Block-level storage device with content security
View Patent ↗A block-level storage device is provided that implements a digital rights management (DRM) system. In response to receiving a public key from an associated host system, the storage device challenges the host system to prove it has the corresponding private key to establish trust. This trust is established by encrypting a secure session key using the public key. The host system uses its private key to recover the secure session key. The storage device may store content that has been encrypted according to a content key. In addition, the storage device may encrypt the content key using the secure session key.
1. A block-level storage device, comprising:
a storage medium; and
a storage engine, the storage engine being configured to generate a secure session key and to receive a block of encrypted content and its corresponding encrypted content key from a host system, wherein the content key has been encrypted by the host system using the secure session key, the storage engine being further configured to decrypt the encrypted content key using the secure session key and to encrypt the decrypted content key with a first storage engine encryption key and to write the storage-engine-encrypted content key to the storage medium.
2. The block-level storage device of claim 1 , wherein the storage engine is further configured to generate the secure session key in response to verifying the authenticity of a certifying authority's digital signature provided by the host system.
3. The block-level storage device of claim 2 , wherein the storage engine is further configured to encrypt the secure session key using a public key provided by the host system such that the host system can recover the secure session key only by decrypting the encrypted secure session key using the private key corresponding to the public key.
4. The block-level storage device of claim 3 , wherein the storage engine is further configured to re-encrypt the block of encrypted content using at least a second storage engine encryption key.
5. The block-level storage device of claim 4 , wherein the second storage engine encryption key comprises a Data Encryption Standard (DES) key.
6. The block-level storage device of claim 5 , wherein the DES key comprises a triple DES key.
7. The block-level storage device of claim 1 , wherein the storage engine is a hard disc storage engine and wherein the storage media is a hard disc.
8. The block-level storage device of claim 7 , wherein the storage media is a removable hard disc.
9. The block-level storage device of claim 3 , wherein the public key and the private key are elliptic curve cryptography keys.
10. The block-level storage device of claim 1 , wherein the storage engine includes a random number generator for generating the secure session key.
11. A method of writing to a block-level storage device from a host system having a public key and a corresponding private key, comprising:
encrypting a secure session key using the public key;
recovering the secure session key from the encrypted secure session key using the corresponding private key;
encrypting content according to a content key and commanding the block-level storage device to write the encrypted content to host-system-determined block addresses;
encrypting the content key using the secure session key and transmitting the encrypted content key to the block-level storage device;
in the block-level storage device, decrypting the encrypted content key using the secure session key;
in the block-level storage device, encrypting the decrypted content key with a storage device key; and
writing the storage-device-encrypted content key to a host-system-determined block address.
12. The method of claim 11 , wherein the content comprises a file system object, the method further comprising:
in the block-level storage device, encrypting the decrypted content key with a storage device key, and
writing the storage-device-encrypted content key to a storage-device-determined block address.
13. A block-level storage device, comprising:
a storage medium; and
a storage engine, the storage engine being configured to respond to block-level non-secure content requests, block-level secure content requests, and block-level security metadata requests from a host system, the storage engine being further configured to, in response to a security metadata request, generate a secure session key and to receive an encrypted content key from the host system, wherein the content key has been encrypted by the host system using the secure session key, the storage engine being further configured to decrypt the encrypted content key using the secure session key and to encrypt the decrypted content key with a first storage engine encryption key and to write the storage-engine-encrypted content key to the storage medium.
14. The block-level storage device of claim 13 , wherein the storage engine includes a random number generator for generating the secure session key.
15. The block-level storage device of claim 13 , wherein the storage engine is configured to receive a public key from the host system and to encrypt the secure session key with the public key and to send the encrypted secure session key to the host system, whereby the host system may recover the secure session key only through the use of the host system's corresponding private key.