Data storage device detecting read-before-write conditions and returning configurable return data

Abstract

Disclosed herein is a data storage device comprising data storage media comprising a plurality of data sectors and control circuitry programmed to: receive a command from a host to cryptographically erase at least a portion of data stored on the data storage media; execute a cryptographic erase; receive a read command from the host to read a data sector in the data storage media; determine if the data sector has been cryptographically erased; and return configurable return data to the host in response to determining that the data sector has been cryptographically erased.

Description

BACKGROUND

Certain data storage devices may support a cryptographic erase feature whereby data is encrypted with a key and rendered inaccessible (effectively erased) by deleting the key used for such encryption.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1A shows a data storage device according to an embodiment.

FIG. 1B is a flow diagram showing a method executed by the control circuitry of the data storage device according to an embodiment.

FIG. 2 illustrates example data path protection information according to an embodiment.

FIGS. 3A-3C illustrate various data processing scenarios including the read-before-write scenario according to an embodiment.

FIG. 4 is a flow chart illustrating a method of reading data from the data storage device and performing various related checks according to an embodiment.

FIG. 5 is a flow chart illustrating a method of writing data to the data storage device and performing various related checks according to an embodiment.

DETAILED DESCRIPTION

FIG. 1A shows a data storage device 8 according to an embodiment. In an embodiment, the data storage device 8 comprises magnetic recording media such as a disk 2 comprising a plurality of servo tracks 22 defined by servo sectors 24₀-24_N, a head 4 actuated over the disk 2, and control circuitry 10 comprising a servo control system operable to servo the head 4 over the disk 2. In the embodiment of FIG. 1A, the control circuitry 24 processes a read signal 26 emanating from the head 4 to demodulate the servo sectors 24₀-24_N and generate a position error signal (PES) representing an error between the actual position of the head and a target position relative to a target track. The control circuitry 10 filters the PES using a suitable compensation filter to generate a control signal 28 applied to a voice coil motor (VCM) 30 which rotates an actuator arm 32 about a pivot in order to actuate the head 4 radially over the disk 2 in a direction that reduces the PES. The servo sectors 24₀-24_N may comprise any suitable head position information, such as a track address for coarse positioning and servo bursts for fine positioning. The servo bursts may comprise any suitable pattern, such as an amplitude based servo pattern or a phase based servo pattern.

In another embodiment, the control circuitry 10 is configured to read data from, and write data to, a solid-state memory media 38, either in addition to, or in place of, magnetic recording media such as disk 2. Thus, the data storage device 8 may comprise one or more of: (1) the disk 2 and the associated servo-mechanical system and (2) the solid-state memory 38 and the associated circuitry.

In an embodiment, the control circuitry 10 is operable to execute the method shown in the flow diagram of FIG. 1B. At block 42, a command is received from a host to cryptographically erase at least a portion of data stored on the data storage media (e.g., disk 2 or solid state memory 38). The cryptographic erase command may result in the cryptographic erasure of all user data in the data storage device. At block 44, in response to the host command, a cryptographic erase is executed in the data storage device. At block 46, a read command from the host to read a data sector is received by the data storage device. At block 48, it is determined if the requested data sector has been cryptographically erased. At block 50, configurable return data is returned to the host in response to determining that the data sector has been cryptographically erased. This situation in which cryptographic erased data is requested in a read command before it is overwritten is referred to as a “read-before-write” condition.

In an embodiment, the control circuitry is further programmed to decrypt data stored in the data sector based on a key and determine that the data sector has been cryptographically erased when the decryption fails. As will be explained further below in conjunction with FIGS. 3A-3C and 4, when the key has been invalidated and no hardware error has been detected, this constitutes a read-before-write condition.

The configurable return data that is returned to the host may take on several forms in various embodiments. In an embodiment, the control circuitry is configured to return scrambled data as the configurable return data. The scrambled data may be generated by decrypting data written to the data sector with a different key than the key used for encryption just prior to writing the data to the data sector. In another embodiment, the configurable return data may include a data path protection tag that identifies the returned data as configurable return data instead of user data read from the data sector. The data path protection tag may be defined according to a standard such as the Small Computer System Interface (SCSI) T10 standard, and the tag may include SCSI T10 protection information.

FIG. 2 illustrates example data path protection information according to an embodiment. As shown in table 52, each field (user data, logical block guard (LBG), application tag, and reference tag) may include several configurable options. For example, in the user data field, configurable return data may be configured such that either scrambled data or a fixed identifier is returned as the “user data” when a cryptographic erase condition is encountered. Similarly, configurable return data may be configured such that scrambled data, a fixed identifier, or CRC information may be returned under the LBG field. The same could be configured for the other fields shown and so on. The various options under each field can be combined, so that the configurable return data can be highly customizable to suit the expectation of the host. In an embodiment, the configurable return data may be configured so that the host can discern, through the configurable return data, that a read-before-write condition has occurred, and take appropriate error handling actions. The individual options may also indicate to the host additional identifying information such as drive identifier, sector identifier, etc. to aid in the error handling actions. In some embodiments, the configurable return data may be configured to meet backward compatibility requirements of the host system.

