Secure data storage device having security functions implemented in a data security bridge

Abstract

The present disclosure provides a secure data storage device with a security function implemented in a data security bridge. A storage device includes: a controller; a storage medium coupled to the controller; and a data security bridge including a security module and a key management module; wherein the security module is configured to perform data encryption and / or data decryption; and wherein the key management module is configured to obtain a first security key stored in the storage device, obtain a second security key received by the storage device, and perform user authentication based on the first security key and the second security key.

Description

Technical Field

[0001] The field of application relates to data storage devices and related methods. Background Art

[0002] As more and more data is collected every day, security becomes increasingly important. Hard disk drives (HDDs) and solid-state drives (SSDs) are two examples of storage devices that store data. These devices store data in plain text and connect to the motherboard through standard connectors such as SATA connectors, m.2 connectors (for SATA or PCIe), U.2 connectors (for PCIe), etc. One advantage of such storage devices is that they can be unplugged from one computer and connected to another computer (e.g., a docking station) to allow the data to be read on the other computer.

[0003] New storage devices, systems including such new storage devices, and related methods of operation are described herein. Summary of the invention

[0004] A storage device comprises: a controller; a storage medium coupled to the controller; and a data security bridge comprising a security module and a key management module; wherein the security module is configured to perform data encryption and / or data decryption; and wherein the key management module is configured to obtain a first security key stored in the storage device, obtain a second security key received by the storage device, and perform user authentication based on the first security key and the second security key.

[0005] Optionally, the storage device further comprises a first interface for communicating with the station and a second interface configured to allow communication between the data security bridge and the controller.

[0006] Optionally, the first interface and the second interface are of the same type.

[0007] Optionally, the first interface and the second interface are of different types.

[0008] Optionally, the second interface is an internal interface integrated with the controller.

[0009] Optionally, the key management module is configured to perform user authentication based on the first security key and the second security key whenever the storage device is started from a shutdown mode.

[0010] Optionally, the key management module is configured to perform user authentication based on the first security key and the second security key whenever the storage device wakes up from the power saving mode.

[0011] Optionally, the storage device further includes a first interface and a second interface, wherein the security module is configured to receive data via the first interface and perform data encryption on the received data to obtain encrypted data; and wherein the second interface is configured to transmit the encrypted data to the controller.

[0012] Optionally, the storage device further includes a first interface and a second interface, wherein the controller is configured to retrieve encrypted data from the storage medium and transmit the encrypted data to the security module via the second interface; and wherein the security module is configured to decrypt the encrypted data to obtain decrypted data, and transmit the decrypted data from the storage device via the first interface.

[0013] Optionally, the storage device further includes a housing for accommodating the controller, the storage medium and the data security bridge.

[0014] Optionally, the key management module of the data security bridge includes a medium configured to store the first security key.

[0015] Optionally, the controller, security module and key management module are integrated into an integrated circuit (IC) chip.

[0016] Optionally, the second security key is stored in a USB or mobile phone.

[0017] Optionally, the storage device is configured to be communicatively coupled with the bridge of the station via a connector, the connector comprising a SATA connector, an m.2 connector, a PCIe connector, an Ethernet connector, or a U.2 connector.

[0018] Optionally, the storage device further comprises a wireless receiver, wherein the storage device is configured to obtain the second security key via the wireless receiver.

[0019] Optionally, the data security bridge further comprises a random number generator.

[0020] Optionally, the storage medium is configured to store encrypted data.

[0021] Optionally, the storage medium comprises a rotating magnetic disk.

[0022] Optionally, the storage medium includes a HDD or a NAND flash memory.

[0023] A station comprises the storage device.

[0024] Optionally, the station is configured to obtain a user identification different from the second security key.

[0025] Optionally, the user identification includes a user password.

[0026] Optionally, the user identification comprises a fingerprint, a retina scan, or a voice signature.

[0027] Optionally, the station is configured to receive a second security key from an external device and transfer the second security key to a key management module in the storage device.

[0028] Optionally, the external device includes a USB.

[0029] Optionally, the external device includes a mobile phone.

[0030] Optionally, the station includes: a device detector configured to detect an external device; a startup and / or wake-up controller configured to suspend a startup and / or wake-up process in response to the device detector detecting the external device; and a notification generator configured to notify a user to remove the external device.

[0031] Optionally, the startup and / or wake-up controller is configured to resume the startup and / or wake-up process in response to a user removing the external device.

[0032] A method executed by a storage device includes: obtaining a first security key from a medium in the storage device; obtaining a second security key stored in an external device; performing user authentication based on the first security key and the second security key by a key management module in the storage device; and retrieving encrypted data from a storage medium in the storage device based at least in part on the result of the action of performing the user authentication.

[0033] Optionally, the method further comprises obtaining a user identification from the user, wherein if the user identification satisfies the criteria and if the user authentication is successful, the encrypted data is retrieved from the storage medium in the storage device.

[0034] Optionally, the user identification includes a user password, fingerprint, retinal scan, or voice signature.

[0035] Optionally, the external device includes a USB or a mobile phone.

[0036] Optionally, the storage device comprises a wireless receiver, and wherein the second security key is obtained by the storage device using the wireless receiver.

[0037] Optionally, the method further includes: receiving data at a storage device; and performing data encryption on the received data to obtain encrypted data.

[0038] Optionally, the method further includes: transmitting the encrypted data to a security module in the storage device; decrypting the encrypted data by the security module to obtain decrypted data; and transmitting the decrypted data from the storage device.

[0039] Optionally, the storage device is coupled to the station, and wherein the second security key is transmitted from the external device to the station, the station communicating the second security key to the storage device.

[0040] Optionally, the method further comprises: detecting, by the station, the presence of the external device; pausing the boot and / or wake-up process in response to the detected presence of the external device; and notifying a user to remove the external device.

[0041] Optionally, the method further comprises resuming the boot and / or wake-up process in response to the user removing the external device.

[0042] Other and further aspects and features will become apparent from reading the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The accompanying drawings illustrate the design and use of the embodiments, wherein similar elements are referenced by common reference numerals. These figures are not necessarily drawn to scale. In order to better understand how to obtain the above-recorded and other advantages and purposes, a more specific description of the embodiments will be given, which is shown in the accompanying drawings. These drawings depict only exemplary embodiments and are therefore not to be considered as limiting the scope of the claims.

[0044] Figure 1 A system including a storage device is shown.

[0045] Figure 2 Another system including a storage device is shown.

