Recovery key for unlocking a data storage device
Disclosed herein is a data storage device comprising a data path and an access controller. The access controller generates a recovery private key, generates encrypted authorization data based on the recovery private key, stores the encrypted authorization data, and sends the recovery private key to a manager device. When recovery is desired, access controller receives a recovery public key, calculated based on the recovery private key, from a recovery manager device, decrypts the encrypted authorization data based on the recovery public key, generates a challenge for the recovery manager device based on the decrypted authorization data, sends the challenge to the recovery manager device over the communication channel that is different from the data path, receives a response to the challenge from the recovery manager device over the communication channel, and based at least partly on the response, enables decryption of the encrypted user content data.
1. A data storage device comprising:
a data path comprising:
a data port configured to transmit data between a host computer system and the data storage device;
a non-volatile storage medium configured to store encrypted user content data; and
a cryptography engine connected between the data port and the non-volatile storage medium, wherein the cryptography engine is configured to use a cryptographic key to decrypt the encrypted user content data stored on the non-volatile storage medium in response to a request from the host computer system; and
an access controller configured to:
responsive to a registration process for a manager device:
generate a recovery private key;
generate encrypted authorization data based on the recovery private key, wherein the encrypted authorization data includes a recovery key record for unlocking a manager key;
store the encrypted authorization data in a data store configured for access by the access controller; and
send data indicative of the recovery private key to the manager device, wherein:
the manager device is configured to authorize at least one user device to unlock the data storage device to enable decryption of the encrypted user content data;
the data indicative of the recovery private key is configured for:
transfer to a recovery manager device; and
derivation of the recovery private key by the recovery manager device; and
the recovery manager device is a different device than the manager device; and
during a recovery process:
receive a recovery public key from the recovery manager device over a communication channel that is different from the data path, wherein the recovery manager device is configured to calculate the recovery public key from the recovery private key;
decrypt the encrypted authorization data based on the recovery public key;
generate a challenge for the recovery manager device based on the decrypted authorization data;
send the challenge to the recovery manager device over the communication channel that is different from the data path;
receive a response to the challenge from the recovery manager device over the communication channel; and
based at least partly on the response and the recovery key record, enable the recovery manager device to authorize at least one user device to unlock the data storage device to enable decryption of the encrypted user content data.
2. The data storage device of claim 1 , wherein the recovery private key is stored on the recovery manager device and the response is based on the recovery private key stored on the recovery manager device.
3. The data storage device of claim 2 , wherein the manager key is configured to enable configuration of the access controller to enable decryption of the encrypted user content data.
4. The data storage device of claim 3 , wherein the manager key is configured to enable registration of an authorized device with the access controller to enable decryption of the encrypted user content data in response to the authorized device being connected to the data storage device.
5. The data storage device of claim 4 , wherein:
registration of the authorized device comprises creation of an authorized device record entry as further encrypted authorization data in the data store based on a public key associated with the authorized device;
the authorized device record entry comprises an encrypted user key calculated based on the manager key; and
the access controller is further configured to determine the cryptographic key based on the user key.
6. The data storage device of claim 5 , wherein:
the recovery key record has a first structure that is identical to a second structure of encrypted authorization data; and
the second structure of encrypted authorization data includes the authorized device record entry based on the public key associated with the authorized device that is authorized to unlock the data storage device by responding to a challenge generated by the access controller.
7. The data storage device of claim 6 , wherein:
the first structure and the second structure comprise a respective public key field; and
the access controller is further configured to store the recovery public key in the public key field of the first structure and to store the public key associated with the authorized device in the public key field of the second structure.
8. The data storage device of claim 5 , wherein the user key is directly derivable from the manager key.
9. The data storage device of claim 1 , wherein the access controller is further configured to determine, based at least partly on the response, the manager key to enable decryption of the encrypted user content data.
10. The data storage device of claim 1 , wherein the access controller is further configured to determine the cryptographic key based on the manager key.
11. The data storage device of claim 1 , wherein the encrypted authorization data comprises metadata encrypted by a pre-authorization metadata wrapping key that is derivable from the recovery public key.
12. The data storage device of claim 11 , wherein the access controller is further configured to derive the pre-authorization metadata wrapping key by performing a key derivation function using the recovery public key as an input.
