Passcode authentication based data storage device
Data storage devices, methods, and systems for passcode authentication based on automatically generated and dynamically changing unlock passcodes are described. An access controller of a data storage device is configured to receive a first passcode based on an externally generated input passcode that is synchronized with internal generation of an unlock passcode by the access controller. The access controller generates a second passcode based on the internally generated unlock passcode, and unlocking the data storage device is responsive to the first passcode matching the second passcode.
1. A data storage device comprising:
a data path comprising:
a data port configured to transmit data between a host computer system and the data storage device, wherein the data storage device is configured to register with the host computer system as a block data storage device; and
a non-volatile storage medium configured to store user content data; and
an access controller configured to:
repeatedly and automatically generate a dynamically changing unlock passcode for unlocking the data storage device;
set a reference time value of the access controller to a real-time dynamically determined time value;
generate a time indication signal that automatically causes a user device external to the data storage device to set a corresponding reference time value of the user device to the same dynamically determined time value;
receive a first passcode including at least, an input passcode provided by the user device, wherein the user device is configured to generate the input passcode:
externally to the data storage device; and
synchronously with the generation of the unlock passcode by the access controller using the corresponding time reference value; and
provide access to the user content data via the data port in response to the first passcode matching with a second passcode generated by the access controller, wherein the second passcode includes at least the unlock passcode.
2. The data storage device of claim 1 , wherein the second passcode further includes a predetermined passcode of the data storage device.
3. The data storage device of claim 2 , wherein the predetermined passcode of the data storage device is selectively set by a user of the user device.
4. The data storage device of claim 1 , wherein the input passcode is generated by the user device.
5. The data storage device of claim 4 , wherein the access controller is further configured to generate the unlock passcode as a time-based one-time passcode based on a passcode generation key and the reference time value.
6. The data storage device of claim 5 , wherein the access controller is further configured to share the passcode generation key by sending the passcode generation key over a wireless communication channel via a protocol such as near field communication (NFC) or Bluetooth.
7. The data storage device of claim 5 , wherein the access controller is further configured to share the passcode generation key by displaying a quick response (QR) code encoding the passcode generation key on a display of the data storage device.
8. The data storage device of claim 1 , wherein the access controller is further configured to perform, responsive to a predefined time period value having expired, a time synchronization operation to align the time reference value of the access controller with the corresponding time reference value of the user device associated with the data storage device.
9. The data storage device of claim 1 , wherein:
setting the time reference value of the access controller involves setting the reference time value of the access controller to a current time value of the user device; and
the access controller is further configured to receive the current time value within a synchronization message transmitted to the data storage device.
10. The data storage device of claim 1 , wherein setting the reference time value of the access controller to the real-time dynamically determined time value is based on a clocking signal from a clock of the access controller.
11. The data storage device of claim 1 , wherein generating the time indication signal comprises changing an on/off status of an optical or acoustic emitter.
12. The data storage device of claim 8 , wherein performing the time synchronization operation comprises a unidirectional data transfer from the data storage device to the user device.
13. The data storage device of claim 1 , wherein the access controller is further configured to receive the input passcode from the user device or the host computer system.
14. The data storage device of claim 1 , wherein:
the access controller is further configured to selectively set a data access state of the data storage device to either:
an unlocked state to enable transmission of the user content data between the host computer system and the non-volatile storage medium; or
a locked state to disable transmission of the user content data between the host computer system and the non-volatile storage medium, and
providing access to the user content data via the data port involves setting the data access state of the data storage device to the unlocked state.
15. The data storage device of claim 1 , wherein:
the data path further comprises a cryptography engine connected between the data port and the non-volatile storage medium and configured to use a decryption key to selectively decrypt encrypted user content data stored on the non-volatile storage medium; and
the access controller is further configured to provide the decryption key to the cryptography engine.