FIGS. 3A-3C illustrate various data processing scenarios including the read-before-write scenario according to an embodiment. FIG. 3A illustrates a normal read scenario. Under this scenario, first, when the data is read from the media, a check indicates a valid physical block of data has been accessed. Second, another check indicates a valid logical block of data has been accessed. This logical block check is typically performed pre-decryption. Third, another check indicates that no hardware decryption error has been detected during the decryption process. Finally, a post-decryption logical block check also verifies that a valid logical block has been accessed. When these checks indicate that these conditions are verified, the data retrieved from the media (user data) is returned to the host as part of a normal read operation.

In the read-before-write scenario shown in FIG. 3B, the physical block, logical block, and hardware decryption condition check results are identical to the normal read scenario. However, the post-decryption logical block check indicates that an invalid logical block has been accessed. In an embodiment, an error detection code (EDC) is seeded with a logical block address at the time of writing, and that EDC does not verify correctly post-decryption, indicating that an error has occurred. This could occur, if a cryptographic erase has taken place between initial writing and the read, and as a result the key used to encrypt the original data is no longer available for decryption. This read-before-write scenario is contrasted with a normal read error scenario shown in FIG. 3C, where, in addition to the failed logical block check post-decryption, a hardware decryption error has also been detected.

FIG. 4 is a flow chart illustrating a method of reading data from the data storage device and performing various related checks according to an embodiment. In an embodiment, the data path protection and decryptor checking method 62 is performed by the control circuitry 10 of the data storage device 8. The method 62 in an embodiment is performed as part of a read operation in a data storage device that implements encryption. At block 64, the control circuitry checks whether it has accessed a valid physical block of data. In an embodiment, this check includes checking an EDC that was PBA (physical block address) seeded at the time of writing to see if the recovered PBA matches the expected value. If not, the method ends at the failure block 80, where an error handling mechanism may be triggered. Otherwise, an additional check is performed to determine whether the valid logical block of data has been read. This may include checking whether an EDC that was LBA seeded at the time of writing verifies correctly. If the check fails, again the method ends at the failure block 80.

Otherwise, if the check at block 66 verifies correctly, a dual decryptor is used at block 68 in an embodiment, and the results from both decryptors are compared to each other at block 70 to ensure that the decryption executed properly. The use of a dual decryptor in an embodiment enables a high-confidence confirmation of a good decryption without errors. This aids in the detection of a read-before-write condition by distinguishing a scenario that is caused by a hardware decryption error from one caused by a key change. If no decryption error is detected, then at block 72 an additional check is performed. In an embodiment, this check includes checking an EDC that was LBA seeded at the time of writing to see if the recovered LBA post decryption matches the expected value. If the check verifies correctly, this means that a cryptographic erase has not taken place. Finally, the read data is returned to the host at block 76. If an error is found at block 72, a read-before-write condition has been detected and configurable return data is returned to the host as described above.

FIG. 5 is a flow chart illustrating a method of writing data to the data storage device and performing various related checks according to an embodiment. In an embodiment, the data path protection and encryptor checking method 92 is performed by the control circuitry 10 of the data storage device 8. The method 92 in an embodiment is performed as part of a write operation in a data storage device that implements encryption, and may be complementary to the method 62 shown in FIG. 4. At block 94, the control circuitry checks whether a data buffer error has been encountered. The check includes checking error detection code (EDC) data as the data is read from the buffer in anticipation of writing to the media. In one embodiment, the same EDC is carried with the data to be written throughout the remainder of the process. If the check fails, the method ends at the failure block 106, where an error handling mechanism may be triggered. If the check at block 94 verifies correctly, a dual encryptor is used at block 96, and the results from both encryptors are compared to each other at block 98 to ensure that the encryption executed properly. The use of a dual encryptor in an embodiment enables a high-confidence confirmation of a good encryption without errors. If no encryption error is detected, then at block 100 an LBA seeded EDC is generated and appended to the data. Then, at block 102 an PBA seeded EDC is generated and appended to the data. The data, with the appended EDC information, are then written to the media in block 104.

Those skilled in the art will appreciate that in some embodiments, other types of data storage devices can be implemented. In addition, the actual steps taken in the processes shown in FIGS. 1B, 4, and 5 may differ from those shown in the figures. Depending on the embodiment, certain of the steps described above may be removed, others may be added. While certain embodiments have been described, these embodiments have been presented by way of example only, and are not intended to limit the scope of protection. Indeed, the novel methods and systems described herein may be embodied in a variety of other forms. Furthermore, various omissions, substitutions and changes in the form of the methods and systems described herein may be made.

