Challenge and response access control providing data security in data storage devices

1. A data storage device that comprises code for providing security to data stored on the data storage device, wherein the code is stored on a computer readable medium in the data storage device, the data storage device comprising:

non-volatile memory;

code for generating a first public key and a secret key pair;

code for encrypting data stored in the non-volatile memory using a bulk encryption key, encrypting the bulk encryption key using the first public key to generate an encrypted bulk encryption key, and storing the encrypted bulk encryption key in the non-volatile memory;

code for generating a challenge and response pair, wrapping the secret key with the response to generate a wrapped secret key, and storing the challenge and the wrapped secret key in the non-volatile memory, wherein the challenge is a random number encrypted with a second public key, and wherein the response is the random number that equals the challenge decrypted with a private key;

code for authenticating a host by retrieving the challenge and the wrapped secret key from the non-volatile memory, erasing the challenge and the wrapped secret key from the non-volatile memory, sending the challenge to the host after the challenge and the wrapped secret key have been erased from the non-volatile memory, receiving the response that is generated based on the challenge from the host, and unwrapping the wrapped secret key using the response from the host to regenerate the secret key; and

code for decrypting the encrypted bulk encryption key using the regenerated secret key to regenerate the bulk encryption key and decrypting the data stored in the non-volatile memory using the regenerated bulk encryption key.

2. The data storage device defined in claim 1 wherein the code for generating the challenge and the response pair, wrapping the secret key with the response to generate the wrapped secret key, and storing the challenge and the wrapped secret key in the non-volatile memory further comprises code for generating multiple challenge and response pairs, wrapping the secret key with each of the responses to generate wrapped secret keys, and storing the challenges and the wrapped secret keys in the non-volatile memory.

3. The data storage device defined in claim 1 wherein the bulk encryption key, the response, and the secret key are not stored in the non-volatile memory in an unencrypted format.

4. The data storage device defined in claim 1 wherein the data storage device is a hard disk drive and the non-volatile memory is a magnetic hard disk.

5. The data storage device defined in claim 1 wherein the secret key is a symmetric key.

6. The data storage device defined in claim 1 wherein the secret key is an asymmetric key.

7. The data storage device defined in claim 1 wherein the code for encrypting the data stored in the non-volatile memory using the bulk encryption key, encrypting the bulk encryption key using the first public key to generate an encrypted bulk encryption key, and storing the encrypted bulk encryption key in the non-volatile memory further comprises code for wrapping the bulk encryption key to generate a wrapped bulk encryption key and storing the wrapped bulk encryption key in the non-volatile memory.

8. A data storage device comprising:

non-volatile memory that stores data, wherein the data storage device generates a first public key and a secret key pair, encrypts the data using a bulk encryption key, encrypts the bulk encryption key using the first public key to generate an encrypted bulk encryption key, and stores the encrypted bulk encryption key in the non-volatile memory;

wherein the data storage device generates a challenge and response pair, wraps the secret key with the response to generate a wrapped secret key, and stores the challenge and the wrapped secret key in the non-volatile memory, wherein the challenge is a random number encrypted with a second public key, and wherein the response is the random number that equals the challenge decrypted with a private key;

wherein the data storage device authenticates a host by reading the challenge and the wrapped secret key from the non-volatile memory, erasing the challenge and the wrapped secret key from the non-volatile memory, sending the challenge to the host, receiving the response that is generated based on the challenge from the host, and unwrapping the wrapped secret key using the response from the host to regenerate the secret key, and

wherein the data storage device decrypts the encrypted bulk encryption key using the regenerated secret key, and decrypts the data stored in the non-volatile memory using the decrypted bulk encryption key.

9. The data storage device defined in claim 8 wherein the data storage device generates multiple challenge and response pairs, wraps the secret key with each of the responses to generate wrapped secret keys, and stores the challenges and the wrapped secret keys in the non-volatile memory.

10. The data storage device defined in claim 8 wherein the response, the secret key, and the bulk encryption key are not stored in the non-volatile memory in an unencrypted format, and wherein the data storage device wraps the bulk encryption key to generate a wrapped bulk encryption key and stores the wrapped bulk encryption key in the data storage device.

11. The data storage device defined in claim 8 wherein the data storage device is a hard disk drive and the non-volatile memory is a magnetic hard disk.

12. A data storage device comprising:

non-volatile memory that stores data, wherein the data storage device generates a first public key and a secret key pair, encrypts the data using a bulk encryption key, encrypts the bulk encryption key using the first public key to generate an encrypted bulk encryption key, and stores the encrypted bulk encryption key in the non-volatile memory;

wherein the data storage device generates a challenge and response pair, wraps the secret key with a first number that is a function of the response to generate a wrapped secret key, and stores the challenge and the wrapped secret key in the non-volatile memory, wherein the challenge is a random number encrypted with a second public key, and wherein the response is the random number that equals the challenge decrypted with a private key;

wherein the data storage device authenticates a host by reading the challenge and the wrapped secret key from the non-volatile memory, erasing the challenge and the wrapped secret key from the non-volatile memory, sending the challenge to the host, receiving the response that is generated based on the challenge from the host, and unwrapping the wrapped secret key using the first number to regenerate the secret key, and

wherein the data storage device decrypts the encrypted bulk encryption key using the regenerated secret key, and decrypts the data stored in the non-volatile memory using the decrypted bulk encryption key.

13. The data storage device defined in claim 12 wherein the bulk encryption key, the response, the first number, and the secret key are not stored in the non-volatile memory in an unencrypted format.

14. The data storage device defined in claim 12 wherein the data storage device generates multiple challenge and response pairs, wraps the secret key with numbers that are functions of the responses to generate wrapped secret keys, and stores the challenges and the wrapped secret keys in the non-volatile memory.

15. The data storage device defined in claim 12 wherein the function is selected from the group consisting of a padding function, a trimming function, and a hash function.