Trusted storage

1. A computer-implemented method for authenticating access to encrypted content on a storage device, the method comprising:

receiving a pass code from a host over an authenticated communication channel between a host and the storage device, the storage device having stored therein encrypted content, wherein the encrypted content is encrypted according to a content encryption key, the storage device including an encrypted version of the content encryption key and an encrypted version of a content-key encryption key, and wherein the encrypted version of the content encryption key is encrypted according to the content key encryption key;

verifying an authenticity of the pass code and obtaining a derived key by hashing the pass code if the pass code is authentic, wherein the encrypted version of the content-key encryption key is encrypted according to the derived key;

decrypting the encrypted version of the content-key encryption key using the derived key to recover the content-key encryption key;

decrypting the encrypted content encryption key using the recovered content-key encryption key to recover the content encryption key; and

decrypting the encrypted content using the content encryption key.

2. The method of claim 1 , further comprising providing an authenticated communication channel between the host and the storage device.

3. The method of claim 2 , wherein providing an authenticated communication channel further comprises:

the host authenticating the storage device through a first authentication protocol using a first public key or a first private key; and

the storage device authenticating the host through a second authentication protocol using a second public key or a second private key.

4. The method of claim 1 , wherein receiving a pass code further comprises:

selecting a user record;

associating the received pass code with the user record; and

processing the pass code to uncover the derived key associated to the user record, wherein the user record is one of a plurality of user records and the derived key associated with the user record is unique to the user record associated with the received pass code.

5. The method of claim 1 , wherein obtaining the derived key comprises hashing the pass code to form the derived key.

6. The method of claim 5 , wherein obtaining the derived key further comprises:

associating a user record on the storage device to the pass code; and storing the derived key-encrypted version of the content-key encryption key in the user record associated to the pass code.

7. The method of claim 1 , wherein decrypting the encrypted version of the content-key encryption key to recover the content-key encryption key further comprises:

recovering the derived key using the pass code;

associating a user record on the storage device to the pass code; and

using the derived key to decrypt the encrypted version of the content-key encryption key stored in the user record associated to the pass code, wherein the user record is one of a plurality of user records and the encrypted version of the content-key encryption key is unique to the user record associated to the pass code.

8. The method of claim 1 , wherein decrypting the encrypted content encryption key using the recovered content-key encryption key to recover the content encryption key further comprises:

accessing the encrypted content encryption key in a secure provider (SP) area, wherein the SP area stores at least one user record.

9. The method of claim 1 , further comprising using the recovered content encryption key to encrypt content and store the encrypted content on the storage device.

10. The method of claim 1 , wherein a derived key associated to a user record is generated using a National Security Agency (NSA) secure hash algorithm (SHA) hash of a pass code associated to the user record.

11. The method of claim 1 , wherein:

a derived key associated to a user record is generated using an NSA SHA hash of a pass code associated to a user record;

the encrypted version of the content-key encryption key is encrypted by the derived key associated to the user record through an advanced encryption standard (AES); and

the AES, derived key-encrypted version of the content-key encryption key is stored in the user record in an SP area.

12. The method of claim 1 , wherein verifying an authenticity of the pass code further comprises using an N-factor authentication protocol including a plurality of factors.

13. A system for authenticating access to encrypted content on a storage device, wherein the encrypted content is encrypted according to a content encryption key, the storage device including an encrypted version of the content encryption key and an encrypted version of a content-key encryption key, and wherein the encrypted version of the content encryption key is encrypted according to the content-key encryption key, the system comprising:

a host; and

a storage device;

wherein the storage device is configured to:

receive a pass code from the host over an authenticated communication channel;

verify an authenticity of the pass code and obtain a derived key by hashing the pass code if the pass code is authentic, wherein the encrypted version of the content-key encryption key is encrypted according to the derived key;

decrypt the encrypted version of the content-key encryption key using the derived key to recover the content-key encryption key;

decrypt the encrypted content encryption key using the recovered content key encryption key to recover the content encryption key; and

decrypt the encrypted content using the content encryption key.

14. The system of claim 13 , wherein the host is configured to authenticate the storage device through a first authentication protocol using a first public key or a first private key; and wherein the storage device is configured to authenticate the host through a second authentication protocol using a second public key or a second private key.

15. The system of claim 13 , wherein the storage device is configured to:

select a user record;

associate the received pass code with the user record; and

process the pass code to uncover the derived key associated to the user record, wherein the user record is one of a plurality of user records and the derived key associated with the user record is unique to the user record associated with the received pass code.

16. The system of claim 13 , wherein the storage device is configured to obtain the derived key by at least in part hashing the pass code to form the derived key.

17. The method of claim 16 , wherein the storage device is configured to obtain the derived key by at least in part:

associating a user record on the storage device to the pass code; and

storing the derived key-encrypted version of the content-key encryption key in the user record associated to the pass code.

18. The system of claim 13 , wherein the storage device is configured to decrypt the encrypted version of the content-key encryption key to recover the content-key encryption key by at least in part:

recovering the derived key using the pass code;

associating a user record on the storage device to the pass code; and

using the derived key to decrypt the encrypted version of the content-key encryption key stored in the user record associated to the pass code, wherein the user record is one of a plurality of user records and the encrypted version of the content-key encryption key is unique to the user record associated to the pass code.

19. The system of claim 13 , wherein the storage device is configured to decrypt the encrypted content encryption key using the recovered content-key encryption key to recover the content encryption key by at least in part:

accessing the encrypted content encryption key in a secure provider (SP) area, wherein the SP area stores at least one user record.

20. The system of claim 13 , wherein the storage device is further configured to use the recovered content encryption key to encrypt content and store the encrypted content on the storage device.

21. The system of claim 13 , wherein a derived key associated to a user record is generated using a National Security Agency (NSA) secure hash algorithm (SHA) hash of a pass code associated to the user record.

22. The system of claim 13 , wherein:

a derived key associated to a user record is generated using an NSA SHA hash of a pass code associated to a user record;

the encrypted version of the content-key encryption key is encrypted by the derived key associated to the user record through an advanced encryption standard (AES); and

the AES, derived key-encrypted version of the content-key encryption key is stored in the user record in an SP area.

23. The system of claim 13 , wherein the storage device is configured to verify an authenticity of the pass code by at least in part using an N-factor authentication protocol including a plurality of factors.