Abstract: A distributed ledger is used by one or more parties executing a ledger node to document a lifecycle of a device. When devices are manufactured, shipped, and used, attestation transactions are recorded to the distributed ledger that identify the devices and include attestation information about the device. The distributed ledger further supports command transactions that are used to change the behavior of the device, such as unlocking capabilities on the device. The distributed ledger provides a history of device attestation and activation.

Abstract: Apparatus and method for distributed authentication in a data storage system using block chain technology. In some embodiments, a requested transaction is generated to perform a selected security operation upon a data processing device in a computer network. The requested transaction is validated and propagated to a plurality of nodes. The nodes use a consensus mechanism to quasi-randomly select a particular node to generate a new block listing the requested transaction. The new block is validated, propagated among the plurality of nodes, and added to a block chain data structure. A processing node processes the requested transaction from the block chain data structure to authorize the selected security operation. Credits may be debited and credited between requesting nodes and the processing node for each transaction. Different types of credits may be used for different types of security operations.

Abstract: Apparatus and method for data security using adaptive selection of intrusion traps in relation to workload. In some embodiments, a data storage device has a non-volatile memory (NVM). A device controller circuit services data transfer commands received from a host device to transfer data between the host device and the NVM. A security controller circuit monitors the received data transfer commands and enacts a change in security policy to implement one or more intrusion traps associated with the NVM in response to the received data transfer commands. The intrusion traps constitute memory locations that are configured to normally store user data, but are not normally accessed during the servicing of the currently received data transfer commands.

Abstract: A method includes adding a key version tag to an encryption key store that stores encryption keys. The key version tag is inserted into a data stream. The data stream including the key version tag is written to media. The data in the data stream is erased by scrambling the encryption keys and incrementing the key version tag in the encryption store by a digit. The data stream is replaced with a replacement data pattern when the key version tag stored in the encryption store and the key version tag located in the data stream mismatch.

Abstract: Apparatus and method for data security using adaptive selection of intrusion traps in relation to workload. In some embodiments, a data storage device has a non-volatile memory (NVM). A device controller circuit services data transfer commands received from a host device to transfer data between the host device and the NVM. A security controller circuit monitors the received data transfer commands and enacts a change in security policy to implement one or more intrusion traps associated with the NVM in response to the received data transfer commands. The intrusion traps constitute memory locations that are configured to normally store user data, but are not normally accessed during the servicing of the currently received data transfer commands.

Abstract: A distributed ledger is used by one or more parties executing a ledger node to document a lifecycle of a device. When devices are manufactured, shipped, and used, attestation transactions are recorded to the distributed ledger that identify the devices and include attestation information about the device. The distributed ledger further supports command transactions that are used to change the behavior of the device, such as unlocking capabilities on the device. The distributed ledger provides a history of device attestation and activation.

Abstract: A method includes adding a key version tag to an encryption key store that stores encryption keys. The key version tag is inserted into a data stream. The data stream including the key version tag is written to media. The data in the data stream is erased by scrambling the encryption keys and incrementing the key version tag in the encryption store by a digit. The data stream is replaced with a replacement data pattern when the key version tag stored in the encryption store and the key version tag located in the data stream mismatch.

Abstract: Apparatus and method for generating random numbers. In accordance with some embodiments, the apparatus comprises a random number generator circuit that generates a random number responsive to a total number of programming pulses used to transition a solid-state memory cell from a first programming state to a second programming state.

Abstract: Random numbers are generated according to a variety of solutions. A particular solution relates to a method for generating the random number. A common start signal is provided to each of a plurality of inverter components of a ring oscillator circuit. This causes the ring oscillator circuit to enter a metastable mode. At least a first bit and a second bit of a random number are both generated in parallel. The parallel generation of the bits involves the generation of the first bit from entropic properties of a signal of a first one of the plurality of inverter components and the generation of the second bit from entropic properties of a signal of a second one inverter components.

