Authentication processing for a plurality of self-encrypting storage devices

1. A method comprising:

performing authentication processing for a plurality of self-encrypting storage devices of a computer system to unlock the plurality of self-encrypting storage devices using a plurality of different unlock keys, the authentication processing for the plurality of self-encrypting storage devices comprising:

obtaining authentication information for one self-encrypting storage device of the plurality of self-encrypting storage devices;

performing authentication processing for the one self-encrypting storage device based on the obtained authentication information for the one self-encrypting storage device; and

based on the authentication processing for the one self-encrypting storage device, performing authentication processing for each additional self-encrypting storage device of one or more additional self-encrypting storage devices of the plurality of self-encrypting storage devices, wherein the authentication processing for the plurality of self-encrypting storage devices sequentially unlocks the plurality of self-encrypting storage devices using the plurality of different unlock keys, wherein an unlock key corresponding to a sequentially-subsequent self-encrypting storage device is obtained based on unlocking a sequentially-previous self-encrypting storage device and obtaining, from the sequentially-previous self-encrypting storage device, the unlock key corresponding to the sequentially-subsequent self-encrypting storage device.

2. The method of claim 1 , wherein the obtaining authentication information for the one self-encrypting storage device comprises obtaining, as the authentication information, at least one user authentication input and measurement data, the measurement data obtained based on a measurement of the computer system, and wherein the authentication processing for the one self-encrypting storage device comprises attempting to unlock the one self-encrypting storage device using the obtained measurement data and user authentication input.

3. The method of claim 1 , wherein the authentication processing for the one self-encrypting storage device comprises:

determining whether the authentication information comprises a predefined erase passphrase; and

based on determining that the authentication information comprises the predefined erase passphrase, erasing at least some data from the one self-encrypting storage device.

4. The method of claim 3 , wherein the authentication processing for each additional self-encrypting storage device comprises erasing at least some data from the additional self-encrypting storage device.

5. The method of claim 1 , wherein the authentication processing for the one self-encrypting storage device comprises unlocking the one self-encrypting storage device, and wherein the authentication processing for each additional self-encrypting storage device comprises unlocking the additional self-encrypting storage device using an unlock key, of the plurality of different unlock keys, corresponding to the additional self-encrypting storage device.

6. The method of claim 5 , wherein the authentication processing for each additional self-encrypting storage device of at least one additional self-encrypting storage device of the one or more additional self-encrypting storage devices further comprises:

obtaining, from a user, authentication input corresponding to the additional self-encrypting storage device; and

processing the authentication input in conjunction with the unlock key corresponding to the additional self-encrypting storage device to determine whether to unlock the additional self-encrypting storage device.

7. The method of claim 5 , wherein the authentication processing for each additional self-encrypting storage device of at least one additional self-encrypting storage device of the one or more additional self-encrypting storage devices further comprises:

obtaining from a user, authentication input corresponding to the additional self-encrypting storage device;

determining whether the authentication input comprises a predefined erase passphrase; and

based on determining that the authentication input comprises the predefined erase passphrase, erasing at least some data from the additional self-encrypting storage device.

8. The method of claim 7 , wherein the authentication processing for each additional self-encrypting storage device of the at least one additional self-encrypting storage device further comprises, prior to erasing the at least some data:

using at least some of the authentication input to unlock the additional self-encrypting storage device and obtain therefrom an unlock key corresponding to another self-encrypting storage device of the one or more additional self-encrypting storage devices, the unlock key for use in the authentication processing for the another self-encrypting storage device; and

proceeding with the erasing the at least some data.

9. The method of claim 1 , further comprising, based on performing the authentication processing for the plurality of self-encrypting storage devices, initiating a boot of the computer system to an operating system, wherein the plurality of self-encrypting storage devices are unlocked for use by the operating system.

10. The method of claim 1 , further comprising, based on a power-on of the computer system:

presenting a selection interface indicating the plurality of self-encrypting storage devices of the computer system;

receiving, based on input to the selection interface, a selection indicating one or more self-encrypting storage devices of the plurality of self-encrypting storage devices, wherein at least one self-encrypting storage device of the plurality of self-encrypting storage devices is not part of the selection; and

performing the authentication processing for the plurality of self-encrypting storage devices, wherein:

for each self-encrypting storage device of the one or more self-encrypting storage devices indicated by the selection, the authentication processing for the self-encrypting storage device comprises (i) unlocking the self-encrypting storage device for use after a boot of the computer system or (ii) erasing at least some data from the self-encrypting storage device; and

for each self-encrypting storage device of the at least one self-encrypting storage device not part of the selection, the authentication processing for the self-encrypting storage device comprises temporarily unlocking the self-encrypting storage device to obtain an unlock key for use in authentication processing for a next self-encrypting drive, and locking the self-encrypting storage device based on obtaining the unlock key.