[0046] Figure 3 Another system including a storage device is shown.

[0047] Figure 4 Another system including a storage device is shown.

[0048] Figure 5 Another system including a storage device is shown.

[0049] Figure 6 Shown by Figure 3 or Figure 4 or Figure 5 system execution method.

[0050] Figure 7 An example of a special purpose processing system is shown in which one or more embodiments described herein may be implemented. DETAILED DESCRIPTION

[0051] Various embodiments are described below with reference to the accompanying drawings. It should be noted that the drawings are not drawn to scale, and throughout the drawings, elements with similar structures or functions are represented by the same reference numerals. It should also be noted that the drawings are only used to help describe the embodiments. They are not intended to be an exhaustive description of the invention or to limit the scope of the invention. In addition, the illustrated embodiments do not necessarily have all the aspects or advantages shown. The aspects or advantages described in conjunction with a particular embodiment are not necessarily limited to that embodiment, and may be practiced in any other embodiment, even if not so stated, or even if not so explicitly described.

[0052] Figure 1 A system 10 is shown that includes a station 12 and a storage device 20. The station 12 may be a desktop computer, a laptop computer, a server, a drive docking station, or any other computing device configured to allow a storage device (such as the storage device 20) to be fixed thereto. The station 12 includes a CPU 30 and a bridge 32. The bridge 32 may be one or more chips that are communicatively coupled between the CPU 30 and the I / O. In some cases, the bridge 32 may be a south bridge. Moreover, in some embodiments, the bridge 32 may be integrated with the CPU 30. The storage device 20 is coupled to the CPU 30 of the station 12 via the bridge 32. In some cases, the connection between the storage device 20 and the station 12 may be implemented using a standard connector, such as a SATA connector (for a SATA interface), an m.2 connector (for SATA or PCIe), a U.2 connector (for PCIe), or an Ethernet connector. Optionally, the system 10 further includes a memory 14, such as a dynamic random access memory (DRAM) for storing data.

[0053] As shown, the storage device 20 includes a storage medium 50, a controller 60, and a housing 70 that accommodates the storage medium 50 and the controller 60. The storage device 20 may be a hard disk drive (HDD), a solid state drive (SSD), or any other type of storage device. The storage medium 50 in the storage device 20 is configured to store unencrypted data (plain text), and the controller 60 of the storage device 20 is configured to retrieve the unencrypted data from the storage medium 50 and output the retrieved data for transmission to the station 12 of the system 10. The controller 60 is an electrical component within the storage device 20 that enables the CPU 30 of the station 12 to access, read, write, delete, and modify data to and from the medium 50. The controller 60 is configured to translate instructions received from the station 12 into content that can be understood by the storage device 20, and vice versa. Instructions from the station 12 can flow through the hard disk adapter, flow into the hard disk interface, and then flow to the controller 60, which sends commands to the medium 50 (e.g., a disk) for performing specific operations.

[0054] During use, a user of the station 12 may enter user input via a user interface at the station 12. In some cases, the user input may be a request to store data to the storage device 20. In this case, the CPU 30 of the station 12 processes the user input and transmits the data in an unencrypted form to the controller 60 of the storage device 20. The transmission of data from the station 12 to the storage device 20 may be accomplished via a SATA connector, an m.2 connector, a 2.U connector, or any other type of connector. The controller 60 of the storage device 20 processes the data and passes the data in an unencrypted form to the storage medium 50 for storage.

[0055] In other cases, the user input may be a request to retrieve data from the storage device 20. In this case, the CPU 30 of the station 12 processes the user input and transmits the request to the controller 60 of the storage device 20. The controller 60 processes the request and retrieves the requested data in an unencrypted form from the storage medium 50. The controller 60 then transmits the requested data in an unencrypted form to the station 12. The transfer of data from the storage device 20 to the station 12 may be accomplished via a SATA connector, an m.2 connector, a 2.U connector, or any other type of connector.

[0056] In other cases, instead of being provided by a user of station 12, the request to store data and / or the request to retrieve data may be received by station 12 from another device in communication with station 12. The other device may be a peripheral device attached to station 12, or a remote device connected to station 12 via the Internet.

[0057] Figure 1 One disadvantage of the system 10 is the lack of encryption of the data in the storage device 20. A hacker can unplug the storage device 20 from the system 10 and reinsert it into another station 12. Since the storage device 20 includes a standard interface (e.g., SATA), the hacker can easily read out its data.

[0058] Figure 2Another system 200 including a station 212 and a storage device 220 is shown. The station 212 may be a desktop computer, a laptop computer, a server, a drive docking station, or any other computing device configured to allow a storage device (such as the storage device 220) to be fixed thereto. The station 212 also includes a CPU 230, a bridge 232, and a platform module 234 coupled to the bridge 232. The bridge 232 may be one or more chips communicatively coupled between the CPU 30 and the I / O. In some cases, the connection between the storage device 220 and the station 212 may be implemented using a standard connector, such as a SATA connector (for a SATA interface), an m.2 connector (for SATA or PCIe), a U.2 connector (for PCIe), or an Ethernet connector. The platform module 234 may be configured to obtain a password from a user of the station 212 through a user interface and obtain an identification from the storage device 220, which may be used by the platform module 234 to perform authentication. Examples of the platform module 234 include a trusted platform module (TPM), such as used in a computer. Optionally, the system 200 further includes a memory 214, such as a dynamic random access memory (DRAM) for storing data.

[0059] As shown, the storage device 220 includes a storage medium 250, a controller 260, and a housing 270 that houses the storage medium 250 and the controller 260. The controller 260 is an electrical component within the storage device 220 that enables the CPU 230 of the station 212 to access, read, write, delete, and modify data to and from the medium 250. The controller 260 is configured to translate instructions received from the station 212 into content that can be understood by the storage device 220, and vice versa. Instructions from the station 212 can flow through the hard disk adapter, flow into the hard disk interface, and then flow to the controller 260, which sends commands to the medium 250 (e.g., a disk) to perform specific operations. The controller 260 of the storage device 220 includes a security module 262 configured to perform data encryption and data decryption. The storage medium 250 in the storage device 220 is configured to store encrypted data provided by the controller 260. The storage device 220 can be a HDD, an SSD, or any other type of storage device.

