Verifying the authenticity of storage devices
Techniques for a host system or a user to verify the authenticity of a storage device or a logical sub-unit (e.g., a partition) of the storage device are disclosed. A storage device stores one or more first secret keys and a host device stores one or more second keys. A respective first secret key and a respective second key are used in a verification process that verifies the authenticity of the storage device prior to accessing the storage device.
1 . A storage device, comprising:
a storage medium operable to store data therein;
a secure storage medium operable to store a shared secret; and
a processing device operably connected to the storage medium and the secure storage medium, the processing device operable to:
receive a plurality of shared secrets;
store the shared secrets in partitions in the secure storage medium, wherein respective shared secrets are associated with one or more subsets of the partitions of the secure storage medium, wherein a subset of the partitions of the secure storage medium is lower in number of partitions than all of the partitions of the secure storage medium;
receive a verification message comprising a single-use key;
access the shared secrets;
process the single-use key and the shared secrets to produce verification keys corresponding to each of the respective shared secrets for verifying the authenticity of the partitions of the storage device; and
transmit, to a host device, the verification keys to facilitate authentication of the storage device.
2 . The storage device of claim 1 , wherein the secure storage medium is located in the processing device.
3 . The storage device of claim 2 , wherein the secure storage medium is a one-time-programmable memory.
4 . The storage device of claim 1 , wherein:
the processing of the single-use key and the shared secrets to produce the verification keys comprises concatenating the single-use key and the shared secrets.
5 . The storage device of claim 4 , wherein the processing of the single-use key and the shared secrets to produce the verification keys further comprises generating proxies of the concatenated single-use key and the shared secrets.
6 . The storage device of claim 5 , wherein the proxies are hash values.
7 . The storage device of claim 4 , wherein the single-use key is a random number.
8 . The storage device of claim 1 , wherein the shared secrets comprise one or more of:
a password;
biometric data; or
a string of characters.
9 . A method of operating a storage device, the method comprising:
receiving a plurality of shared secrets;
storing the shared secrets in partitions in a secure storage medium, wherein respective shared secrets are associated with one or more of the partitions of the secure storage medium, wherein a subset of the partitions of the secure storage medium is lower in number of partitions than all of the partitions of the secure storage medium;
receiving a verification message, the verification message comprising a single-use key;
processing the single-use key and the shared secrets stored in the storage device to produce verification keys corresponding to each of the respective shared secrets; and
transmitting the verification keys to a host device to enable the host device to verify the authenticity of the one or more partitions of the storage device.
10 . The method of claim 9 , further comprising:
after verification of the authenticity of the one or more partitions of the storage device, receiving a read request; and
retrieving data associated with the read request.
11 . The method of claim 9 , further comprising:
after verification of the authenticity of the one or more partitions of the storage device, receiving a write request; and
storing data associated with the write request.
12 . The method of claim 9 , wherein processing the single-use key and the shared secrets comprises concatenating the single-use key and the shared secrets to produce string concatenations that are used as the verification keys.
13 . The method of claim 12 , wherein processing the single-use key and the shared secrets further comprises generating hash values based on the string concatenations.
14 . The method of claim 9 , further comprising retrieving, by the storage device, the shared secrets from a secure storage medium within the storage device.
15 . A system, comprising:
a storage device, comprising:
a storage medium operable to store data therein;
a secure storage medium operable to store a shared secret; and
a processing device operably connected to the storage medium and the secure storage medium, the processing device operable to:
receive a plurality of shared secrets;
store the shared secrets in partitions in the secure storage medium, wherein respective shared secrets are associated with one or more of the partitions of the secure storage medium, wherein a subset of the partitions of the secure storage medium is lower in number of partitions than all of the partitions of the secure storage medium;
receive a single-use key from a host device;
access the shared secrets;
process the single-use key and the shared secrets to produce verification keys corresponding to each of the respective shared secrets operable to verify the authenticity of the one or more partitions of the storage device; and
transmit, to the host device, the verification keys to facilitate authentication of the storage device.
16 . The system of claim 15 , wherein:
the processing device is a first processing device;
the secure storage medium is a first storage device;
the verification keys are first verification keys; and
the host device comprises:
a second secure storage medium operable to store the shared secrets; and
a second processing device operably connected to the second secure storage medium, the second processing device operable to:
transmit the single-use key to the storage device;
receive a first verification message;
process the single-use key and the shared secrets to produce second verification keys;
determine whether the first verification keys correspond to the second verification keys to verify the authenticity of the one or more partitions of the storage device; and
based on a successful verification of the authenticity of the one or more partitions of the storage device, enable access to at least a portion of the data stored in the storage medium in the one or more partitions of the storage device.
17 . The system of claim 15 , wherein the storage medium is a non-partitioned storage medium and the shared secrets are associated with and enables access to all of the data stored in the one or more partitions of the secure storage medium.