Multiple authorization requests from a data storage device
Disclosed herein is a data storage device. A data port transmits data between a host computer system and the data storage device. A non-volatile storage medium stores encrypted user content data and a cryptography engine connected between the data port and the storage medium uses a cryptographic key to decrypt the encrypted user content data. The access controller generates authorization request data indicative of multiple devices to be authorized, and stores the authorization request data on non-volatile configuration memory of the data storage device. Upon approval of the authorization request data by a manager device that is registered with the access controller as a manager device, the access controller locates the authorization request data of one of the multiple devices to be authorized and registers the one of the multiple devices to be authorized as an authorized device.
1. A data storage device comprising:
a data path comprising:
a data port configured to transmit data between a host computer system and the data storage device;
a non-volatile storage medium configured to store encrypted user content data; and
a cryptography engine connected between the data port and the storage medium, wherein the cryptography engine is configured to use a cryptographic key to decrypt the encrypted user content data stored on the storage medium in response to a request from the host computer system; and
an access controller configured to:
generate authorization request data, comprising multiple records indicative of respective multiple devices to be authorized;
encrypt, using a decrypted manager key, the authorization request data, wherein the access controller discards the decrypted manager key following encryption of the authorization request data;
store the encrypted authorization request data on non-volatile configuration memory of the data storage device;
receive, from a manager device that is registered with the access controller as a manager device, an authorization response for approval of one device to be authorized from the multiple devices to be authorized;
determine, based on the authorization response, the decrypted manager key;
locate the encrypted authorization request data of the one device to be authorized in the non-volatile configuration memory;
decrypt, using the decrypted manager key, the authorization request data of the one device to be authorized; and
register, using the authorization request data, the one device to be authorized as an authorized device to control access to the encrypted user content data, wherein:
the host computer system is a first device;
the manager device is a second device; and
the multiple devices to be authorized are multiple third devices.
2. The data storage device of claim 1 , wherein the manager device is remote from the data storage device and the access controller is further configured to:
generate an authorization request based on the stored authorization request data;
send the authorization request to the one device of the multiple devices to be authorized;
receive, from the one device to be authorized, the authorization response generated by the manager device; and
determine whether approval is provided in the authorization response.
3. The data storage device of claim 1 , wherein the access controller is further configured to store the encrypted authorization request data on a list of authorization requests, the list of authorization requests comprising one list item for each device of the multiple devices to be authorized.
4. The data storage device of claim 3 , wherein
the list of authorization requests has a fixed size in a number of items, and
the access controller is further configured to, upon the number of items exceeding the fixed size, overwrite previously stored list items in the list of authorization requests.
5. The data storage device of claim 3 , wherein the access controller is further configured to:
write an initial list item at a random position in the list of authorization requests; and
write a successive list item immediately adjacent to the initial list item.
6. The data storage device of claim 3 , wherein the access controller is further configured to:
upon approval of the authorization request, create a new entry in a list of authorized devices to register the one device to be authorized as the authorized device, and
delete the list item from the list of authorization requests corresponding to the one device of the multiple devices to be authorized.
7. The data storage device of claim 1 , wherein
the authorization response comprises identifying information identifying the one device of the multiple devices to be authorized;
the access controller is further configured to calculate a list index corresponding to the one device of the multiple devices to be authorized based on the identifying information; and
locating the encrypted authorization request data comprises searching the stored encrypted authorization request data for the list index.
8. The data storage device of claim 7 , wherein the identifying information is a public key corresponding to a private key stored on the one device of the multiple devices to be authorized.
9. The data storage device of claim 8 , wherein calculating the list index comprises multiplying the public key corresponding to a private key stored on the one of the multiple devices to be authorized, with a private key stored on the data storage device.
10. The data storage device of claim 1 , wherein the access controller is further configured to:
derive a device-specific ephemeral unlock secret to encrypt the manager key from a public key of an ephemeral unlock key pair and a private key stored in the manager device;
store the encrypted manager key in the non-volatile configuration memory;
derive a list entry key from the decrypted manager key to encrypt the authorization request data;
re-generate, responsive to the authorization response, the device-specific ephemeral unlock secret using the public key of the ephemeral unlock key pair multiplied by the private key stored on the manager device, wherein the authorization response comprises the public key of the ephemeral unlock key pair multiplied by the private key stored on the manager device; and
decrypt the manager key to decrypt the authorization request data.