[0060] During use, a user of the station 212 may enter user input via a user interface at the station 212. In some cases, the user input may be a request to store data to the storage device 220. In this case, the CPU 230 of the station 212 processes the user input and transmits the data in an unencrypted form to the controller 260 of the storage device 220. The transmission of data from the station 212 to the storage device 220 may be accomplished via a SATA connector, an m.2 connector, a 2.U connector, or any other type of connector. The controller 260 of the storage device 220 receives the unencrypted data from the station 212, encrypts the data to form encrypted data, and passes the encrypted data to the storage medium 250 for storage of the encrypted data.

[0061] In other cases, the user input may be a request to retrieve data from the storage device 220. In this case, the CPU 230 of the station 212 processes the user input and transmits the request to the controller 260 of the storage device 220. The controller 260 processes the request and retrieves the requested data in encrypted form from the storage medium 250. The controller 260 then decrypts the encrypted data to obtain the unencrypted data and transmits the requested data in unencrypted form to the station 212. The transfer of data from the storage device 220 to the station 212 may be accomplished via a SATA connector, an m.2 connector, a 2.U connector, or any other type of connector.

[0062] In other cases, instead of being provided by a user of station 212, a request to store data and / or a request to retrieve data may be received by station 212 from another device in communication with station 212. The other device may be a peripheral device attached to station 212, or a remote device connected to station 212 via the Internet.

[0063] The controller 260 of the storage device 220 also authenticates commands and / or associated data. For example, when storing data, the controller 260 can check write / storage commands and / or data to be stored to ensure that commands and / or data are from a trusted user or trusted device. In one implementation, the controller 260 can perform authentication of commands and / or data by checking the password entered by the user (via the user interface associated with the platform module 234) to ensure that the user is a trusted user. When retrieving data, the controller 260 can check the retrieval command to ensure that the retrieval command is from a trusted user or trusted device. Again, this can be realized by checking the password entered by the user via the user interface associated with the platform module 234.

[0064] Therefore, the controller 260 of the storage device 220 includes encryption, decryption and authentication functions. In some cases, the security module 262 of the controller 260 of the storage device 220 may include an encryption module for encrypting plain text into encrypted text, and a decryption module for decrypting the decrypted text. Moreover, the controller 260 may include an authenticator for performing data authentication. For example, the authenticator may check the password input by the user of the storage device 220 to ensure that the user is a trusted user.

[0065] Figure 3 System 300 is shown including station 312 and storage device 320. Station 312 may be a desktop computer, a laptop computer, a server, a drive docking station, or any other computing device configured to allow a storage device, such as storage device 320, to be secured thereto. Station 312 also includes CPU 330 and bridge 332. Optionally, system 300 further includes memory 314, such as dynamic random access memory (DRAM) for storing data.

[0066] As shown, the storage device 320 includes a data security bridge 322, a storage medium 350, a controller 360, and a housing 370 that contains the data security bridge 322, the storage medium 350, and the controller 360. The controller 360 is an electrical component within the storage device 320 that enables the CPU 330 of the station 312 to access, read, write, delete, and modify data to and from the medium 350. The controller 360 is configured to translate instructions received from the station 312 into content that can be understood by the storage device 320, and vice versa. Instructions from the station 312 can flow through the hard disk adapter, flow into the hard disk interface, and then flow to the controller 360, which sends a command to the medium 350 (e.g., a disk) to perform a specific operation. The storage medium 350 in the storage device 320 is configured to store encrypted data. The storage device 320 can be implemented by coupling the data security bridge 322 with a storage mechanism such as an HDD, an SSD, or any other type of storage mechanism / product.

[0067] The data security bridge 322 is configured to provide security functions and / or key management. As shown, the data security bridge 322 includes a first interface 372 configured to communicate with a bridge associated with the CPU 30, and a second interface 374 configured to communicate with the controller 360 of the storage device 320. In the illustrated embodiment, the first interface 372 is configured to communicate with the bridge 332 of the station 312 using connectors such as SATA connectors, m.2 connectors, U.2 connectors, PCIe connectors, Ethernet connectors, etc. The second interface 374 can also be configured to communicate with the controller 360 using connectors such as SATA connectors, m.2 connectors, U.2 connectors, PCIe connectors, Ethernet connectors, etc. In some cases, the first interface 372 can be a slave interface, and the second interface 374 can be a master interface. In other cases, the first interface 372 can be a master interface, and the second interface 374 can be a slave interface. In some cases, the first interface 372 and the second interface 374 are of the same type, for example, the first interface 372 is a SATA slave interface, and the second interface 374 is a master interface. In other cases, the first interface 372 and the second interface 374 are of different types, for example, the first interface 372 is a PCIe endpoint interface, and the second interface 374 is a SATA host interface. The data security bridge 322 also includes a security module 376 for data encryption and / or data decryption, and a key management module 378 for key management (e.g., for performing security checks).

[0068] In some cases, the security module 376 of the data security bridge 322 may include an encryption module for encrypting data into encrypted data, and a decryption module for decrypting the encrypted data to form decrypted data. By way of non-limiting example, the security module 376 may be configured to perform Advanced Encryption Standard (AES) encryption and decryption, Secure Hash Algorithm 1 (SHA1), Elliptic Curve Cryptography (ECC), any other symmetric or asymmetric encryption function, any other symmetric or asymmetric decryption function, etc. Moreover, in some embodiments, the data security bridge 322 may include a random number generator for generating encryption keys and / or decryption keys.

[0069] The key management module 378 may include an authenticator for performing a security check to authenticate a user. As shown, the station 312 is configured to obtain a security key from an external device 390 containing a security key. In one example, the external device 390 is inserted into a USB slot of the station 312. The security key is used by the data security bridge 322 to perform a security check. In other embodiments, instead of a USB, the device 390 may be any external device, such as a mobile phone, an iPad, a tablet computer, or any other device capable of storing a security key. In another implementation, the device 390 may include an application configured to generate a security key, which is used to be checked by the data security bridge 332 of the storage device 320.

[0070] The key management module 378 may employ various techniques to perform security checks based on the security key obtained from the external device 390. In one implementation, during the initialization process, the key management module 378 obtains the security key from the external device 390 and registers the security key at the storage device 320. For example, the storage device 320 may store the security key from the external device 390 as a first security key (reference security key), thereby establishing "trust" between the external device 390 and the storage device 320. In subsequent use, the user may use the external device 390 to provide its secret key (second security key) for processing by the key management module 378. The key management module 378 may compare the security key (second security key) with the first security key (reference key) to determine whether they match. If so, the key management module 378 may determine that the user is a "trusted" user. In other embodiments, in addition to the above-mentioned key check performed by the key management module 378, the user may also be required to provide another form of identification (e.g., user password, fingerprint, retinal scan, voice signature, etc.) at the platform 312. In this case, if the key management module 378 determines that both the second form of identification and the security key from the external device 390 are correct (ie, if they match the predetermined reference identification and reference key), the user can access the encrypted data in the storage medium 350.

