
receive a request to enable access controls of said NVM, from a user, and to enable said access controls;
in response to said request to enable said access controls, change said SID value to a randomly generated value; and
verify a physical presence of said user using a Physical Security Identifier (PSID), wherein:
when said verification is successful, said SID value is restored to said MSID value and at least a portion of said NVM is capable of encryption; and
when said verification is not successful, said SID value remains said randomly generated value and said request to enable said access controls is denied.
2. The storage device of claim 1 , wherein said secure access control circuitry implements Opal Storage Specification access controls.
3. The storage device of claim 1 , further comprising a random number generator to generate said randomly generated value.
4. The storage device of claim 1 , wherein said PSID is associated with said storage device.
5. The storage device of claim 4 , wherein said PSID is displayed on a housing of said storage device.
6. The storage device of claim 1 , wherein said secure access control circuitry configures said access controls of said NVM if said verification of said physical presence is successful.
7. The storage device of claim 1 , wherein said NVM is a solid state drive (SSD).
8. The storage device of claim 1 , wherein said secure access control circuitry communicates with a host system through an interface module and a storage bus, said interface module to implement one of a Serial Advanced Technology Attachment (SATA) interface, a Serial Attached Small Computer System (SAS) Interface, a Peripheral Component Interconnect Express (PCIe) interface, a Universal Flash Storage (UFS) interface or an embedded Multimedia Controller interface (eMMC).
9. A method for secure control of a storage device, said method comprising:
receiving a request, from a user, to enable access controls of a non-volatile memory (NVM) of said storage device;
in response to said request to enable said access controls, changing a Security Identifier (SID) associated with said storage device to a randomly generated value and enabling said access controls;
verifying a physical presence of said user using a Physical Security Identifier (PSID);
when said verification is successful, restoring said SID to a Manufacturer Security Identifier (MSID) and encrypting at least a portion of said NVM;
when said verification is not successful, said SID retains said randomly generated value and said request to enable said access controls is denied.
10. The method of claim 9 , wherein said storage device implements Opal Storage Specification access controls.
11. The method of claim 9 , wherein said PSID is displayed on a housing of said storage device.
12. The method of claim 9 , further comprising allowing configuration of said access controls of said NVM in response to success of said verifying.
13. A mobile platform comprising:
a processor;
a display element coupled to said processor; and
a solid state drive (SSD) storage device coupled to said processor, said SSD comprising:
a non-volatile memory (NVM); and
secure access control circuitry configured to:
store a Manufacturer Security Identifier (MSID) having a MSID value;
store a Security Identifier (SID) having an SID value, wherein said SID value is initially equal to said MSID value;
enable access controls of said NVM in response to a request from said processor;
in response to said request to enable said access controls, change said SID value to a randomly generated value; and
verify a physical presence of a user using a Physical Security Identifier (PSID), wherein:
when said verification is successful, said SID value is restored to said MSID value and at least a portion of said NVM is capable of encryption; and
when said verification is not successful said SID value remains said randomly generated value and said request to enable said access controls is denied.
14. The mobile platform of claim 13 , wherein said secure access control circuitry implements Opal Storage Specification access controls.
15. The mobile platform of claim 13 , wherein said PSID is associated with said storage device.
16. The mobile platform of claim 15 , wherein said PSID is displayed on a housing of said storage device.
17. The mobile platform of claim 13 , wherein said secure access control circuitry configures said access controls of said NVM if said verification of said physical presence is successful.
18. The mobile platform of claim 13 , wherein said secure access control circuitry communicates with said processor through an interface module and a storage bus, said interface module to implement one of a Serial Advanced Technology Attachment (SATA) interface, a Serial Attached Small Computer System (SAS) Interface, a Peripheral Component Interconnect Express (PCIe) interface, a Universal Flash Storage (UFS) interface or an embedded Multimedia Controller interface (eMMC).
19. The mobile platform of claim 13 , wherein said mobile platform is a smart phone, smart tablet, notebook or laptop computer.