Granted Patent B2

US 11,727,156 · App. 17/216,568 · Granted Aug 15, 2023

Inventors: Matthew Harris Klapman (San Jose, CA); Brian Edward Mastenbrook (Fremont, CA); Pongsanat Karmpeeraparpsontorn (Pathum Thani, TH); Thantham Panyayodrat (Chai Ya Phum, TH); Suksan Yaowaphak (Phra Nakhon Si Ayutthaya, TH)

Assignee: Western Digital Technologies, Inc.

G06F21/78G06F21/32G06F21/602G06F21/85G06F2221/0753

Abstract

Claims (71)

1. An in-line security device to transfer cryptographic key material, the in-line security device comprising:

a first connector configured to connect with a host device;

a second connector configured to connect with a data storage device;

a pass-through circuit between the first connector and the second connector to facilitate data communication between the host device and the data storage device, wherein the pass-through circuit comprises:

a first set of circuits configured to connect data transmit and receive pins of the first connector to data transmit and receive pins of the second connector for data communication between the host device and the data storage device; and

a second set of circuits configured to connect channel configuration pins of the first connector to channel configuration pins of the second connector; and

a communication interface configured to send, using the channel configuration pins of the second connector, a part of a plurality of parts of the cryptographic key material to a cryptography engine in the data storage device, wherein the cryptography engine is configured to decrypt, using a cryptographic key generated based on combining the plurality of parts of the cryptographic key material including the part of the plurality of parts of the cryptographic key material, encrypted data stored in a storage medium of the data storage device.

2. The in-line security device according to claim 1 , wherein the communication interface is further configured to decouple the channel configuration pins of the first connector from the channel configuration pins of the second connector prior to sending the part of the cryptographic key material.

3. The in-line security device according to claim 1 , further comprising at least one processor configured to:

receive a request to send the part of the plurality of parts of the cryptographic key material; and

responsive to receiving the request, send the part of the plurality of parts of the cryptographic key material to the data storage device via the second connector.

4. The in-line security device according to claim 1 , further comprising:

at least one processor configured to:

receive authentication data or at least part of the cryptographic key material;

verify that the received authentication data or the at least part of the cryptographic key material corresponds to a record in an authentication data set; and

based on verification of the received authentication data or the at least part of the cryptographic key material, send the part of the plurality of parts of the cryptographic key material to the data storage device via the second connector.

5. The in-line security device according to claim 1 , wherein the pass-through circuit further comprises a third set of circuits configured to connect power pins of the first connector to power pins of the second connector to enable power communication between the host device and the data storage device.

6. The in-line security device according to claim 1 , further comprising:

a biometric scanner device configured to read biometric data of a user, wherein the communication interface is further configured to send, based on the biometric data, the part of the plurality of parts of the cryptographic key material to the data storage device.

7. The in-line security device according to claim 6 , wherein the biometric scanner device is a fingerprint scanner.

8. The in-line security device according to claim 6 , wherein the cryptographic key material is, at least in part, based on the read biometric data.

9. The in-line security device according to claim 6 , further comprising:

a processor configured to:

receive the biometric data;

verify that the received biometric data corresponds to a record in a biometric authentication data set; and

based on verification of the received biometric data, send the part of the plurality of parts of the cryptographic key material to the data storage device via the communication interface and the second connector.

10. The in-line security device according to claim 1 , wherein:

the cryptographic key material is a first cryptographic key material configured to enable access to a first corresponding portion of the storage medium in the data storage device; and

a second cryptographic key material is configured to enable access to a second corresponding portion of the storage medium in the data storage device.

11. The in-line security device according to claim 1 , further comprising a memory configured to store first cryptographic key material, wherein:

the plurality of parts of the cryptographic key material includes the first cryptographic key material;

the first cryptographic key material is a part of a combined cryptographic key; and

the cryptography engine is further configured to use the combined cryptographic key as the cryptographic key for decrypting encrypted data stored in the storage medium of the data storage device.