[0071] In another implementation, the storage device 320 may contain (e.g., store) a first security key, and the storage device 320 is configured to obtain a second security key provided by the external device 390. During initialization of the storage device 320, the key management module 378 may use both the first security key and the second security key to create a new signature. The signature is then stored in the storage device 320 as a reference signature. In subsequent use, the key management module 378 is configured to check the combination of both the first security key and the second security key. In particular, the user can use the external device 390 to provide the second security key directly to the station 312 or the storage device 320. The key management module 378 then uses the second security key and the first security key to generate a signature, and compares the signature with the reference signature. If the signatures do not match (security check fails), the data security bridge 322 will prevent data from being stored and / or retrieved from the medium 350. If the check passes, the data security bridge 322 will allow data to be stored and / or retrieved from the medium 350.

[0072] In other embodiments, in addition to the above features, the station 312 may obtain a second form of identification from the user. For example, the station 312 may obtain a password from the user, obtain a fingerprint from the user, obtain retinal features from a retinal scan, or obtain a voice signature from the user, etc. In this case, if the second form of identification and the security key check pass, the data security bridge 322 will allow data to be stored and / or retrieved from the medium 350.

[0073] The data security bridge 322 can be implemented using hardware, software, or a combination of both. In some cases, the data security bridge 322 may include a chip having an integrated circuit configured to perform one or more functions described herein. Moreover, in some embodiments, the data security bridge 322 may include a processor configured to perform one or more functions described herein, such as an ASIC processor, an FPGA processor, a general-purpose processor, or any other processing unit. In the illustrated embodiment, the data security bridge 322 is implemented as a part of the storage device 320. In other embodiments, the data security bridge 322 is implemented as a part of the station 312. In other embodiments, the first part of the data security bridge 322 can be implemented on the station 312 side, and the second part of the data security bridge 322 can be implemented at the storage device 320.

[0074] In some embodiments, a portion of the storage device 320 may be implemented using a storage mechanism or product 362 having a conventional configuration. For example, the storage mechanism or product 362 may be a HDD, an SSD, or any other type of storage mechanism or product. In this case, the data security bridge 322 or at least a portion thereof may be combined with a storage mechanism or product 362 having a conventional configuration to form a storage device 320 with enhanced functionality. In other embodiments, the storage mechanism or product 362 may not have a conventional configuration. Moreover, in another embodiment, the item 362 may not be any conventional product, but may instead represent only a combination of the controller 360 and the storage mechanism 350.

[0075] Additionally, in some embodiments, controller 360 may be configured to perform data retrieval from storage medium 350 and / or data writing to storage medium 350 without having any data encryption and / or data decryption functionality itself. For example, in some cases, controller 360 may have the same configuration as controller 60 without an encryption module built therein.

[0076] In the above embodiment, the data security bridge 322 is described as having both the security module 376 and the key management module 378. In other embodiments, the data security bridge 322 may include the security module 376 without the key management module 378. In further embodiments, the data security bridge 322 may include the key management module 378 without the security module 376. Moreover, in other embodiments, the data security bridge 322 may be implemented using subcomponents or modules.

[0077] During use, the storage device 320 is first initialized. In particular, an initialization process may be performed to initialize the storage device 320. In one implementation, during the initialization process, the key management module 378 obtains a security key provided from the external device 390 (a "trusted" device) and registers the security key with the storage device 320. For example, the key management module 378 may store the security key provided by the external device 390 as a first security key in the storage device 320. Alternatively, there may be a first security key already stored in the storage device 320. In this case, the security key from the external device 390 is a second security key, and the key management module 378 is configured to associate the second security key provided by the external device 390 with the first security key stored in the storage device 320. In one implementation, the key management module 378 may access the first security key stored in the storage device 320, and may use both the first security key and the second security key to create a signature. The signature may be stored in the storage device 320 for later use. Alternatively or additionally, the key management module 378 may also obtain a second form of identification (such as a password, voice, retinal features, etc.) from a user of the station 312 for registration with the storage device 320 .

[0078] At the initialization of the storage device 320, the data security bridge 322 of the storage device 320 and the security key source 390 (e.g., USB) establish a one-to-one "trust" or binding. After initialization, all data to be stored on the medium 350 is encrypted by the data security bridge 322, which then passes the encrypted data to the medium 350.

[0079] Upon subsequent startup and / or wake-up of the station 312, the security key will be checked and an authentication process will be formed. In startup mode, the storage device 320 is switched from a shutdown mode to a functional mode. In wake-up mode, the storage device 320 is switched from a power saving mode (e.g., a standby mode in a Windows operating system) or a partial shutdown mode (e.g., a hibernation mode in a Windows operating system) to a functional mode. In subsequent use, the user first couples an external device 390 (e.g., a USB) with the station 312, and a second security key from the external device 390 is transmitted to the key management module 378. The key management module 378 then performs a security check using both the first security key stored in the storage device 320 and the second security key provided by the device 390 to ensure that the user is a trusted user. In one implementation, the first security key is a reference security key previously stored in the storage device 320. In this case, the key management module 378 compares the first security key with the second security key to determine whether they match. If the first security key and the second security key match, the data transmitted from the station 312 can be encrypted by the security module 376 for storage in the medium 350 of the storage device 320, and / or the data from the medium 350 can be retrieved and decrypted by the security module 376 for output to the station 312. In another implementation, if the key management module 378 previously created a signature (reference signature) using both the first security key and the second security key, the key management module 378 can use the key provided by the device 390 and the stored first security key to generate a signature for comparison with the reference signature. If the signature matches the reference signature, the data transmitted from the station 312 can be encrypted by the security module 376 for storage in the medium 350 of the storage device 320, and / or the data from the medium 350 can be retrieved and decrypted by the security module 376 for output to the station 312.