13. The data storage device of claim 12 , wherein the access controller is further configured to perform the key derivation function using an authorized device slot key as a further input.
14. The data storage device of claim 13 , wherein the authorized device slot key is stored on the data store in plain text.
15. The data storage device of claim 11 , wherein:
the access controller is further configured to generate the challenge for the recovery manager device based on the metadata encrypted by the pre-authorization metadata wrapping key; and
the manager key is encrypted by an unlock secret that is derivable from the response to enable decryption of the encrypted user content data.
16. The data storage device of claim 15 , wherein:
the metadata encrypted by the pre-authorization metadata wrapping key comprises an elliptic curve public key corresponding to an ephemeral unlock key; and
the unlock secret is based on the ephemeral unlock key.
17. The data storage device of claim 1 , wherein the access controller is further configured to delete authorization data other than the generated encrypted authorization data based on the recovery private key in response to enabling decryption.
18. The data storage device of claim 1 , wherein:
the recovery public key is calculated by the access controller and the recovery manager device; and
the recovery private key is not stored in non-volatile memory by the access controller.
19. A method for unlocking a data storage device that stores encrypted user content data, the method comprising:
responsive to a registration process for a manager device:
generating, by the data storage device, a recovery private key;
generating, by the data storage device, encrypted authorization data based on the recovery private key, wherein the encrypted authorization data includes a recovery key record for unlocking a manager key;
storing, by the data storage device, the encrypted authorization data in a data store of the data storage device; and
sending, by the data storage device, data indicative of the recovery private key to the manager device, wherein:
the manager device is configured to authorize at least one user device to unlock the data storage device to enable decryption of the encrypted user content data;
the data indicative of the recovery private key is configured for:
transfer to a recovery manager device; and
derivation of the recovery private key by the recovery manager device; and
the recovery manager device is a different device than the manager device; and
during a recovery process:
receiving, by the data storage device, a recovery public key from the recovery manager device over a communication channel, wherein the recovery manager device is configured to calculate the recovery public key from the recovery private key;
decrypting, by the data storage device, the encrypted authorization data based on the recovery public key;
generating, by the data storage device, a challenge for the recovery manager device based on the decrypted authorization data;
sending, by the data storage device, the challenge to the recovery manager device over the communication channel;
receiving, by the data storage device, a response to the challenge from the recovery manager device over the communication channel; and
enabling, based at least partly on the response and the recovery key record, decryption of the encrypted user content data by enabling the recovery manager device to authorize at least one user device to unlock the data storage device.
20. A data storage device comprising:
a data path comprising:
a data port configured to transmit data between a host computer system and the data storage device;
a non-volatile storage medium configured to store encrypted user content data; and
a cryptography engine connected between the data port and the non-volatile storage medium, wherein the cryptography engine is configured to use a cryptographic key to decrypt the encrypted user content data stored on the non-volatile storage medium in response to a request from the host computer system;
means for generating, responsive to a registration process for a manager device, a recovery private key;
means for generating, responsive generating the recovery private key, encrypted authorization data based on the recovery private key, wherein the encrypted authorization data includes a recovery key record for unlocking a manager key;
means for storing, responsive to generating the encrypted authorization data, the encrypted authorization data in a data store of the data storage device;
means for sending, responsive to a generating the recovery private key, data indicative of the recovery private key to a manager device, wherein:
the manager device is configured to authorize at least one user device to unlock the data storage device to enable decryption of the encrypted user content data;
the data indicative of the recovery private key is configured for:
transfer to a recovery manager device; and
derivation of the recovery private key by the recovery manager device; and
the recovery manager device is a different device than the manager device;
means for receiving, during a recovery process, a recovery public key from the recovery manager device over a communication channel, wherein the recovery manager device is configured to calculate the recovery public key from the recovery private key;
means for decrypting, responsive to receiving the recovery public key, the encrypted authorization data based on the recovery public key;
means for generating a challenge for the recovery manager device based on the decrypted authorization data;
means for sending the challenge to the recovery manager device over the communication channel;
means for receiving a response to the challenge from the recovery manager device over the communication channel; and
means for enabling, based at least partly on the response and the recovery key record, decryption of the encrypted user content data by enabling the recovery manager device to authorize at least one user device to unlock the data storage device.