Abstract: Methods, systems, and devices are described for a data storage device, such as a hard disk drive or solid state drive, that may be initially formatted to an initial capacity. The data storage device may continue to be formatted to add additional capacity to the device. In some examples, a data storage device may be shipped from a factory having an initial capacity, with formatting completed in the field. According to certain examples, the additional capacity may be provided to a user of the data storage device upon satisfaction of one or more conditions. For example, a user may purchase additional capacity, upon which the data storage device may be instructed to provide the additional capacity for use by the user.

Abstract: Apparatus and method for generating random numbers. In accordance with some embodiments, the apparatus comprises a random number generator circuit that generates a random number responsive to a total number of programming pulses used to transition a solid-state memory cell from a first programming state to a second programming state.

Abstract: The disclosure is related systems and methods for using operation durations of a data storage medium to generate random numbers. In one embodiment, a device may comprise a random number generator circuit configured to store a value representing a duration of an operation on the data storage medium, and generate a random number based on the value. Another embodiment may be a method comprising recording durations of access operations to a data storage medium, and generating a random number based on the durations.

Abstract: Method and apparatus for the non-destructive, selective purging of data from a non-volatile memory. In accordance with various embodiments, multiple copies of a selected set of confidential user data having a common logical address are stored to a confidential data portion of a non-volatile memory so that each copy is in a different location within the confidential data portion. A nondestructive purge of all said copies from the confidential data portion is carried out responsive to an externally supplied selective purge command so that all said copies are erased and other, non-purged confidential user data remain stored in the confidential data portion.

Abstract: Random numbers are generated according to a variety of solutions. A particular solution relates to method for generating the random number. A common start signal is provided to each of a plurality of inverter components of a ring oscillator circuit. This causes the ring oscillator circuit to enter a metastable mode. At least a first bit and a second bit of a random number are both generated in parallel. The parallel generation of the bits involves the generation of the first bit from entropic properties of a signal of a first one of the plurality of inverter components and the generation of the second bit from entropic properties of a signal of a second one inverter components.

Abstract: Method and apparatus for the non-destructive, selective purging of data from a non-volatile memory. In accordance with various embodiments, multiple copies of a selected set of confidential user data having a common logical address are stored to a confidential data portion of a non-volatile memory so that each copy is in a different location within the confidential data portion. A nondestructive purge of all said copies from the confidential data portion is carried out responsive to an externally supplied selective purge command so that all said copies are erased and other, non-purged confidential user data remain stored in the confidential data portion.

Abstract: An apparatus comprises at least one port for coupling signals to the apparatus, a mode selector for setting the apparatus to a normal mode or a debug mode, and a port control for controlling access to secure information in the apparatus through the port in accordance with the selected mode. A method for controlling access to the port is also provided.

Abstract: A data storage system comprises a storage element, and an encryption and decryption unit connected between a host and the storage element, and using a key that is generated in the data storage system.

Abstract: A non-volatile write cache using an alternate power source is implemented in a disc drive to maintain the integrity of cached write commands during a standard disc drive power loss, and to further recover and execute outstanding cached write commands when standard disc drive power is restored. The disc drive includes an internal or external alternate power source, control circuitry to switch between normal and low-power modes, memory control circuitry to, when in low-power mode, maintain the refresh of the cache, and firmware to recover and execute cached write commands once power is restored.

Abstract: An integrated circuit for particular use in a disc drive has a core logic module connected to a core voltage, an input/output buffer module connected to an input/output voltage and having input/output buffer control lines connected to the core logic module, and a mode switch input on the I/O buffer module that is operable to prevent output operation of the I/O buffer module whenever core voltage is below a safe operating level. One embodiment has the core logic module determining when the safe operating level is met and providing an appropriate signal to the I/O buffer. Another embodiment has a separate level detect module operably connected to the core voltage and the input/output voltage determining when the safe operating level is met, and having an output connected to the mode switch input on the I/O buffer module.