[0080] Alternatively or additionally, the user may provide a second form of identification (such as a password, voice, retinal features, etc.) upon subsequent startup or wakeup of the station 312. The station 312 (e.g., operating system) checks the second form of identification, and the data security bridge 322 checks the security key obtained from the external device 390. If at least two criteria, namely, (1) the second form of identification provided by the user matches the predetermined auxiliary identification, and (2) the security key obtained from the external device 390 satisfies the security check, are met, the station 312 is allowed to be started or woken up, and / or the medium 350 of the storage device 320 is allowed to be accessed. After these two criteria are met, data transmitted from the station 312 can be encrypted by the security module 376 for storage in the medium 350 of the storage device 320, and / or data from the medium 350 can be retrieved and decrypted by the security module 376 for output to the station 312.

[0081] In some embodiments, to ensure that the user does not keep the USB 390 plugged into the station 312, the station 312 can be configured to pause the boot and / or wake-up process after performing a security check using the security key on the USB 390. The station 312 will then prompt the user to unplug the USB 390 from the station 312. The station 312 continues the boot process only after the user has unplugged the USB from the station 312. In one implementation, the station 312 may include a USB detector configured to detect the USB 390. The station 312 may also include: a boot and / or wake-up controller configured to suspend the boot and / or wake-up process in response to the USB detector detecting the USB; and a notification generator configured to notify the user to remove the USB from the station 312. The boot and / or wake-up controller is also configured to resume the boot and / or wake-up process in response to the user removing the USB from the station 312.

[0082] After the storage device 320 is initialized and the station 312 is powered on, the user may then use the media 350 in the storage device 320 .

[0083] For example, in some cases, a user of the station 312 may enter user input via a user interface at the station 312. The user input may be a request to store data to the storage device 320. In this case, the CPU 330 of the station 312 processes the user input and transmits the data to the data security bridge 322 in an unencrypted form via the first interface 372. The transmission of data from the station 312 to the data security bridge 322 of the storage device 320 may be completed via a SATA connector, an m.2 connector, a 2.U connector, or any other type of connector. The data security bridge 322 of the storage device 320 receives the unencrypted data from the station 312, encrypts the data to form encrypted data, and passes the encrypted data to the controller 360 via the second interface 374. The communication between the second interface 374 of the data security bridge 322 and the controller 360 of the storage device 320 may be completed using connectors such as a SATA connector, an m.2 connector, a U.2 connector, a PCIe connector, an Ethernet connector, etc. In some embodiments, the first interface 372 and the second interface 374 may be of the same type, while in other embodiments, the first interface 372 and the second interface 374 are of different types. The controller 360 of the storage device 320 processes the encrypted data and passes the data in encrypted form to the storage medium 350 for storage. In some embodiments, optionally, the data security bridge 322 can further perform a security check before the data is stored in the storage medium 350. For example, this can be done by the key management module 378, which performs a security check using a second key from the external device 390.

[0084] In other cases, the user input may be a request to retrieve data from the storage device 320. In this case, the CPU 330 of the station 312 processes the user input and transmits the request to the data security bridge 322 of the storage device 320 via the first interface 372. The transmission of the request from the station 312 to the data security bridge 322 may be performed via a connector such as a SATA connector, an m.2 connector, a U.2 connector, a PCIe connector, an Ethernet connector, etc. The first interface 372 of the data security bridge 322 receives the request and passes the request to the controller 360 via the second interface 372. The controller 360 processes the request and retrieves the requested data from the storage medium 350 in an encrypted form. The controller 360 then passes the retrieved encrypted data to the data security bridge 322 via the second interface 374. The data security bridge 322 then decrypts the encrypted data to obtain unencrypted data and transmits the retrieved data to the station 312 in an unencrypted form via the first interface 372. The transmission of the encrypted data from the controller 360 of the storage device 320 to the data security bridge 322 of the storage device 320 can be accomplished via a SATA connector, an m.2 connector, a 2.U connector, or any other type of connector. Moreover, the transmission of the decrypted data from the data security bridge 322 of the storage device 320 to the station 312 can be accomplished via a SATA connector, an m.2 connector, a 2.U connector, or any other type of connector. In some embodiments, optionally, the data security bridge 322 can further perform a security check before retrieving data from the storage medium 350. For example, this can be accomplished by the key management module 378, which performs a security check using a second key from the external device 390.

[0085] In other cases, instead of being provided by a user of station 312, a request to store data and / or a request to retrieve data may be received by station 312 from another device in communication with station 312. The other device may be a peripheral device attached to station 312, or a remote device connected to station 312 via the Internet.

[0086] Storage device 320 is more advantageous than storage device 220. This is because storage device 320 provides multi-step security, rather than the single-step security associated with storage device 220. In the multi-step security provided by storage device 320, if a person removes storage device 320 from station 312 and places it in another station, the person can only see the encrypted data. The person will not be able to decrypt the data because the person will not have the second security key stored in external device 390. Similarly, if a person gets station 312 and if the person even obtains the password to station 312, the person cannot start station 312 because the person does not have the second security key stored in external device 390. In contrast, in one-step security, if a person has station 212 with storage device 220 and obtains the password, the person can easily copy the data.

[0087] The storage device 320 is also advantageous because the storage device 320 can be more flexible in function than the storage device 220 because it can implement any security function for any country (e.g., AES for the United States, SM4 for China, etc.). In addition, the security functions in the controller 360 of the storage device 320 can be more easily upgraded. If a new cryptographic algorithm is developed, the same controller 360 can be configured to implement any new cryptographic algorithm. Moreover, in some cases, the data security bridge 322 can adapt to different types of first interfaces and second interfaces, thereby allowing one type of storage mechanism or product 362 (e.g., SATA) to be connected to another type of station 312 (e.g., PCIe).

[0088] In addition, the storage device 320 is more flexible in function than the storage device 220. This is because if someone removes the storage device 220 from the station 212 and places it in another station, the controller 260 will not enable the decryption function, and all the data read out will be scrambled data and cannot be used. On the other hand, if someone removes the storage device 320 from the station 312 and places it in another station, the data can still be accessed from the medium 350 of the storage device 320 as long as the user also provides an external device 390 including a second security key. Accordingly, the storage device 320 provides flexibility of use while enhancing the security of the stored data.

[0089] Additionally, storage device 320 is also advantageous because, unlike other techniques used to simply make computer booting more secure, storage device 320 actually allows data stored therein to be more secure. In this regard, even if an unauthorized user removes storage device 320 from station 312, the unauthorized user will not be able to access the data stored therein due to the security features described herein.