11. The method of claim 1 , further comprising configuring the computer system with a pre-boot authentication environment, the pre-boot authentication environment comprising program instructions stored on the one self-encrypting storage device for execution to perform the authentication processing for a plurality of self-encrypting storage devices of a computer system, wherein the configuring the computer system with the pre-boot authentication environment comprises:

obtaining from a user configuration information indicating one or more authentication types for use with the plurality of self-encrypting storage devices; and

writing the pre-boot authentication environment, configured to utilize the one or more authentication types, to the one self-encrypting storage device.

12. A computer program product comprising:

a non-transitory computer-readable storage medium comprising program instructions for execution by a processor to perform a method comprising:

performing authentication processing for a plurality of self-encrypting storage devices of a computer system to unlock the plurality of self-encrypting storage devices using a plurality of different unlock keys, the authentication processing for the plurality of self-encrypting storage devices comprising:

obtaining authentication information for one self-encrypting storage device of the plurality of self-encrypting storage devices;

performing authentication processing for the one self-encrypting storage device based on the obtained authentication information for the one self-encrypting storage device; and

based on the authentication processing for the one self-encrypting storage device, performing authentication processing for each additional self-encrypting storage device of one or more additional self-encrypting storage devices of the plurality of self-encrypting storage devices, wherein the authentication processing for the plurality of self-encrypting storage devices sequentially unlocks the plurality of self-encrypting storage devices using the plurality of different unlock keys, wherein an unlock key corresponding to a sequentially-subsequent self-encrypting storage device is obtained based on unlocking a sequentially-previous self-encrypting storage device and obtaining, from the sequentially-previous self-encrypting storage device, the unlock key corresponding to the sequentially-subsequent self-encrypting storage device.

13. The computer program product of claim 12 , wherein the authentication processing for the one self-encrypting storage device comprises:

determining whether the authentication information comprises a predefined erase passphrase; and

based on determining that the authentication information comprises the predefined erase passphrase, erasing at least some data from the one self-encrypting storage device, and wherein the authentication processing for each additional self-encrypting storage device comprises erasing at least some data from the additional self-encrypting storage device.

14. The computer program product of claim 12 , wherein the authentication processing for the one self-encrypting storage device comprises unlocking the one self-encrypting storage device, and wherein the authentication processing for each additional self-encrypting storage device comprises unlocking the additional self-encrypting storage device using an unlock key, of the plurality of different unlock keys, corresponding to the additional self-encrypting storage device.

15. The computer program product of claim 14 , wherein the authentication processing for each additional self-encrypting storage device of at least one additional self-encrypting storage device of the one or more additional self-encrypting storage devices further comprises:

obtaining from a user, authentication input corresponding to the additional self-encrypting storage device;

determining whether the authentication input comprises a predefined erase passphrase; and

based on determining that the authentication input comprises the predefined erase passphrase, erasing at least some data from the additional self-encrypting storage device.

16. The computer program product of claim 12 , wherein the method further comprises:

presenting a selection interface indicating the plurality of self-encrypting storage devices of the computer system;

receiving, based on input to the selection interface, a selection indicating one or more self-encrypting storage devices of the plurality of self-encrypting storage devices, wherein at least one self-encrypting storage device of the plurality of self-encrypting storage devices is not part of the selection; and

performing the authentication processing for the plurality of self-encrypting storage devices, wherein:

for each self-encrypting storage device of the one or more self-encrypting storage devices indicated by the selection, the authentication processing for the self-encrypting storage device comprises (i) unlocking the self-encrypting storage device for use after a boot of the computer system or (ii) erasing at least some data from the self-encrypting storage device; and

for each self-encrypting storage device of the at least one self-encrypting storage device not part of the selection, the authentication processing for the self-encrypting storage device comprises temporarily unlocking the self-encrypting storage device to obtain an unlock key for use in authentication processing for a next self-encrypting drive, and locking the self-encrypting storage device based on obtaining the unlock key.

17. A computer system configured to perform a method comprising:

performing authentication processing for a plurality of self-encrypting storage devices of a computer system to unlock the plurality of self-encrypting storage devices using a plurality of different unlock keys, the authentication processing for the plurality of self-encrypting storage devices comprising:

obtaining authentication information for one self-encrypting storage device of the plurality of self-encrypting storage devices;

performing authentication processing for the one self-encrypting storage device based on the obtained authentication information for the one self-encrypting storage device; and

based on the authentication processing for the one self-encrypting storage device, performing authentication processing for each additional self-encrypting storage device of one or more additional self-encrypting storage devices of the plurality of self-encrypting storage devices, wherein the authentication processing for the plurality of self-encrypting storage devices sequentially unlocks the plurality of self-encrypting storage devices using the plurality of different unlock keys, wherein an unlock key corresponding to a sequentially-subsequent self-encrypting storage device is obtained based on unlocking a sequentially-previous self-encrypting storage device and obtaining, from the sequentially-previous self-encrypting storage device, the unlock key corresponding to the sequentially-subsequent self-encrypting storage device.

18. The computer system of claim 17 , wherein the authentication processing for the one self-encrypting storage device comprises unlocking the one self-encrypting storage device, and wherein the authentication processing for each additional self-encrypting storage device comprises unlocking the additional self-encrypting storage device using an unlock key, of the plurality of different unlock keys, corresponding to the additional self-encrypting storage device.