A host system comprising: one or more computer processors; a data channel (206; 676) connected to the one or more computer processors; an embedded self-encrypting device, SED, (100, 101; 300; 620) connected to the data channel (206; 676), the embedded self-encrypting device comprising: an authentication subsystem configured to validate a user based on received user-authentication information; an encryption engine configured to encrypt data with an encryption key; a storage media that stores encrypted data that is encrypted with the encryption key; a radio frequency, RF, transceiver (306; 624) configured to provide a communication channel, said communication channel being different from the data channel; and a data interface (206, FIG 6C) coupled with the data channel, the data interface being configured to lock sending and receiving data between the one or more computer processors and the storage media until the authentication subsystem validates the user from user-authentication information received via the RF transceiver, thereby unlocking the embedded self-encrypting device, wherein the authentication subsystem is further configured to provide the encryption key to the encryption engine once the user has been validated; and a casing enclosing the one or more computer processors, the data channel (206; 676), and the embedded SED (100, 101; 300; 620), wherein validating the user with the embedded SED is independent from the host system, wherein, when the user has not been validated and the host system powers up, the embedded SED is locked and invisible to the host system and the host system will not boot up (step 222), and wherein, when the embedded SED is unlocked (step 226), the embedded SED becomes visible to the host system during power up and the host system will boot up. one or more computer processors; a data channel (206; 676) connected to the one or more computer processors; an embedded self-encrypting device, SED, (100, 101; 300; 620) connected to the data channel (206; 676), the embedded self-encrypting device comprising: an authentication subsystem configured to validate a user based on received user-authentication information; an encryption engine configured to encrypt data with an encryption key; a storage media that stores encrypted data that is encrypted with the encryption key; a radio frequency, RF, transceiver (306; 624) configured to provide a communication channel, said communication channel being different from the data channel; and a data interface (206, FIG 6C) coupled with the data channel, the data interface being configured to lock sending and receiving data between the one or more computer processors and the storage media until the authentication subsystem validates the user from user-authentication information received via the RF transceiver, thereby unlocking the embedded self-encrypting device, wherein the authentication subsystem is further configured to provide the encryption key to the encryption engine once the user has been validated; and a casing enclosing the one or more computer processors, the data channel (206; 676), and the embedded SED (100, 101; 300; 620), an authentication subsystem configured to validate a user based on received user-authentication information; an encryption engine configured to encrypt data with an encryption key; a storage media that stores encrypted data that is encrypted with the encryption key; a radio frequency, RF, transceiver (306; 624) configured to provide a communication channel, said communication channel being different from the data channel; and a data interface (206, FIG 6C) coupled with the data channel, the data interface being configured to lock sending and receiving data between the one or more computer processors and the storage media until the authentication subsystem validates the user from user-authentication information received via the RF transceiver, thereby unlocking the embedded self-encrypting device, wherein the authentication subsystem is further configured to provide the encryption key to the encryption engine once the user has been validated; and a casing enclosing the one or more computer processors, the data channel (206; 676), and the embedded SED (100, 101; 300; 620), wherein validating the user with the embedded SED is independent from the host system, wherein, when the user has not been validated and the host system powers up, the embedded SED is locked and invisible to the host system and the host system will not boot up (step 222), and wherein, when the embedded SED is unlocked (step 226), the embedded SED becomes visible to the host system during power up and the host system will boot up.