Sandisk Technologies Inc.

Western Digital Technologies, Inc.

John So

Brian Edward Mastenbrook

David Robert Arnold

Matthew Harris Klapman

Disclosed herein is a data storage device. A data port transmits data between a host computer system and the data storage device. A non-volatile storage medium stores encrypted user content data and a cryptography engine connected between the data port and the storage medium uses a cryptographic key to decrypt the encrypted user content data. Multiple manager device records each comprise a first key identical for each of the records, and a second key that different for each of the records. The controller generates an authorization request using the first key and receives a response to the request generated by a manager device. The response is specific to that manager device. The controller uses the response to locate the record; decrypts the located manager device record to obtain key data; and generates configuration data based on the key data to register the device.

Authorization requests from a data storage device to multiple manager devices

Disclosed herein is a data storage device. A data port transmits data between a host computer system and the data storage device. A non-volatile storage medium stores encrypted user content data and a cryptography engine connected between the data port and the storage medium uses a cryptographic key to decrypt the encrypted user content data. The access controller generates authorization request data indicative of multiple devices to be authorized, and stores the authorization request data on non-volatile configuration memory of the data storage device. Upon approval of the authorization request data by a manager device that is registered with the access controller as a manager device, the access controller locates the authorization request data of one of the multiple devices to be authorized and registers the one of the multiple devices to be authorized as an authorized device.

Multiple authorization requests from a data storage device

Disclosed herein is a data storage device. A data port transmits data between a host computer system and the data storage device. A non-volatile storage medium stores encrypted user content data and a cryptography engine connected between the data port and the storage medium uses a cryptographic key to decrypt the encrypted user content data. The access controller generates an authorization request for a manager device. The authorization request comprises a certificate. The certificate comprising key data. In response to receiving the key data in a response to the authorization request generated by the manager device, the access controller generates configuration data based on the key data to register the device to be authorized as an authorized device.

Certificates in data storage devices

Disclosed herein is a data storage device. A data port transmits data between a host computer system and the data storage device. A non-volatile storage medium stores encrypted user content data and a cryptography engine connected between the data port and the storage medium uses a cryptographic key to decrypt the encrypted user content data. The access controller generates a challenge for a manager device. The challenge comprises a blinded public key of an ephemeral unlock key pair that is blinded by an unlock blinding key. The challenge further comprises the unlock blinding key in encrypted form. The access controller further provides the challenge to the device to be authorized for sending the challenge to the manager device; receives a response to the challenge; decrypts the unlock blinding key and calculates a shared secret; and upon determining that the response indicates approval of registering the device, registers the device to be authorized as an authorized device.

Growing community of inventors

San Jose, CA, United States of America

John So