Multi-device unlocking of a data storage device
Disclosed herein is a data storage device comprising a data path and an access controller. The data path comprises a data port configured to transmit data between a host computer and the data storage device and registers with the host computer system as a block data storage device. A non-volatile storage medium stores encrypted user content data. A cryptography engine is connected between the data port and the storage medium and uses a key to decrypt the encrypted user content data. A data store stores multiple entries comprising authorization data associated with respective authorized devices. The access controller receives from a manager device a public key associated with a private key stored on a device to be authorized, creates the authorization data, and stores the authorization data in association with the public key in the data store, thereby registering the device to be authorized as one of the authorized devices.
1. A data storage device comprising:
a data path, wherein:
the data path comprises:
a data port;
a non-volatile storage medium; and
a cryptography engine connected between the data port and
the storage medium;
the data port is configured to transmit data between a host computer system and the data storage device;
the data storage device is configured to register with the host computer system as a block data storage device;
the non-volatile storage medium is configured to store encrypted user content data; and
the cryptography engine is configured to use a cryptographic key to decrypt the encrypted user content data stored on the storage medium in response to a request from the host computer system;
a memory comprising a data store, wherein the data store is configured to store multiple entries comprising authorization data associated with respective multiple authorized devices; and
an access controller connected to the data path and the data store, wherein the access controller is configured to:
receive from a manager device a public key, wherein:
the public key is associated with a private key stored on a device to be authorized;
the host computer system is a first device;
the manager device is a second device; and
the device to be authorized is a third device;
create the authorization data for the device to be authorized; and
store, in a respective entry in the data store, the authorization data associated with the device to be authorized, wherein the authorization data in the respective entry includes the public key and registers the device to be authorized as an authorized device of the multiple authorized devices.
2. The data storage device of claim 1 , wherein the access controller is further configured to:
receive an indication of the public key from the authorized device of the multiple authorized devices;
generate a challenge based on the authorization data in the respective entry;
send the challenge to the authorized device of the multiple authorized devices;
receive a response to the challenge from the authorized device of the multiple authorized devices; and
upon validation of the response, update the authorization data in the respective entry stored on the data store and allow, based on the authorized device of the multiple authorized devices, the cryptographic engine to decrypt the encrypted user content data.
3. The data storage device of claim 1 , wherein the access controller is further configured to generate an index of the authorization data stored in the multiple entries based on the public key.
4. The data storage device of claim 3 , wherein the index of the authorization data is based on a private key stored in the data store.
5. The data storage device of claim 4 , wherein the private key stored in the data store is identical for each authorized device of the multiple authorized devices.
6. The data storage device of claim 1 , wherein the authorization data for each authorized device of the multiple authorized devices indicates:
a transport public key for transporting data between the access controller and that authorized device; and
an unlocking public key for generating a challenge for that authorized device.
7. The data storage device of claim 1 , wherein:
the authorization data indicates a first public key and a second public key; and
the access controller is further configured to selectively update the authorization data based on the first public key being identical to the second public key.
8. The data storage device of claim 1 , wherein the multiple authorized devices comprise one or more of a user device with a user interface, a beacon without a user interface, and a key fob without a user interface.
9. The data storage device of claim 1 , wherein the public key is communicated from the device to be authorized to the manager device.
10. The data storage device of claim 9 , wherein communication of the public key from the device to be authorized to the manager device is over an insecure channel.
11. The data storage device of claim 1 , wherein:
the authorization data for each authorized device of the multiple authorized devices indicates the cryptographic key; and
the cryptographic key is identical for each authorized device of the multiple authorized devices.
12. The data storage device of claim 11 , wherein the cryptographic key is encrypted using an unlocking secret that is specific to each authorized device of the multiple authorized devices.
13. The data storage device of claim 12 , wherein the access controller is further configured to calculate the unlocking secret based on a response from the authorized device of the multiple authorized devices to a challenge generated based on the public key associated with the authorized device of the multiple authorized devices.
14. The data storage device of claim 1 , wherein the authorization data comprises authorized device metadata encrypted by a pre-authorized metadata wrapping key that is derivable from the public key.
15. The data storage device of claim 14 , wherein the pre-authorized metadata wrapping key is derivable from the public key via a key derivation function using a private key stored in the data store.
16. The data storage device of claim 1 , wherein the authorization data comprises a metadata wrapping key to encrypt authorized device metadata.
17. The data storage device of claim 16 , wherein the metadata wrapping key is a symmetric key.
18. A method for authorizing a user device with respect to a data storage device, the method comprising:
registering the data storage device with a host computer system as a block storage device;
receiving, in the data storage device and from a manager device, a public key, wherein the public key is associated with a private key stored on the user device to be authorized;
creating, in the data storage device, authorization data used by the data storage device to decrypt encrypted user content data stored in a non-volatile storage medium of the data storage device;
storing, in an entry in a data store integrated with the data storage device, authorization data associated with the user device to be authorized, wherein:
the authorization data in the entry includes the public key and registers the user device to be authorized as an authorized device of multiple authorized devices; and
the data store is configured to store multiple entries comprising authorization data associated with respective multiple authorized devices; and
transmitting, responsive to the authorized device, decrypted user content data to the host computer system, wherein:
the host computer system is a first device;
the manager device is a second device; and
the user device is a third device.
19. The method of claim 18 , further comprising:
receiving, by the data storage device, an indication of the public key from the authorized device of the multiple authorized devices;
generating, by the data storage device, a challenge based on the authorization data in the entry;
sending the challenge to the authorized device of the multiple authorized devices;
receiving a response to the challenge from the authorized device of the multiple authorized devices; and
upon validation of the response, updating the authorization data in the entry stored on the data store to allow the authorized device of the multiple authorized devices to authorize the data storage device to decrypt encrypted user content data stored on the data storage device for transmission to the host computer system.
20. A data storage device comprising:
means for receiving, from a manager device, a public key, wherein the public key is associated with a private key stored on a device to be authorized;
means for creating, in the data storage device, authorization data used by the data storage device to decrypt encrypted user content data stored in a non-volatile storage medium of the data storage device;
means for storing, in an entry in a data store integrated with the data storage device, authorization data associated with the device to be authorized, wherein:
the authorization data in the entry includes the public key and registers the device to be authorized as an authorized device of multiple authorized devices; and
the data store is configured to store multiple entries comprising authorization data associated with respective multiple authorized devices; and
means for transmitting, responsive to the authorized device, decrypted user content data to a host computer system, wherein:
the host computer system is a first device;
the manager device is a second device; and
the device to be authorized is a third device.