One-time programmable features for storage devices
Systems and methods are provided for implementing one-time programmable features for storage devices. In some embodiments, an Information Handling System (IHS) may include: a processor; and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution, cause the IHS to: initialize a one-time programmable (OTP) security storage device; and transmit a command to the OTP security storage device, where the OTP security device is configured to be set in security or non-security mode in response to the command, and where the OTP security storage device is configured to deny or ignore any subsequent command to set the OTP security storage device in a security mode or a non-security mode.
1. An Information Handling System (IHS), comprising:
a processor;
a data storage device; and
a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution, cause the IHS to:
initialize the data storage device as a one-time programmable (OTP) security storage device;
transmit a command to the OTP security storage device, wherein the command comprises an instruction to change a secure identification (SID) personal identification number (PIN) of the OTP security storage device, wherein the OTP security storage device is configured to be set in security mode in response to the command comprising the instruction to change the SID PIN of the OTP security storage device, wherein the OTP security storage device is configured to deny or ignore any subsequent command to set the OTP security storage device in a security mode or a non-security mode, wherein to deny or ignore any subsequent command, the OTP security storage device is configured with a secure memory area reserved to indicate whether the OTP security storage device is in the security mode or the non-security mode, wherein an initial OTP security state of the secure memory area is configured by the supplier of the OTP security storage device to an unprogrammed security state; and
generate an encrypted locking key to prevent user access to the OTP security storage device, wherein the encrypted locking key is stored in the secured memory area.
2. The IHS of claim 1 , wherein the secure memory area is not directly accessible by the processor.
3. The IHS of claim 1 , wherein to deny or ignore any subsequent command, the OTP security storage device is configured with one-time fusible link.
4. The IHS of claim 1 , wherein the command comprises an instruction to set the OTP security storage device as a Trusted Computing Group Secure Encrypting Drive (TCG-SED) drive.
5. The IHS of claim 1 , wherein the command comprises an instruction to change a secure identification (SID) personal identification number (PIN) of the OTP security storage device, and wherein the OTP security storage device is configured to be set in the security mode in response to the command.
6. The IHS of claim 1 , wherein the program instructions, upon execution, further cause the IHS to:
transmit a discovery command to the OTP security storage device; and
in response to the transmission, receive: (a) an indication of whether the OTP security storage device supports the security and non-security modes, (b) a current programming state of the OTP security storage device, and (c) a current security state of the OTP security storage device.
7. The IHS of claim 6 , wherein the program instructions, upon execution, further cause the IHS to, in response to the transmission, receive: (d) an indication of how the OTP security storage device was programmed.
8. A memory storage device having program instructions stored thereon that, upon execution by a controller of a one-time programmable (OTP) security storage device, wherein the OTP security storage device comprises a data storage device configured with a secure memory area reserved to indicate whether the data storage device is in security or non-security mode, cause the OTP security storage device to:
receive a command from an Information Handling System (IHS), wherein the command comprises an instruction to change a secure identification (SID) personal identification number (PIN) of the OTP security storage device, and wherein the SID PIN change is based on context information determined by sensors coupled to the IHS, wherein the context information for the SID PIN change comprises at least one of: a distance between a user of the IHS and the IHS, a posture of the IHS, or a lid state of the IHS; and
enter a security mode in response to the command comprising the instruction to change the SID PIN of the OTP security storage device.
9. The memory storage device of claim 8 , wherein the program instructions, upon execution by the controller, further cause the OTP security storage device to deny or ignore any subsequent command to set the OTP security storage device in security or non-security mode.
10. The memory storage device of claim 8 , wherein the secure memory area is not directly accessible by a processor of the IHS.
11. The memory storage device of claim 8 , wherein the command comprises an instruction to set the OTP security storage device as a Trusted Computing Group Secure Encrypting Drive (TCG-SED) drive.
12. The memory storage device of claim 8 , wherein the program instructions, upon execution, further cause the OTP security storage device to:
receive a discovery command from the IHS; and
in response to the discovery command, transmit to the IHS: (a) an indication of whether the OTP security storage device supports the security and non-security modes, (b) a current programming state of the OTP security storage device, (c) a current security state of the OTP security storage device, and (d) an indication of how the OTP security storage device was programmed.
13. A method, comprising:
determining, by a drive controller, that a data storage device coupled to the drive controller is not programmed to operate in a mode of operation, wherein the data storage device is configured with a secure memory area reserved to indicate the mode of operation;
receiving, at the drive controller, a command issued by a processor of an Information Handling System (IHS);
in response to: (a) determining that the data storage device has not been programmed to operate in the mode of operation, and (b) receiving the command, permanently removing all Trusted Computer Group Secure Encrypting Drive (TCG-SED) commands from a list of commands processable-by the drive controller, and setting the data storage device in a non-security mode of operation; and
automatically denying or ignoring any subsequent command to set the data storage device in a different mode operation.
14. The method of claim 13 , further comprising, prior to setting the data storage device in the mode of operation, determining that the command indicates a user's intent to set the data storage device in the mode of operation.
15. The method of claim 13 , further comprising:
receiving a discovery command from the IHS; and
in response to the discovery command, transmitting to the IHS at least one of: (a) an indication of whether the data storage device supports the mode and the other mode, (b) a current mode of the data storage device, or (c) an indication of how the data storage device was programmed.