12. The in-line security device according to claim 11 , wherein:

a second in-line security device is configured to store second cryptographic key material for the combined cryptographic key;

the second in-line security device is configured to connect to the first connector and the host device; and

the pass-through circuit is further configured to facilitate communication of the second cryptographic key material between the first connector and the second connector.

13. A data storage device comprising:

means for selectively connecting to an in-line security device, the in-line security device comprising:

a first connector configured to connect with a host device;

a second connector configured to connect with the means for selectively connecting to the in-line security device; and

a pass-through circuit between the first connector and the second connector to facilitate data communication between the host device and the data storage device, wherein the pass-through circuit comprises:

a first set of circuits configured to connect data transmit and receive pins of the first connector to data transmit and receive pins of the second connector for data communication between the host device and the data storage device; and

a second set of circuits configured to connect channel configuration pins of the first connector to channel configuration pins of the second connector;

means for receiving, using the channel configuration pins of the second connector, at least part of cryptographic key material from the in-line security device;

means for storing data configured to store user content data; and

means for cryptography, wherein access to the means for storing data is enabled by the means for cryptography:

receiving a part of a plurality of parts of the cryptographic key material from the in-line security device; and

decrypting, using a cryptographic key generated based on combining the plurality of parts of the cryptographic key material including the part of the plurality of parts of the cryptographic key material, encrypted user content data stored in the means for storing data.

14. The data storage device according to claim 13 , wherein the means for cryptography is configured to use the cryptographic key material to, at least in part, encrypt and decrypt the user content data stored on the means for storing data.

15. The data storage device according to claim 13 , further comprising:

means for sending, via the means for selectively connecting to an in-line security device, a request for the part of the plurality of parts of the cryptographic key material.

16. The data storage device according to claim 13 , wherein the means for cryptography further comprises:

means for receiving the plurality of parts of the cryptographic key material from a plurality of in-line security devices; and

means for combining the plurality of parts of the cryptographic key material to generate a combined cryptographic key, wherein the means for cryptography uses the combined cryptographic key as the cryptographic key.

17. The data storage device according to claim 13 , wherein the means for cryptography further comprises:

means for receiving a plurality of cryptographic key material, wherein each of the plurality of cryptographic key material enables access to a corresponding portion of the means for storing data.

18. A method for a data storage device to communicate with a host device, the method comprising:

storing cryptographic key material in an in-line security device;

communicatively coupling, via wire, the host device to a first connector of the in-line security device;

communicatively coupling, via wire, the data storage device to a second connector of the in-line security device;

sending, through a pass-through circuit between the first connector and the second connector, data communication between the host device and the data storage device, wherein the pass-through circuit comprises:

a first set of circuits configured to connect data transmit and receive pins of the first connector to data transmit and receive pins of the second connector for data communication between the host device and the data storage device; and

a second set of circuits configured to connect channel configuration pins of the first connector to channel configuration pins of the second connector;

sending, using the channel configuration pins of the second connector, a part of a plurality of parts of the cryptographic key material from the in-line security device to the data storage device; and

responsive to receiving the cryptographic key material, enabling data communication to a storage medium of the data storage device by decrypting, using a cryptographic key generated based on combining the plurality of parts of the cryptographic key material including the part of the plurality of parts of the cryptographic key material, encrypted user content data stored in the storage medium of the data storage device.

19. The method according to claim 18 , further comprising:

reading, with a biometric reader in the in-line security device, biometric data of a user, wherein the cryptographic key material is based on the biometric data.

20. The method according to claim 18 , further comprising:

receiving, by the in-line security device, authentication data; and

verifying, by the in-line security device, that the received authentication data corresponds to a record in an authentication data set, wherein sending the part of the plurality of parts of the cryptographic key material to the data storage device is based on verification of the received authentication data.

Assignments (11)

Continuity (1)

Cited By (1)

US 12,536,343