Initializing a data storage device with a manager device
Disclosed herein is a data storage device. A data port transmits data between a host computer system and the data storage device. A non-volatile storage medium stores encrypted user content data and a cryptography engine uses a cryptographic key to decrypt the encrypted user content data stored on the storage medium in response to a request from the host computer system. An access controller receives a request from a manager device to initialize the data storage device. The controller generates the cryptographic key, generates a manager key configured to provide manager access for the manager device and provide access to the cryptographic key, and stores, on a data store, authorization data indicative of the manager key and accessible based on a private key stored on the manager device.
1. A data storage device comprising:
a data path comprising:
a data port configured to transmit data between a host computer system and the data storage device;
a non-volatile storage medium configured to store encrypted user content data; and
a cryptography engine connected between the data port and the non-volatile storage medium, wherein the cryptography engine is configured to use a cryptographic key to decrypt the encrypted user content data stored on the non-volatile storage medium in response to a request from the host computer system; and
an access controller configured to:
during an initialization process for the data storage device:
receive a request from a manager device to initialize the data storage device;
generate, responsive to the request from the manager device, the cryptographic key;
generate, responsive to the request from the manager device, a manager key configured to provide manager access to authorization data for registered devices; and
store, in a non-volatile data store, the authorization data, wherein:
the authorization data comprises an authorized device record for the manager device;
the authorized device record for the manager device is indicative of the manager key; and
the authorization data is accessible based on a private key stored on the manager device;
during a registration process for a user device:
approve, by the manager device, the user device to become a registered user device;
store, in the authorization data, an authorized device record for the registered user device, wherein:
the authorized device record comprises:
an encrypted user key configured to unlock, responsive to an unlock request from the registered user device, the cryptographic key; and
encrypted authorized device metadata configured to identify the registered user device; and
the manager device is configured to access the encrypted authorized device metadata responsive to the manager key; and
during an unlock process for the registered user device:
receive, from the registered user device, the unlock request;
validate, using the authorized device record for the registered user device, the registered user device;
determine, responsive to the unlock request and based on the authorized device record for the registered user device, the cryptographic key; and
provide, responsive to the unlock request, the cryptographic key to the cryptography engine to decrypt the encrypted user content data for access by the host computer system, wherein:
the host computer system is a first device;
the manager device is a second device; and
the registered user device is a third device.
2. The data storage device of claim 1 , wherein the access controller is further configured to:
derive a user key from the manager key; and
encrypt the cryptographic key using the user key.
3. The data storage device of claim 1 , wherein:
the access controller is further configured to encrypt the manager key; and
the authorization data comprises the encrypted manager key.
4. The data storage device of claim 3 , wherein the encrypted manager key is decryptable based on an unlocking private key stored on the manager device.
5. The data storage device of claim 4 , wherein:
the encrypted manager key is decryptable based on a response from the manager device to a challenge generated by the access controller; and
the response was calculated by the manager device based on the unlocking private key stored on the manager device.
6. The data storage device of claim 5 , wherein the challenge is based on the authorization data.
7. The data storage device of claim 1 , wherein the access controller is further configured to:
generate an ephemeral private key;
calculate an ephemeral unlock secret based on the ephemeral private key; and
encrypt the manager key using the ephemeral unlock secret.
8. The data storage device of claim 7 , wherein the ephemeral unlock secret is based on an unlocking public key corresponding to an unlocking private key stored on the manager device.
9. The data storage device of claim 8 , wherein the ephemeral unlock secret and the unlocking private key are based on elliptic curve cryptography.
10. The data storage device of claim 8 , wherein the access controller is further configured to:
calculate an ephemeral public key corresponding to the ephemeral private key; and
encrypt the ephemeral public key using a metadata wrapping key.
11. The data storage device of claim 10 , wherein the access controller is further configured to generate the metadata wrapping key.
12. The data storage device of claim 11 , wherein the access controller is further configured to provide the metadata wrapping key to the manager device.
