Patent ID: 8484736

Claim:
A method comprising: in a storage device having a host interface, the storage device including a storage area for storing data, a storage controller for managing the storage area, and a security processor, performing, while the storage device is operatively coupled to a host device via the host interface: in response to initialization of the storage device, operating the storage device in a security mode, wherein operating the storage device in the security mode includes: receiving a command from the host device, determining, by the security processor, whether the received command includes an indication from the host device that an anti-virus application is executing on the host device, when the received command includes the indication, transitioning from operating the storage device in the security mode to operating the storage device in a safe mode, when the command does not include the indication, determining whether the received command poses a security threat, when the received command poses the security threat, logging, by the security processor, the received command in a command alert log, storing at least one of the received command and information associated with the received command in a volatile memory in the storage area, blocking the received command from reaching the storage controller, and notifying the host device that the command was executed as expected by the host device, and when the received command does not pose the security threat, passing the received command to the storage controller, and wherein operating the storage device in the safe mode includes forwarding to the storage controller commands received from the host device without filtering the commands received from the host device.