Method and device for secure data transfer and storage
A data storage device comprising a data port, configured to transceive data via a wired communication channel, a control port, configured to transceive data via a peer-to-peer wireless communication channel, a non-volatile storage medium, and a controller. In response to receiving, from a user device, via the control port, a command to enable control channel access, the controller performs an unlocking process, and, in response to completing the unlocking process, transitions from a locked state to a control channel access state. In response to being in the control channel access state, and in response to receiving, from the user device, via the control port, a write command, the controller stores write data in the storage medium, and, in response to receiving, from a host computer, via the data port, a command to access the storage medium, the controller transmits, to the host computer, a locked state indication.
1. A method for accessing data on a data storage device, the method performed by a controller of the data storage device, the method comprising:
in response to receiving, from a user device, via a control port, a command to enable control channel access, performing an unlocking process;
in response to completing the unlocking process, transition from a locked state to a control channel access state; and
in response to being in the control channel access state:
in response to receiving, from the user device, via the control port, a write command, the write command comprising write data, storing the write data in a non-volatile storage medium of the data storage device; and
in response to receiving, from a host computer, via a data port, a command to access the non-volatile storage medium, transmitting, to the host computer, via the data port, a locked state indication.
2. A data storage device comprising:
means for, in response to receiving, from a user device, via a control port, a command to enable control channel access, performing an unlocking process;
means for, in response to completing the unlocking process, transition from a locked state to a control channel access state; and
means for, in response to being in the control channel access state:
in response to receiving, from the user device, via the control port, a write command, the write command comprising write data, storing the write data in a non-volatile storage medium of the data storage device; and
in response to receiving, from a host computer, via a data port, a command to access the non-volatile storage medium, transmitting, to the host computer, via the data port, a locked state indication.
3. A data storage device comprising:
a data port, configured to transceive data via a wired communication channel, between a host computer system and the data storage device;
a control port, configured to transceive data via a peer-to-peer wireless communication channel, between a user device and the data storage device;
a non-volatile storage medium, configured to store user content data; and
a controller, configured to:
in response to receiving, from the user device, via the control port, a command to enable control channel access, perform an unlocking process;
in response to completing the unlocking process, transition from a locked state to a control channel access state; and
in response to being in the control channel access state:
in response to receiving, from the user device, via the control port, a write command, the write command comprising write data, store the write data in the non-volatile storage medium; and
in response to receiving, from the host computer system, via the data port, a command to access the non-volatile storage medium, transmit, to the host computer, via the data port, a locked state indication.
4. The data storage device of claim 3 , wherein the unlocking process comprises:
generating, by the controller, a challenge for the user device;
transmitting, to the user device, via the peer-to-peer wireless communication channel, the challenge; and
receiving, from the user device, via the peer-to-peer wireless communication channel, a response calculated by the user device based on the challenge.
5. The data storage device of claim 4 , wherein the challenge is based on elliptic curve cryptography.
6. The data storage device of claim 3 , wherein the locked state indication comprises an indication that there is no storage medium present in the data storage device.
7. The data storage device of claim 3 , wherein the command to access the non-volatile storage medium comprises one or more of: a read command; a write command; and a register command.
8. The data storage device of claim 3 , wherein, in response to being in the control channel access state, the controller is further configured to:
in response to receiving, from the user device, via the control port, a read command, the read command comprising an indication of a read data stored in the non-volatile storage medium, transmit the read data, via the control port, to the user device.
9. The data storage device of claim 3 , wherein the controller is further configured to, in response to receiving, from the user device, via the control port, a command to transition to an unlocked state:
perform an unlocking process; and
in response to completing the unlocking process, transition to the unlocked state.
10. The data storage device of claim 3 , in response to being in the control channel access state, the controller is further configured to:
in response to receiving, from the user device, an indication to cease control channel access, transition to an unlocked state.
11. The data storage device of claim 3 , wherein the data storage device is further configured to:
in response to being in a locked state, register with the host computer system as a mass data storage device without a storage medium present;
in response to being in the control channel access state, register with the host computer system as a mass data storage device without a storage medium present; and
in response to being in an unlocked state, register with the host computer system as a mass data storage device with a storage medium present.
12. The data storage device of claim 3 , wherein the data storage device is further configured to, in response to being in an unlocked state:
in response to receiving, from the host computer system, via the data port, a read command, the read command comprising an indication of read data stored in the non-valatile storage medium, transmit the read data, via the data port, to the host computer system; and
in response to receiving, from the host computer system, via the data port, a write command, the write command comprising write data, store the write data in the non-volatile storage medium.
13. The data storage device of claim 3 , wherein the data storage device is further configured to, responsive to being in the control channel access state, register with the user device as a mass data storage device with a storage medium present.
14. The data storage device of claim 3 , further comprising:
a cryptography engine, connected between the data port and the storage medium and configured to use a cryptographic key to decrypt encrypted user content data stored on the storage medium.
15. The data storage device of claim 14 , wherein the unlocking process further comprises:
calculating the cryptographic key based at least partly on a response from the user device; and
providing the cryptographic key to the cryptography engine to decrypt the user content data stored on the non-volatile storage medium of the data storage device.
16. The data storage device of claim 14 , wherein, in response to being in an unlocked state, the controller is configured to cause the cryptography engine to use the cryptographic key to decrypt the encrypted user content data stored on the non-volatile storage medium in response to a read command, receive via the data port, from the host computer system.
17. The data storage device of claim 14 , wherein, in response to being in a control channel access state, the controller is configured to cause the cryptography engine to use the cryptographic key to decrypt the encrypted user content data stored on the non-volatile storage medium in response to a read command, received via the control port, from the user device.
18. The data storage device of claim 3 , wherein the peer-to-peer wireless communication channel comprises a Bluetooth communication channel.
19. The data storage device of claim 3 , wherein the controller is further configured to establish the peer-to-peer wireless communication channel by performing a pairing process with the user device.
20. The data storage device of claim 3 , wherein the user device comprises an authorized user device.