Techniques for encrypting data on storage devices using an intermediate key

1. A method performed on a data storage device for providing security to data stored on the data storage device, the method comprising:

encrypting data using a bulk encryption key;

storing the encrypted data in non-volatile memory on the data storage device;

generating a first password-generated encryption key based on a first password;

generating a second password-generated encryption key based on a second password;

wrapping an intermediate encryption key with the first password-generated encryption key to generate a first wrapped intermediate key;

storing the first wrapped intermediate key in the non-volatile memory;

wrapping the intermediate encryption key with the second password-generated encryption key to generate a second wrapped intermediate key;

storing the second wrapped intermediate key in the non-volatile memory;

wrapping the bulk encryption key with the intermediate encryption key to generate a wrapped bulk encryption key;

unwrapping the wrapped bulk encryption key to regenerate the bulk encryption key using the intermediate encryption key regenerated from the first wrapped intermediate key;

decrypting the encrypted data stored in the non-volatile memory using the regenerated bulk encryption key;

encrypting the data using a new bulk encryption key;

wrapping the new bulk encryption key with the intermediate encryption key to generate a new wrapped bulk encryption key;

regenerating the second password-generated encryption key based on the second password;

unwrapping the second wrapped intermediate key to regenerate the intermediate encryption key using the regenerated second password-generated encryption key;

unwrapping the new wrapped bulk encryption key to regenerate the new bulk encryption key using the intermediate encryption key regenerated from the second wrapped intermediate key; and

decrypting the data using the regenerated new bulk encryption key.

2. The method defined in claim 1 wherein the data storage device is a hard disk drive and the non-volatile memory is a magnetic hard disk.

3. The method defined in claim 1 further comprising:

storing the wrapped bulk encryption key in the non-volatile memory.

4. The method defined in claim 3 further comprising:

retrieving the wrapped bulk encryption key from the non-volatile memory and unwrapping the wrapped bulk encryption key to regenerate the bulk encryption key using the intermediate encryption key regenerated from the second wrapped intermediate key.

5. The method defined in claim 3 further comprising:

regenerating the first password-generated encryption key based on the first password; and

retrieving the first wrapped intermediate key from the non-volatile memory and unwrapping the first wrapped intermediate key to regenerate the intermediate encryption key using the regenerated first password-generated encryption key.

6. The method defined in claim 5 further comprising:

storing the new wrapped bulk encryption key in the non-volatile memory without preventing a user from accessing the data with the second password.

7. The method defined in claim 1 wherein the first password-generated encryption key, the intermediate encryption key, and the bulk encryption key are not stored on the non-volatile memory in an unencrypted format.

8. A data storage device that comprises code for decrypting data stored on the data storage device, wherein the code is stored on a computer readable medium in the data storage device, the data storage device comprising:

non-volatile memory;

code for generating a first password-generated encryption key based on a first password;

code for wrapping an intermediate encryption key with the first password-generated encryption key to generate a first wrapped intermediate key and storing the first wrapped intermediate key in the non-volatile memory;

code for generating a second password-generated encryption key based on a second password;

code for wrapping the intermediate encryption key with the second password-generated encryption key to generate a second wrapped intermediate key and storing the second wrapped intermediate key in the non-volatile memory;

code for retrieving the first wrapped intermediate key from the non-volatile memory and unwrapping the first wrapped intermediate key to generate the intermediate encryption key using the first password-generated encryption key;

code for retrieving a wrapped bulk encryption key from the non-volatile memory, unwrapping the wrapped bulk encryption key to generate a bulk encryption key using the intermediate encryption key generated from the first wrapped intermediate key, and decrypting data stored in the non-volatile memory using the bulk encryption key;

code for encrypting the data using a new bulk encryption key;

code for wrapping the new bulk encryption key with the intermediate encryption key to generate a new wrapped bulk encryption key;

code for unwrapping the second wrapped intermediate key to regenerate the intermediate encryption key using the second password-generated encryption key;

code for unwrapping the new wrapped bulk encryption key to regenerate the new bulk encryption key using the intermediate encryption key regenerated from the second wrapped intermediate key; and

code for decrypting the data using the new bulk encryption key.