[0090] In the above embodiment, the second security key is described as being received directly by the station 312, which is then passed to the data security bridge 322 of the storage device 320. In other embodiments, the second security key may be received directly by the storage device 320 without passing through the station 312 ( Figure 4 ). For example, the storage device 320 may include a wireless receiver 400 configured to receive the second security key from another device 390. The wireless receiver 400 may be implemented as part of the data security bridge 322, or may be implemented as a separate component coupled to the data security bridge 322. The other device 390 may be a mobile phone, an iPad, a tablet computer, another computer, or any other device with the ability to transmit wireless signals. The wireless receiver 400 may communicate with other devices via Bluetooth, WiFi, Zigbee, RFID, or any other wireless solution. The wireless receiver 400 may be coupled to the data security bridge 322 of the storage device 320 for transmission of the second security key to the data security bridge 322.

[0091] It should be noted that in any of the embodiments described herein, the features of the key management module 378 may be incorporated into the security module 376. Alternatively, any of the features of the security module 376 may be incorporated into the key management module 378.

[0092] Furthermore, in other embodiments, the security module 376 and the key management module 378 of the data security bridge 322 and the controller 360 may be combined and implemented in an integrated circuit (IC) chip. Figure 5 An example of such an implementation is shown, in which the data security bridge 322 and the controller 360 are combined in an integrated circuit (IC) chip 450. In such an implementation, the second interface 374 becomes an internal bus interface. The integrated solution provides a low-cost solution while sacrificing the benefits of the flexibility of the independent data security bridge 322. In some embodiments, the IC chip 450 may include a processor, such as an ASIC processor, an FPGA processor, a general-purpose processor, or any other processing unit configured to perform one or more functions described herein.

[0093] Figure 6 It shows that it can be Figure 3 or Figure 4 or Figure 5 The method 500 is performed by the system. First, a first security key is obtained (item 502). In some embodiments, item 502 can be performed by the key management module 378 in the data security bridge 322, which accesses the first security key stored in the storage device 320.

[0094] Next, obtain the second security key (item 504). In some embodiments, the second security key can be obtained by the key management module 378 in the data security bridge 322, which receives the second security key through the first interface 372. The second security key can be transmitted from the external device 390 (e.g., USB, mobile phone, etc.) to the station 312. The station 312 then passes the second security key to the data security bridge 322 of the storage device 320 via the first interface 372. Alternatively, the second security key can be transmitted wirelessly from the external device 390 (e.g., a mobile phone or another external device) and wirelessly received by the wireless receiver 400 at the storage device 320.

[0095] Next, the key management module 378 performs a security check using both the first key and the second key (item 506). As discussed, in some embodiments, the first key may be a reference key, and the key management module 378 may compare the first key with the second key to see if they match. If so, the key management module 378 may determine that the user providing the external device 390 with the second security key is a "trusted" user. In other embodiments, the key management module 378 may generate a signature using both the first security key and the second security key. In this case, the key management module 378 may then compare the signature with a reference signature stored in the storage device 320. The reference signature may have been previously generated during the initialization process using the first security key and the second security key provided from a "trusted" external device. If the signatures match, the key management module 378 may determine that the user providing the external device 390 with the second security key is a "trusted" user.

[0096] After the security check is performed, the security module 376 may encrypt the data transmitted from the station 312 for storage in the medium 350 of the storage device 320, and / or the security module 376 may decrypt the data retrieved from the medium 350 for output to the station 312 (item 508). In some embodiments, after the security module 376 encrypts the data, the data security bridge 332 then outputs the encrypted data via a connector such as a SATA connector, an m.2 connector, a U.2 connector, a PCIe connector, an Ethernet connector, etc. for transmission to the controller 360. Similarly, in some embodiments, the encrypted data stored in the medium 350 may be transmitted to the data security bridge 332 (for decryption by the security module 376) via a connector, which may be a SATA connector, an m.2 connector, a U.2 connector, a PCIe connector, an Ethernet connector, etc.

[0097] Optionally, before item 508 is executed, station 312 may obtain a second form of identification from a user of station 312 (item 516). By way of non-limiting example, the second form of identification may be a user password entered by the user via a keyboard or touch screen at station 312, a fingerprint obtained by a fingerprint reader at station 312, retinal features obtained by a retinal scan, or a voice signature obtained by a microphone at station 312, etc. After the second form of identification is obtained, station 312 and / or storage device 320 then authenticates such secondary identification. Item 508 is executed only if (1) the security check in item 506 is successfully executed, and (2) the second form of user identification in item 516 is authenticated.

[0098] In the above embodiments, storage device 320 is described as being coupled to station 312. In other embodiments, storage device 320 may be considered a part of station 312 that is configured to communicate with another part of station 312. Thus, as used in this specification, the term “station” may or may not include storage device 320.

[0099] Although the above embodiments have been described with reference to a storage device 320 having a certain "trusted" user / external device, in other embodiments, the storage device 320 may have multiple "trusted" users / external devices. For example, in other embodiments, the medium at the storage device 320 may store multiple first security keys belonging to different users. During use, the first user may use the first external device to provide a second security key to the storage device 320. Then, the key management module 378 searches the first security key to determine whether any first security key matches the second security key. If so, the key management module 378 may determine that the first user is a "trusted" user and may allow the operation to be performed on the medium 350 of the storage device 320. In another use, a second user different from the first user may provide a second external device, which provides another second security key to the storage device 320. The second security key from the second device of the second user is different from the second security key from the first device of the first user. The key management module 378 then searches the first security key to determine whether any first security key matches the second security key from the second external device. If so, the key management module 378 may determine that the second user is also a "trusted" user and may allow the operation to be performed on the media 350 of the storage device 320. Thus, the same storage device 320 may be used by multiple users. In some cases, the media 350 in the storage device 320 may be divided into different portions for different respective users.

[0100] In other embodiments, the media at the storage device 320 may store multiple signatures belonging to different users. During use, a first user may use a first external device to provide a security key to the storage device 320. The key management module 378 then generates a signature using the security key from the first external device and searches for signatures already stored in the storage device 320 to determine if any of them match the created signature. If so, the key management module 378 may determine that the first user is a "trusted" user and may allow operations to be performed on the media 350 of the storage device 320. In another use, a second user different from the first user may provide a second device with another security key that is transmitted to the storage device 320. The security key from the second device of the second user is different from the security key from the first device of the first user. The key management module 378 then generates a signature using the security key from the second device and searches for signatures in the storage device 320 to determine if any of them match the created signature. If so, the key management module 378 may determine that the second user is also a "trusted" user and may allow operations to be performed on the media 350 of the storage device 320.