11. The data storage device of claim 10 , wherein the access controller is further configured to:
register multiple manager devices as manager devices with the data storage device; and
use the public key of the ephemeral unlock key pair that is identical for the multiple manager devices such that a request sent to one of the multiple manager devices is unspecific for that manager device and an approval from any of the multiple manager devices provides sufficient information to decrypt the manager key.
12. The data storage device of claim 1 , wherein the access controller is further configured to:
encrypt the stored authorization request data corresponding to the one device of the multiple devices to be authorized using a list entry key;
store the list entry key encrypted in a header of the encrypted authorization request data; and
decrypt the list entry key using a public key corresponding to a private key stored on one of the multiple devices to be authorized and a private key stored in the non-volatile configuration memory of the data storage device.
13. The data storage device of claim 1 , wherein the access controller is further configured to:
generate an authorization request; and
send the authorization request to the one device of the multiple devices to be authorized for approval by the manager device.
14. The data storage device of claim 13 , wherein the access controller is further configured to maintain the authorization request data unchanged in response to generating a second authorization request.
15. The data storage device of claim 13 , wherein the authorization request comprises a file that is attachable to a digital message to the manager device.
16. The data storage device of claim 1 , wherein the access controller is further configured to:
communicate the authorization request data to the manager device that is within communication range; and
receive the authorization response from the manager device connected with the access controller.
17. The data storage device of claim 16 , wherein:
the decrypted manager key is available to the access controller from the manager device; and
the access controller is further configured to use the decrypted manager key to decrypt a portion of the authorization data comprising records for review and approval through the manager device.
18. The data storage device of claim 1 , wherein:
the access controller is further configured to:
determine a command from the authorization response generated by the manager device; and
execute the command; and
the command is selected from: approval, rejection, and reset of the data storage device.
19. A method performed by an access controller of a data storage device, the method comprising:
generating authorization request data comprising multiple records indicative of respective multiple devices to be authorized to control access by a host computer system to encrypted user content data in a non-volatile storage medium of the data storage device;
encrypting the authorization request data corresponding to each device of the multiple devices to be authorized using a list entry key corresponding to that device;
storing the encrypted authorization request data on non-volatile configuration memory of the data storage device;
storing the list entry key encrypted in a header of the encrypted authorization request data corresponding to that device; and
responsive to an authorization response for approval of the authorization request data by a manager device that is registered with the access controller as a manager device:
locating the authorization request data of one device of the multiple devices to be authorized;
decrypting the list entry key for the one device using a public key corresponding to a private key stored on the one device and a private key stored in the non-volatile configuration memory of the data storage device; and
registering the one device of the multiple devices to be authorized as an authorized device to control access to the encrypted user content data, wherein
the host computer system is a first device;
the manager device is a second device; and
the multiple devices to be authorized are multiple third devices.
20. A data storage device comprising:
a data path comprising:
a data port configured to transmit data between a host computer system and the data storage device;
a non-volatile storage medium configured to store encrypted user content data; and
a cryptography engine connected between the data port and the storage medium, wherein the cryptography engine is configured to use a cryptographic key to decrypt the encrypted user content data stored on the storage medium in response to a request from the host computer system;
means for generating authorization request data, comprising multiple records indicative of respective multiple devices to be authorized;
means for deriving a device-specific ephemeral unlock secret to encrypt a manager key from a public key of an ephemeral unlock key pair and a private key stored in a manager device, wherein the manager device is registered with the data storage device as a manager device;
means for storing the encrypted manager key in a non-volatile configuration memory of the data storage device;
means for deriving a list entry key from the manager key to encrypt the authorization request data;
means for storing the encrypted authorization request data in the non-volatile configuration memory of the data storage device;
means for re-generating, responsive to receiving an authorization response for approval of the authorization request data by the manager device, the device-specific ephemeral unlock secret using the public key of the ephemeral unlock key pair multiplied by the private key stored on the manager device, wherein the authorization response comprises the public key of the ephemeral unlock key pair multiplied by the private key stored on the manager device
means for locating the authorization request data of one device of the multiple devices to be authorized;
means for decrypting the manager key to decrypt the authorization request data; and
means for registering the one device of the multiple devices to be authorized as an authorized device to control access to the encrypted user content data, wherein
the host computer system is a first device;
the manager device is a second device; and
the multiple devices to be authorized are multiple third devices.