13. The data storage device of claim 12 , wherein the access controller is further configured to:
create a certificate for the manager device, wherein the certificate includes the metadata wrapping key;
sign the certificate; and
send the signed certificate to the manager device.
14. The data storage device of claim 13 , wherein the certificate comprises a transport public key sent to the access controller and corresponding to a transport private key stored on the manager device.
15. The data storage device of claim 1 , wherein receiving the request from the manager device to initialize the data storage device comprises establishing a secure communication channel.
16. The data storage device of claim 15 , wherein establishing the secure communication channel is based on an identity key provided on the data storage device and readable by the manager device out-of-band.
17. The data storage device of claim 15 , wherein establishing the secure communication channel comprises:
generating a certificate;
signing the certificate; and
sending the signed certificate to the manager device.
18. The data storage device of claim 1 , wherein the access controller is further configured to remove access for devices other than the manager device.
19. A method for initializing a data storage device configured for access from a host computer system, the method comprising:
during an initialization process for the data storage device:
receiving a request from a manager device to initialize the data storage device;
generating, responsive to the request from the manager device, a cryptographic key configured to decrypt encrypted user content data stored on a storage medium of the data storage device;
generating, responsive to the request from the manager device, a manager key configured to provide manager access to authorization data for registered devices; and
storing, in a non-volatile data store of the data storage device, the authorization data, wherein:
the authorization data comprises an authorized device record for the manager device;
the authorized device record for the manager device is indicative of the manager key; and
the authorization data is accessible based on a private key stored on the manager device;
during a registration process for a user device:
approving, by the manager device, the user device to become a registered user device;
storing, in the authorization data, an authorized device record for the registered user device, wherein:
the authorized device record comprises:
an encrypted user key configured to unlock, responsive to an unlock request from the registered user device, the cryptographic key; and
encrypted authorized device metadata configured to identify the registered user device; and
the manager device is configured to access the encrypted authorized device metadata responsive to the manager key; and
during an unlock process for the registered user device:
receiving, from the registered user device, the unlock request;
validating, using the authorized device record for the registered user device, the registered user device;
determining, responsive to the unlock request and based on the authorized device record for the registered user device, the cryptographic key; and
providing, responsive to the unlock request, the cryptographic key to a cryptography engine to decrypt the encrypted user content data for access by the host computer system, wherein:
the host computer system is a first device;
the manager device is a second device; and
the registered user device is a third device.
20. A data storage device comprising:
means for receiving, during an initialization process for the data storage device, a request from a manager device to initialize the data storage device, wherein the data storage device is configured for access from a host computer system;
means for generating, responsive to the request from the manager device, a cryptographic key configured to decrypt encrypted user content data stored on a storage medium of the data storage device;
means for generating, responsive to the request from the manager device, a manager key configured to provide manager access to authorization data for registered devices;
means for storing, during the initialization process and in a non-volatile data store of the data storage device, the authorization data, wherein:
the authorization data comprises an authorized device record for the manager device;
the authorized device record for the manager device is indicative of the manager key; and
the authorization data is accessible based on a private key stored on the manager device;
means for approving, during a registration process for a user device and by the manager device, the user device to become a registered user device;
means for storing, during the registration process and in the authorization data, an authorized device record for the registered user device, wherein:
the authorized device record comprises:
an encrypted user key configured to unlock, responsive to an unlock request from the registered user device, the cryptographic key; and
encrypted authorized device metadata configured to identify the registered user device; and
the manager device is configured to access the encrypted authorized device metadata responsive to the manager key;
means for receiving, from the registered user device during an unlock process, the unlock request;
means for validating, during the unlock process and using the authorized device record for the registered user device, the registered user device;
means for determining, responsive to the unlock request and based on the authorized device record for the registered user device, the cryptographic key; and
means for providing, responsive to the unlock request, the cryptographic key to a cryptography engine to decrypt the encrypted user content data for access by the host computer system, wherein:
the host computer system is a first device;
the manager device is a second device; and
the registered user device is a third device.