[0101] In another embodiment, the storage device 320 may store multiple identifications (such as passwords) associated with multiple "trusted" users. In this case, the key management module 378 may use the stored identifications (such as passwords) to authenticate different users.

[0102] In some of the above embodiments, the station 312 has been described as being coupled to the storage device 320 and configured to obtain a key from the external device 390. It should be noted that the station 312 is not limited to obtaining the key directly from the external device 390, and may instead be configured to obtain the key indirectly from the external device 390. For example, in other embodiments, the user may be using another station (second station) that communicates with the station 312 (first station) remotely (e.g., via a network such as the Internet). In this case, the user may provide the external device 390 to transfer its key to the second station. The second station then transfers the key to the first station 312 where the storage device 320 is located. In this case, after the key has been used by the storage device 320 to perform authentication, the user of the second station can then obtain data from the storage device 320 at the first station. Therefore, the user of the station 312 and / or the storage device 320 is not limited to the user who directly uses the station 312 and / or the storage device 320, and may include a user who remotely uses the station 312 and / or the storage device 320. In other embodiments, in addition to checking the key from the external device, the storage device may also check a second form of identification from the user. For example, the user at the second station may provide a second form of identification, which is then transmitted from the second station to the first station 312. The storage device 320 then checks the second form of identification. If the second form of identification meets the first criteria (e.g., it matches the reference identification) and if the key from the external device 390 meets the second criteria (e.g., it matches the reference key), the user will be allowed to access the encrypted data at the storage device 320. The second form of identification may be a user password, fingerprint, retinal scan, voice signature, etc.

[0103] Dedicated processing system

[0104] Figure 7 16 is a block diagram illustrating an embodiment of a special-purpose processing system 1600 that can be used to implement various embodiments described herein. For example, the processing system 1600 can be an example of the station 12 / 212 / 312 described herein.

[0105] refer to Figure 7, the processing system 1600 includes a bus 1602 or other communication mechanism for communicating information, and a processor 1604 coupled to the bus 1602 for processing information. The processor system 1600 also includes a main memory 1606, such as a random access memory (RAM) or other dynamic storage device, coupled to the bus 1602 for storing information and instructions to be executed by the processor 1604. The main memory 1606 can also be used to store temporary variables or other intermediate information during the execution of instructions to be executed by the processor 1604. The processor system 1600 further includes a read-only memory (ROM) 1608 or other static storage device coupled to the bus 1602 for storing static information and instructions for the processor 1604. A data storage device 1610, such as a magnetic disk or optical disk, is provided and coupled to the bus 1602 for storing information and instructions.

[0106] The processor system 1600 may be coupled to a display 1612, such as a cathode ray tube (CRT), via the bus 1602 for displaying information to a user. An input device 1614, including alphanumeric and other keys, is coupled to the bus 1602 for communicating information and command selections to the processor 1604. Another type of user input device is a cursor control 1616, such as a mouse, trackball, or cursor direction keys, for communicating direction information and command selections to the processor 1604 and for controlling cursor movement on the display 167. The input device typically has two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), which allows the device to specify a position in a plane.

[0107] In some embodiments, the processor system 1600 can be used to perform various functions described herein. According to some embodiments, this use is provided by the processor system 1600 in response to the processor 1604 executing one or more sequences of one or more instructions contained in the main memory 1606. Those skilled in the art will know how to prepare such instructions based on the functions and methods described herein. Such instructions can be read into the main memory 1606 from another processor-readable medium such as a storage device 1610. The execution of the instruction sequence contained in the main memory 1606 causes the processor 1604 to perform the processing steps described herein. One or more processors of a multi-processing arrangement can also be used to execute the instruction sequence contained in the main memory 1606. In alternative embodiments, hard-wired circuit devices can be used instead of or in combination with software instructions to implement the various embodiments described herein. Therefore, the embodiments are not limited to any specific combination of hardware circuit devices and software.

[0108] The term "processor-readable medium" as used herein refers to any medium that participates in providing instructions to processor 1604 for execution. Such media can take many forms, including, but not limited to, non-volatile media, volatile media, and transmission media. Non-volatile media include, for example, optical or magnetic disks, such as storage device 1610. Non-volatile media can be considered an example of non-transitory media. Volatile media include dynamic memory, such as main memory 1606. Volatile media can be considered an example of non-transitory media. Transmission media include coaxial cables, copper wire, and optical fiber, including the wires that make up bus 1602. Transmission media can also take the form of acoustic or light waves, such as those generated during radio wave and infrared data communications.

[0109] Common forms of processor-readable media include, for example, floppy disks, flexible disks, hard disks, magnetic tape or any other magnetic medium, CD-ROMs, any other optical medium, punch cards, paper tape, any other physical medium with a pattern of holes, RAM, PROM and EPROM, FLASH-EPROM, any other memory chip or cassette, the carrier waves described below, or any other medium from which a processor can read.

[0110] Various forms of processor-readable media may be involved in carrying one or more sequences of one or more instructions to the processor 1604 for execution. For example, the instructions may initially be carried on a disk of a remote computer. The remote computer may load the instructions into its dynamic memory and send the instructions over a telephone line using a modem. A modem local to the processing system 1600 may receive the data on the telephone line and convert the data into an infrared signal using an infrared transmitter. An infrared detector coupled to the bus 1602 may receive the data carried in the infrared signal and place the data on the bus 1602. The bus 1602 carries the data to the main memory 1606, from which the processor 1604 retrieves and executes the instructions. Optionally, the instructions received by the main memory 1606 may be stored on the storage device 1610 before or after execution by the processor 1604.

[0111] Processing system 1600 also includes a communication interface 1618 coupled to bus 1602. Communication interface 1618 provides bidirectional data communication coupled to network link 1620, which is connected to local network 1622. For example, communication interface 1618 can be an integrated services digital network (ISDN) card or a modem for providing data communication connections to telephone lines of corresponding types. As another example, communication interface 1618 can be a local area network (LAN) card for providing data communication connections to compatible LANs. Wireless links can also be implemented. In any such implementation, communication interface 1618 sends and receives electrical signals, electromagnetic signals, or optical signals that carry data streams representing various types of information.