The accompanying claims and their equivalents are intended to cover such forms or modifications as would fall within the scope and spirit of the protection. For example, the various components illustrated in the figures may be implemented as software and/or firmware executed by a processor, ASIC/FPGA, or dedicated hardware. For example, the actions described as performed by the control circuitry could be implemented as being performed by software and/or firmware executed by a processor, ASIC/FPGA, or dedicated hardware. Also, the features and attributes of the specific embodiments disclosed above may be combined in different ways to form additional embodiments, all of which fall within the scope of the present disclosure. Although the present disclosure provides certain preferred embodiments and applications, other embodiments that are apparent to those of ordinary skill in the art, including embodiments which do not provide all of the features and advantages set forth herein, are also within the scope of this disclosure. Accordingly, the scope of the present disclosure is intended to be defined only by reference to the appended claims.

Claims

1. A data storage device comprising: data storage media comprising a plurality of data sectors; andcontrol circuitry programmed to: receive a command from a host to cryptographically erase at least a portion of data stored on the data storage media;execute a cryptographic erase;receive a read command from the host to read a data sector in the data storage media, wherein the read command comprises a logical block address (LBA);map the LBA to a physical block address (PBA) representing the data sector;use the PBA to read the data sector from the storage media to generate read data;decrypt the read data to generate decrypted read data;execute a data path protection check on the decrypted read data using at least one of the LBA and the PBA;when the data path protection check fails, determine that the data sector has been cryptographically erased; andreturn configurable return data to the host in response to determining that the data sector has been cryptographically erased.

2. The data storage device as recited in claim 1, wherein the control circuitry is further programmed to: decrypt data stored in the data sector based on a key; anddetermine that the data sector has been cryptographically erased when a read-before-write condition is detected.

3. The data storage device as recited in claim 2, wherein the read-before-write condition is detected when the key has been invalidated and no hardware error has been detected.

4. The data storage device as recited in claim 1, wherein the configurable return data comprises scrambled data.

5. The data storage device as recited in claim 4, wherein the control circuitry is further configured to generated the scrambled data by decrypting data written to the data sector with a different key than the one used for encryption prior to writing the data to the data sector.

6. The data storage device as recited in claim 1, wherein the control circuitry is further configured to return a data path protection tag that identifies the returned data as configurable return data instead of data read from the data sector.

7. The data storage device as recited in claim 6, wherein the data storage device supports a Small Computer System Interface (SCSI) and the data path protection tag comprises SCSI T10 protection information.

8. The data storage device as recited in claim 1, wherein the data storage media comprises at least one of: magnetic recording media; andsolid-state non-volatile memory media.

9. The data storage device as recited in claim 1, wherein the data path protection check comprises generating an error detection code (EDC) over at least part of the decrypted read data based on the LBA received in the read command.

10. A method for managing data in a data storage device that comprises data storage media comprising a plurality of data sectors, the method comprising: receiving a command from a host to cryptographically erase at least a portion of data stored on the data storage media;executing a cryptographic erase;receiving a read command from the host to read a data sector in the data storage media, wherein the read command comprises a logical block address (LBA);mapping the LBA to a physical block address (PBA) representing the data sector;using the PBA to read the data sector from the storage media to generate read data;decrypting the read data to generate decrypted read data;executing a data path protection check on the decrypted read data using at least one of the LBA and the PBA;when the data path protection check fails, determining that the data sector has been cryptographically erased; andreturning configurable return data to the host in response to determining that the data sector has been cryptographically erased.

11. The method as recited in claim 10, further comprising: decrypting data stored in the data sector based on a key; anddetermining that the data sector has been cryptographically erased when a read-before-write condition is detected.

12. The method as recited in claim 11, wherein the read-before-write condition is detected when the key has been invalidated and no hardware error has been detected.

13. The method as recited in claim 10, wherein the configurable return data comprises scrambled data.

14. The method as recited in claim 13, further comprising generating the scrambled data by decrypting data written to the data sector with a different key than the one used for encryption prior to writing the data to the data sector.

15. The method as recited in claim 10, wherein returning the configurable return data comprises returning a data path protection tag that identifies the returned data as configurable return data instead of data read from the data sector.

16. The method as recited in claim 15, wherein the data storage device supports a Small Computer System Interface (SCSI) and the data path protection tag comprises SCSI T10 protection information.

17. The method as recited in claim 10, wherein the data storage media comprises at least one of: magnetic recording media; andsolid-state non-volatile memory media.

18. The method as recited in claim 10, wherein the data path protection check comprises generating an error detection code (EDC) over at least part of the decrypted read data based on the LBA received in the read command.