Abstract: A system for providing high security for data stored in memories in computer systems is disclosed. A different encryption key is used for every memory location, and a write counter hides rewriting of the same data to a given location. As a result, the data for every read or write transaction between the microprocessor and the memory is encrypted differently for each transaction for each address, thereby providing a high level of security for the data stored.

Abstract: A method of protecting information in a data storage device is provided. The method includes receiving, in the data storage device, encrypted data via a host computer in which the data storage device is employed. The encrypted data is then decrypted, and re-encrypted, in the data storage device, either before storage or just before data is transferred back to the host computer. The decryption and re-encryption (transcription) is performed substantially independently of the host computer. In addition, a data storage device, readable by a computer system, for implementing the above method for protecting information is provided.

Abstract: An apparatus includes a first counter for counting successive bits representative of a logic 1, and a second counter for counting successive bits representative of a logic 0, wherein a first predetermined count on the first counter or a second predetermined count on the second counter indicates a randomness failure. A method for testing randomness performed by the apparatus is also included.

Abstract: An apparatus includes: a plurality of bit producing circuits; a controller setting a sample frequency at which bits from the bit producing circuits are sampled; and a plurality of test circuits determining if bits sampled from each of the bit producing circuits are random, wherein the controller adjusts the sample frequency if the test circuits determine that the sampled bits are not random. A method performed by the apparatus is also included.

Abstract: Devices and methods are disclosed for improved random number generation. In some embodiments, a device may include a plurality of registers configured to store channel filter coefficients, each of the channel filter coefficients including a plurality of bits, and a controller configured to retrieve at least one channel filter coefficient from the plurality of registers, and to generate a random number based at least in part on the at least one retrieved channel filter coefficient. The device may generate a random number at least in part based on a number of least-significant bits of the at least one retrieved channel filter coefficient.

Abstract: A random number generation system comprising one or more ring oscillators configured to generate entropy due to accumulated phase drift. A random number generator can include a ring oscillator configured to switch between a first state in which a signal of the ring oscillator oscillates between logic levels, and a second state in which the signal at least partially settles to one of the logic levels. The random number generator can also include a counter configured to measure a count of pulses of the signal and a whitener mechanism configured to receive the signal from the ring oscillator, latch a logic level of the signal from the ring oscillator, latch the count of pulses from the counter, and generate a random number based on the logic level and the count of pulses. Corresponding methods may also be performed.

Abstract: An apparatus includes an oscillator, a counter for counting pulses, and a latch for latching a count from the counter in response to changes in a logic level of an output of the oscillator. The apparatus can further include an edge detector for producing a latching signal in response to changes in the logic level of the output of the oscillator.

Abstract: A method includes: computing a first message authentication code for each of a plurality of sets of data blocks on a data storage medium, and authenticating the sets of data blocks by computing a second message authentication code for each of the sets of data blocks to be authenticated and comparing the first and second message authentication codes. An apparatus that performs the method is also provided.

Abstract: A system for providing high security for data stored in memories in computer systems is disclosed. A different encryption key is used for every memory location, and a write counter hides rewriting of the same data to a given location. As a result, the data for every read or write transaction between the microprocessor and the memory is encrypted differently for each transaction for each address, thereby providing a high level of security for the data stored.

Abstract: Method and apparatus for writing data to a non-volatile memory device, such as a solid state drive (SSD). In accordance with various embodiments, a host write command is serviced by writing a newer copy of user data to a first selected empty physical location in a non-volatile memory, and by concurrently overwriting an older copy of said user data previously stored to a different, second selected occupied physical location of the non-volatile memory.

Abstract: Apparatus and method for providing data security through cascaded encryption. In accordance with various embodiments, input data are encrypted in relation to a first auxiliary data value to provide first level ciphertext. The first level ciphertext are encrypted using a second auxiliary data value associated with a selected physical location in a memory to produce second level ciphertext, which are thereafter stored to the selected physical location. In some embodiments, migration of the stored data to a new target location comprises partial decryption and re-encryption of the data using a third auxiliary data value associated with a new target physical location to produce third level ciphertext, and the storage of the third level ciphertext to the new target physical location.

Abstract: Method and apparatus for the non-destructive, selective purging of data from a non-volatile memory. In accordance with various embodiments, multiple copies of a selected set of confidential user data having a common logical address are stored to a confidential data portion of a non-volatile memory so that each copy is in a different location within the confidential data portion. A nondestructive purge of all said copies from the confidential data portion is carried out responsive to an externally supplied selective purge command so that all said copies are erased and other, non-purged confidential user data remain stored in the confidential data portion.

Abstract: A storage device has a storage medium, a set of credentials stored on the storage medium, and a controller. The controller within the storage device is coupled to the storage medium, and adapted to identify security status of the storage device. The controller is adapted to alter one or more credentials of the set of credentials responsive to the security status.

Abstract: Method and apparatus for sanitizing a memory using bit-inverted data. In accordance with various embodiments, a memory location is sanitized by sequential steps of reading a bit value stored in a selected memory cell of the memory, inverting the bit value, and writing the inverted bit value back to the selected memory cell. The memory cell may be erased between the reading and writing steps, as well as after the writing step. Random bit values may be generated and stored to the memory cell, and run-length limited constraints can be used to force bit-inversions.

Abstract: Methods of securely authenticating a host to a storage system are provided. A series of authentication sessions are illustratively performed. Each of the authentication sessions includes the host transmitting an authentication request to the storage system. The storage system authenticates the host based at least in part upon a content of the authentication request. After each successful authentication of the host to the storage system, an encryption key that was utilized in encrypting the authentication request that was transmitted to the storage system is deleted. After each encryption key deletion, a new encryption key that is different than the previous key is optionally stored and is utilized in the next authentication session.

Abstract: Various quality versions of an electronic content are defined, and one or more distortion algorithms (22, 32) that are executable to generate a lower quality version of the electronic content by a distortion of the highest quality version (21, 31) are defined. Each quality version is selectively assigned a content key (CK) whereby an electronic content player (34, 70) will have the appropriate information when decrypting, decoding, and/or distorting the highest quality version (21, 31) of the electronic content.

Abstract: A device comprising a controller configured to retrieve at least one channel filter coefficient from a plurality of registers, and to generate a random number based at least in part on the at least one retrieved channel filter coefficient.

Abstract: A random number generation system comprising one or more ring oscillators configured to generate entropy due to accumulated phase drift.

Abstract: A method for generating a root key is described. Stable bits of a plurality of comparator outputs are identified. The root key is selected from a number of the identified stable bits. A statistically unique value is calculated from the root key using a cryptographically secure function. An identifier of the identified stable bits and the statistically unique value are stored in a memory.

Abstract: An electronic system comprises a processor, a diagnostic port, and a switching circuit, including a switch connected between the diagnostic port and the processor, for enabling and disabling the diagnostic port and for restricting access to contents of the electronic system prior to enabling the diagnostic port. A method for operating the electronic system is also included.