[0112] The network link 1620 typically provides data communication to other devices through one or more networks. For example, the network link 1620 can provide a connection to a host computer 1624 or a device 1626 through a local network 1622. The data stream transmitted by the network link 1620 may include electrical signals, electromagnetic signals, or optical signals. The signals through the various networks and the signals on the network link 1620 and through the communication interface 1618 (which carry data to and from the processing system 1600) are exemplary forms of carrier waves that transmit information. The processing system 1600 can send messages and receive data, including program code, through the network, network link 1620, and communication interface 1618.

[0113] Although specific embodiments have been shown and described, it should be understood that it is not intended to limit the claimed invention to the preferred embodiments, and it will be apparent to those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the claimed invention. Accordingly, the specification and drawings are to be regarded as illustrative rather than restrictive. The claimed invention is intended to cover alternatives, modifications, and equivalents.

Claims

1. A storage device, comprising: Controller; a storage medium coupled to the controller; as well as Data security bridge, including security module and key management module; wherein the security module is configured to perform data encryption and / or data decryption; as well as wherein the key management module is configured to obtain a first security key stored in the storage device, obtain a second security key received by the storage device, and perform user authentication based on the first security key and the second security key; The key management module further includes performing user authentication based on the first security key and the second security key: using both the first security key and the second security key to create a signature during the initialization of the storage device and storing it in the storage device as a reference signature; when the storage device is started or woken up, using the key provided by an external device and the first security key to generate a signature and compare it with the reference signature to perform user authentication.

2. The storage device of claim 1, further comprising a first interface for communicating with a computing device and a second interface configured to allow communication between the data security bridge and the controller.

3. The storage device of claim 2, wherein the first interface and the second interface are of the same type. The storage device of claim 2 , wherein the first interface and the second interface are of different types.

5. The storage device of claim 2, wherein the second interface is an internal interface integrated with the controller. 6 . The storage device of claim 1 , wherein the key management module is configured to perform the user authentication based on the first security key and the second security key whenever the storage device is booted from a shutdown mode. 7 . The storage device of claim 1 , wherein the key management module is configured to perform the user authentication based on the first security key and the second security key whenever the storage device wakes up from a power saving mode.

8. The storage device according to claim 1, further comprising a first interface and a second interface, wherein the security module is configured to receive data via the first interface and perform data encryption on the received data to obtain encrypted data; and The second interface is configured to transmit the encrypted data to the controller.

9. The storage device of claim 1, further comprising a first interface and a second interface, wherein the controller is configured to retrieve encrypted data from the storage medium and transmit the encrypted data to the security module via the second interface; and The security module is configured to decrypt the encrypted data to obtain decrypted data, and transmit the decrypted data from the storage device via the first interface.

10. The storage device according to claim 1, further comprising a housing for accommodating the controller, the storage medium and the data security bridge.

11. The storage device of claim 1, wherein the key management module of the data security bridge comprises a medium configured to store the first security key. 12 . The storage device of claim 1 , wherein the controller, the security module, and the key management module are integrated in an integrated circuit (IC) chip.

13. The storage device of claim 1, wherein the second security key is stored in a USB or a mobile phone.

14. The storage device of claim 1, wherein the storage device is configured to be communicatively coupled to a bridge of a computing device via a connector, the connector comprising a SATA connector, an m.2 connector, a PCIe connector, an Ethernet connector, or a U.2 connector.

15. The storage device of claim 1, further comprising a wireless receiver, wherein the storage device is configured to obtain the second security key via the wireless receiver.

16. The storage device of claim 1, wherein the data security bridge further comprises a random number generator.

17. The storage device of claim 1, wherein the storage medium is configured to store encrypted data.

18. The storage device of claim 1, wherein the storage medium comprises a rotating magnetic disk.

19. The storage device according to claim 1, wherein the storage medium comprises a HDD or a NAND flash memory.

20. A computing device comprising the storage device according to claim 1.

21. The computing device of claim 20, wherein the computing device is configured to obtain a user identification different from the second security key.

22. The computing device of claim 21, wherein the user identification comprises a user password.

23. The computing device of claim 21, wherein the user identification comprises a fingerprint, a retinal scan, or a voice signature.

24. The computing device of claim 20, wherein the computing device is configured to receive the second security key from an external device and to transfer the second security key to the key management module in the storage device.

25. The computing device of claim 24, wherein the external device comprises a USB.

26. The computing device of claim 24, wherein the external device comprises a cell phone.

27. The computing device of claim 24, comprising: a device detector configured to detect the external device; a startup and / or wake-up controller configured to suspend a startup and / or wake-up process in response to the device detector detecting the external device; as well as A notification generator is configured to notify a user to remove the external device.

28. The computing device of claim 27, wherein the boot and / or wake-up controller is configured to resume the boot and / or wake-up process in response to the user removing the external device.

29. A method performed by a storage device, the method comprising: Acquire a first security key from a medium in the storage device; obtaining a second security key stored in an external device; Performing user authentication based on the first security key and the second security key by a key management module in the storage device; as well as retrieving encrypted data from a storage medium in the storage device based at least in part on a result of the act of performing the user authentication; The key management module further includes performing user authentication based on the first security key and the second security key: using both the first security key and the second security key to create a signature during the initialization of the storage device and storing it in the storage device as a reference signature; when the storage device is started or woken up, using the key provided by an external device and the first security key to generate a signature and compare it with the reference signature to perform user authentication.

30. The method of claim 29, further comprising obtaining a user identification from a user, wherein if the user identification satisfies criteria and if the user authentication is successful, the encrypted data is retrieved from the storage medium in the storage device.

31. The method of claim 30, wherein the user identification comprises a user password, fingerprint, retinal scan, or voice signature.

32. The method of claim 29, wherein the external device comprises a USB or a cell phone.

33. The method of claim 29, wherein the storage device includes a wireless receiver, and wherein the second security key is obtained by the storage device using the wireless receiver.

34. The method of claim 29, further comprising: receiving data at the storage device; as well as Data encryption is performed on the received data to obtain the encrypted data.

35. The method of claim 29, further comprising: transmitting the encrypted data to a security module in the storage device; decrypting the encrypted data by the security module to obtain decrypted data; as well as The decrypted data is transmitted from the storage device.

36. The method of claim 29, wherein the storage device is coupled to a computing device, and wherein the second security key is transmitted from the external device to the computing device, the computing device communicates the second security key to the storage device.

37. The method of claim 36, further comprising: detecting, by the computing device, the presence of the external device; suspending a boot and / or wake-up process in response to the detected presence of the external device; as well as The user is notified to remove the external device.

38. The method of claim 37, further comprising resuming the boot and / or wake-up process in response to the user removing the external device.

Images