16. The data storage device of claim 15 , wherein:
the cryptography engine is further configured to use an encryption key to selectively encrypt one or more of:
the user content data stored on the non-volatile storage medium; and
data received from the data port to be stored as user content data on the non-volatile storage medium; and
the access controller is further configured to provide the encryption key to the cryptography engine.
17. The data storage device of claim 16 , wherein the encryption key and the decryption key are the same key.
18. The data storage device of claim 16 , wherein:
the access controller is further configured to:
repeatedly and automatically generate an unlock key by encrypting the encryption key using a currently generated unlock passcode of the data storage device;
generate the decryption key by decrypting an unlock key of the data storage device using the received input passcode;
cause the decryption key to be used in a decryption function of the data storage device to apply the decryption function to, at least, a portion of the encrypted user content data; and
return a result of the decryption function to the host computer system via the data port; and
the encrypted user content data is encrypted by using the encryption key in a corresponding encryption function of the data storage device.
19. A method for accessing data on a data storage device, the method comprising:
repeatedly and automatically generating a dynamically changing unlock passcode for unlocking the data storage device;
receiving, in a synchronization message transmitted from a user device external to the data storage device, a current time value of the user device;
performing, based on the current time value, a time synchronization operation to align a time reference value of the data storage device with a corresponding time reference value of the user device;
receiving a first passcode including an input passcode provided by the user device, wherein the input passcode is generated externally to the data storage device and synchronously with the generation of the unlock passcode by the data storage device using the time reference value; and
providing access to user content data via a data port of the data storage device in response to the first passcode matching with a second passcode generated by the data storage device, wherein the second passcode includes at least the unlock passcode.
20. A data storage device, comprising:
a processor;
a memory;
a non-volatile storage medium configured to store user content data;
means, stored in the memory for execution by the processor, for repeatedly and automatically generating a dynamically changing unlock passcode for unlocking the data storage device;
means, stored in the memory for execution by the processor, for receiving, in a synchronization message transmitted from a user device external to the data storage device, a current time value of the user device;
means, stored in the memory for execution by the processor, for performing, based on the current time value, a time synchronization operation to align a time reference value of the data storage device with a corresponding time reference value of the user device;
means, stored in the memory for execution by the processor, for receiving a first passcode including an input passcode provided by the user device, wherein the input passcode is generated externally to the data storage device and synchronously with the generation of the unlock passcode by the data storage device using the time reference value; and
means, stored in the memory for execution by the processor, for providing access to the user content data via a data port of the data storage device, the access being provided in response to the first passcode matching with a second passcode generated by the data storage device, wherein the second passcode includes at least the unlock passcode.
21. A data storage device, comprising:
a data path comprising:
a data port configured to transmit data between a host computer system and the data storage device, wherein the data storage device is configured to register with the host computer system as a block data storage device;
a non-volatile storage medium configured to store user content data; and
a cryptography engine connected between the data port and the non-volatile storage medium and configured to:
use an encryption key to selectively encrypt one or more of:
the user content data stored on the non-volatile storage medium; and
data received from the data port to be stored as user content data on the non-volatile storage medium; and
use a decryption key to selectively decrypt encrypted user content data stored on the non-volatile storage medium; and
an access controller configured to:
provide the encryption key and the decryption key to the cryptography engine;
repeatedly and automatically generate a dynamically changing unlock passcode for unlocking the data storage device;
repeatedly and automatically generate an unlock key by encrypting the encryption key using a currently generated unlock passcode of the data storage device;
receive a first passcode including an input passcode provided by a user device, wherein the user device is configured to generate the input passcode:
externally to the data storage device; and
synchronously with the generation of the unlock passcode by the access controller;
generate, responsive to the first passcode matching with a second passcode generated by the access controller, the decryption key by decrypting an unlock key of the data storage device using the received input passcode;
cause the decryption key to be used in a decryption function of the data storage device to apply the decryption function to a portion of the encrypted user content data; and
return a result of the decryption function to the host computer system via the data port to provide access to the user content data, wherein the encrypted user content data is encrypted by using the encryption key in a corresponding encryption function of the data storage device.