9. The data storage device defined in claim 8 further comprising:

code for wrapping the bulk encryption key with the intermediate encryption key to generate the wrapped bulk encryption key and storing the wrapped bulk encryption key in the non-volatile memory.

10. The data storage device defined in claim 9 wherein code for generating a first password-generated encryption key based on a first password further comprises code for using a key derivation function to generate the first password-generated encryption key based on a first random salt number and the first password.

11. The data storage device defined in claim 9 further comprising:

code for storing the new wrapped bulk encryption key in the non-volatile memory without preventing a user from accessing the data with the second password.

12. The data storage device defined in claim 8 wherein the first password-generated encryption key, the intermediate encryption key, and the bulk encryption key are not stored in the non-volatile memory in an unencrypted format.

13. The data storage device defined in claim 8 wherein the data storage device is a hard disk drive and the non-volatile memory is a magnetic hard disk.

14. A data storage device comprising:

non-volatile memory that stores data; and

an integrated circuit that encrypts the data stored in the non-volatile memory using a bulk encryption key, wherein a first wrapped intermediate key and a second wrapped intermediate key are stored in the non-volatile memory,

wherein the data storage device generates a first password-generated encryption key based on a first password, generates a second password-generated encryption key based on a second password, unwraps the first wrapped intermediate key to generate an intermediate encryption key using the first password-generated encryption key, retrieves a wrapped bulk encryption key from the non-volatile memory, unwraps the wrapped bulk encryption key to generate the bulk encryption key using the intermediate encryption key generated from the first wrapped intermediate key, and decrypts the data stored on the non-volatile memory using the bulk encryption key,

wherein the data storage device encrypts the data using a new bulk encryption key, wraps the new bulk encryption key with the intermediate encryption key to generate a new wrapped bulk encryption key, unwraps the second wrapped intermediate key to regenerate the intermediate encryption key using the second password-generated encryption key, unwraps the new wrapped bulk encryption key to regenerate the new bulk encryption key using the intermediate encryption key regenerated from the second wrapped intermediate key, and decrypts the data using the regenerated new bulk encryption key.

15. The data storage device defined in claim 14 wherein the data storage device uses a key derivation function to generate the first password-generated encryption key based on a first random salt number and the first password, wraps the intermediate encryption key with the first password-generated encryption key to generate the first wrapped intermediate key, wraps the bulk encryption key with the intermediate encryption key to generate the wrapped bulk encryption key, and stores the wrapped bulk encryption key in the non-volatile memory.

16. The data storage device defined in claim 15 wherein the data storage device uses the key derivation function to generate the second password-generated encryption key based on a second random salt number and the second password, wraps the intermediate encryption key with the second password-generated encryption key to generate the second wrapped intermediate key, and stores the second wrapped intermediate key in the non-volatile memory.

17. The data storage device defined in claim 16 wherein the data storage device uses the key derivation function to regenerate the second password-generated encryption key based on the second random salt number and the second password, retrieves the second wrapped intermediate key from the non-volatile memory, unwraps the second wrapped intermediate key to regenerate the intermediate encryption key using the regenerated second password-generated encryption key, retrieves the wrapped bulk encryption key from the non-volatile memory, and unwraps the wrapped bulk encryption key to regenerate the bulk encryption key using the intermediate encryption key regenerated from the second wrapped intermediate key.

18. The data storage device defined in claim 17 wherein the integrated circuit stores the new wrapped bulk encryption key on the non-volatile memory without preventing a user from accessing the data with the second password.

19. The data storage device defined in claim 14 wherein the first password-generated encryption key, the intermediate encryption key, and the bulk encryption key are not stored in the non-volatile memory in an unencrypted format, and the data storage device is a hard disk drive.