Self-encrypting module with embedded wireless user authentication
Methods, systems, and computer programs are presented for a self-encrypting device (SED) incorporated into a host system. In one example, the host system includes a memory, a processor, a data channel in communication with the memory and the processor, and the SED. The SED comprises an authentication subsystem, a storage subsystem that stores encrypted data that is encrypted with an encryption key provided by the authentication subsystem, a radio frequency (RF) transceiver, and a data interface in electrical contact with the data channel. The data interface is locked from sending and receiving data until the SED is unlocked by the authentication subsystem with user-authentication information received via the RF transceiver.
1. A system comprising:
one or more computer processors;
a data channel connected to the one or more computer processors; and
a self-encrypting device connected to the data channel, the self-encrypting device comprising:
an authentication subsystem comprising an authentication controller;
an encryption engine;
a storage media that stores encrypted data that is encrypted with an encryption key provided by the authentication subsystem;
a radio frequency (RF) transceiver for communications outside the data channel; and
a data interface of an interface controller coupled with the data channel, the data interface being locked from sending and receiving data until the self-encrypting device is unlocked by the authentication subsystem with user-authentication information received via the RF transceiver.
2. The system as recited in claim 1 , wherein the self-encrypting device authenticates a user without use of the one or more computer processors of the system.
3. The system as recited in claim 1 , wherein the RF transceiver is configured for receiving, from a mobile device, the user-authentication information, the mobile device being separate from the one or more computer processors, wherein the self-encrypting device is configured for unlocking the data interface in response to receiving the user-authentication information from the mobile device.
4. The system as recited in claim 3 , wherein the RF transceiver is configured for using independent encryption in RF communications with the mobile device, the independent encryption being separate from encryption provided by a communication protocol for the RF communications.
5. The system as recited in claim 3 , wherein an application in the mobile device provides a user interface for obtaining the user-authentication information from a user.
6. The system as recited in claim 3 , wherein an application in the mobile device authenticates a user by validating the user with a management server, wherein the mobile device sends to the self-encrypting device an unlock command in response to the management server validating the user.
7. The system as recited in claim 1 , further comprising:
an encryption engine, wherein the authentication subsystem stores an encryption key and the authentication subsystem transmits the encryption key to the encryption engine when a user is successfully authenticated.
8. The system as recited in claim 1 , wherein the self-encrypting device initializes a timer when a shutdown of the system is detected, wherein the self-encrypting device initializes in an unlocked state if the system is restarted before an expiration of the timer, wherein the self-encrypting device initializes in a locked state if the system is restarted after the expiration of the timer.
9. The system as recited in claim 1 , wherein data is transmitted in clear form between the data interface and the data channel.
10. The system as recited in claim 1 , wherein the system is one of a laptop, a personal computer, a kitchen appliance, a printer, a scanner, a server, a tablet device, a medical device, a door-unlocking system, a secure access system, an access control device, a home-automation device, a home appliance, a mobile phone, a vehicle, or a smart television set.
11. The system as recited in claim 1 , wherein the self-encrypting device further includes a power source for supplying power to the authentication subsystem while self-encrypting device is locked.
12. A method comprising:
providing a self-encrypting device in a host computer system, the host computer system further having one or more processors and a data channel connected to the one or more processors and connected to the self-encrypting device;
establishing a communication channel between a data interface of the self-encrypting device and the data channel, the communication channel being locked until the self-encrypting device is authenticated;
receiving, via a radio frequency (RF) transceiver of the self-encrypting device for communications outside the data channel, user-authentication information;
unlocking, by an authentication subsystem of the self-encrypting device, the communication channel based on the user-authentication information;
encrypting data, received by the self-encrypting device through the data interface, with an encryption key provided by the authentication subsystem of the self-encrypting device; and
storing the encrypted data in a storage subsystem of the self-encrypting device.
13. The method as recited in claim 12 , wherein the self-encrypting device authenticates a user without use of the one or more processors of the host computer system.
14. The method as recited in claim 12 , further comprising:
receiving, via the RF transceiver and from a mobile device, the user-authentication information; and
unlocking the self-encrypting device in response to receiving the user-authentication information via the RF transceiver.
15. The method as recited in claim 14 , wherein an application in the mobile device authenticates a user by validating the user with a management server, the method further comprising:
receiving an unlock command from the mobile device in response to the management server validating the user.
16. The method as recited in claim 12 , wherein the self-encrypting device initializes a timer when a shutdown of the host computer system is detected, wherein the self-encrypting device initializes in an unlocked state if the host computer system is restarted before an expiration of the timer, wherein the self-encrypting device initializes in a locked state if the host computer system is restarted after the expiration of the timer.
17. A non-transitory machine-readable storage medium including instructions that, when executed by a machine, cause the machine to perform operations comprising:
providing a self-encrypting device in a host computer system, the host computer system further having one or more processors and a data channel connected to the one or more processors and connected to the self-encrypting device;
establishing a communication channel between a data interface of the self-encrypting device and the data channel, the communication channel being locked until the self-encrypting device is authenticated;
receiving, via a radio frequency (RF) transceiver of the self-encrypting device for communications outside the data channel, user-authentication information;
unlocking, by an authentication subsystem of the self-encrypting device, the communication channel based on the user-authentication information;
encrypting data, received by the self-encrypting device through the data interface, with an encryption key provided by the authentication subsystem of the self-encrypting device; and
storing the encrypted data in a storage subsystem of the self-encrypting device.
18. The non-transitory machine-readable storage medium as recited in claim 17 , wherein the self-encrypting device authenticates a user without use of the one or more processors of the host computer system.
19. The non-transitory machine-readable storage medium as recited in claim 17 , wherein the machine further performs operations comprising:
receiving, via the RF transceiver and from a mobile device, the user-authentication information; and
unlocking the self-encrypting device in response to receiving the user-authentication information via the RF transceiver.
20. The non-transitory machine-readable storage medium as recited in claim 19 , wherein an application in the mobile device authenticates a user by validating the user with a management server, wherein the machine further performs operations comprising:
receiving an unlock command from the mobile device in response to the management server validating the user.