Multi-role unlocking of a data storage device
Disclosed herein is a data storage device comprising a data path, an access controller, and a data store. The data path comprises a data port configured to transmit data between a host computer system and the data storage device; a non-volatile storage medium configured to store encrypted user content data; and a cryptography engine connected between the data port and the storage medium and configured to use a cryptographic key to decrypt the encrypted user content data stored on the storage medium in response to a request from the host computer system. The access controller is configured to store on the data store multiple entries associated with multiple respective registered devices. The multiple entries comprise authorization data indicative of cryptographic keys that selectively provide user access or manager access for each of the multiple registered devices.
1. A method for providing access to a data storage device from a host computer system, the method comprising:
storing, on a data store in the data storage device, multiple authorization data entries,
wherein:
each authorization data entry of the multiple authorization data entries is associated with a registered device of multiple registered devices; and
the multiple authorization data entries comprise authorization data indicative of cryptographic keys that selectively provide user access or manager access for each registered device of the multiple registered devices;
communicating with a requesting registered device of the multiple registered devices;
selecting an authorization data entry that is associated with the requesting registered device;
determining, using the authorization data entry associated with the requesting registered device, a content data cryptographic key; and
selectively providing user access or manager access for the requesting registered device to unlock encrypted user content data from the data storage device for the host computer system.
2. A data storage device comprising:
a data path comprising:
a data port configured to transmit data between a host computer system and the data storage device;
a non-volatile storage medium configured to store encrypted user content data; and
a cryptography engine connected between the data port and the storage medium and configured to use a content data cryptographic key to decrypt the encrypted user content data stored on the storage medium in response to a request from the host computer system; and
an access controller configured to:
store, in a data store, multiple authorization data entries, wherein:
each authorization data entry of the multiple authorization data entries is associated with a registered device of multiple registered devices; and
the multiple authorization data entries comprise authorization data indicative of cryptographic keys that selectively provide user access or manager access for each registered device of the multiple registered devices;
communicate with a requesting registered device of the multiple registered devices;
select the authorization data entry that is associated with the requesting registered device;
determine, using the authorization data entry associated with the requesting registered device, the content data cryptographic key; and
selectively provide user access or manager access for the requesting registered device to unlock encrypted user content data for the host computer system.
3. The data storage device of claim 2 , wherein the user access:
enables decryption of the encrypted user content data; and
restricts reading of authorization data associated with other registered devices.
4. The data storage device of claim 2 , wherein the manager access:
enables decryption of the encrypted user content data; and
enables reading of authorization data associated with other registered devices.
5. The data storage device of claim 2 , wherein each authorization data entry comprises authorization data indicative of:
a user key to provide user access to the content data cryptographic key; or
a manager key to provide manager access to the multiple authorization data entries.
6. The data storage device of claim 5 , wherein each authorization data entry comprises a key field configured to store authorization data indicative of only one key of the user key and the manager key.
7. The data storage device of claim 5 , wherein the user key is derivable through a one-way function from the manager key.
8. The data storage device of claim 7 , wherein:
the manager key is configured to enable reading of authorization data associated with other registered devices; and
the user key, derivable from the manager key, is configured to enable decryption of the encrypted user content data.
9. The data storage device of claim 5 , wherein the user key is identical for multiple authorization data entries that provide user access.
10. The data storage device of claim 5 , wherein the manager key is identical for multiple authorization data entries that provide manager access.
11. The data storage device of claim 2 , wherein:
the authorization data of each authorization data entry of the multiple authorization data entries is encrypted based on a private key stored on an associated registered device of the multiple registered devices; and
the associated registered device is associated with that authorization data entry.
12. The data storage device of claim 11 , wherein the private key is different for each registered device of the multiple registered devices.
13. The data storage device of claim 12 , wherein:
each authorization data entry that provides user access comprises encrypted metadata that is encrypted by a metadata encryption key;
the metadata encryption key is based on the private key stored on each registered device of the multiple registered devices and is different for each authorization data entry; and
the metadata encryption key is stored in that authorization data entry encrypted based on a manager key to provide access to the encrypted metadata in response to obtaining the manager key.
14. The data storage device of claim 2 , wherein the access controller is further configured to:
generate a challenge for the requesting registered device of the multiple registered devices;
send the challenge to the requesting registered device of the multiple registered devices over a communication channel that is different from the data path;
receive a response to the challenge from the requesting registered device of the multiple registered devices over the communication channel; and
decrypt, based at least partly on the response, the authorization data to obtain an access key that is one of:
a manager key that provides manager access, and
a user key that provides user access.
15. The data storage device of claim 14 , wherein the challenge is based on the authorization data.
16. The data storage device of claim 14 , wherein the challenge is based on a public key of the requesting registered device of the multiple registered devices.
17. The data storage device of claim 2 , wherein the access controller is further configured to encrypt the cryptographic keys to generate the authorization data.
18. The data storage device of claim 17 , wherein the access controller is further configured to perform the following steps for each authorization data entry of the multiple authorization data entries:
generate an ephemeral private key and a corresponding ephemeral public key;
encrypt the content data cryptographic key based on the ephemeral private key and an unlocking public key corresponding to an unlocking private key stored on the respective registered device;
discard the ephemeral private key; and
store the ephemeral public key and the unlocking public key.
19. The data storage device of claim 2 , wherein the data storage device is configured to register with the host computer system as a block data storage device.
20. A data storage device comprising:
means for storing, on a data store in the data storage device, multiple authorization data entries, wherein:
each authorization data entry of the multiple authorization data entries is associated with a registered device of multiple registered devices; and
the multiple authorization data entries comprise authorization data indicative of cryptographic keys that selectively provide user access or manager access for each registered device of the multiple registered devices;
means for communicating with a requesting registered device of the multiple registered devices;
means for selecting an authorization data entry that is associated with the requesting registered device;
means for determining, using the authorization data entry associated with the requesting registered device, a content data cryptographic key; and
means for selectively providing user access or manager access for the requesting registered device to unlock encrypted user content data from the data storage device for a host computer system.