Data Storage Device Manager Access Initialization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage devices face challenges in user-friendly encryption setup and secure access management, particularly for technically unskilled users, as existing encryption technologies are cumbersome and insecure, and access control lists are impractical for devices moved between host systems, leading to exposed confidential data.
Innovation Solution
A data storage device with a 'take ownership' process that uses a user device to register and gain manager access, involving crypto-erasing user content data, generating cryptographic keys, and employing an access controller to manage access through a non-volatile data store and cryptography engine, utilizing elliptic curve cryptography for secure key management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption is used to secure data storage, then data security is improved, but setup complexity and user difficulty increase
Solution Approach 1:
The system performs self-service by automatically generating cryptographic key pairs and managing encryption/decryption operations without requiring user configuration. The portable device autonomously handles key generation, stores private keys securely, and manages the encryption state of the data storage device, eliminating the need for manual setup while maintaining strong encryption security.
2Adaptability or versatility
If access control lists are used for device management, then access control capability is improved, but portability and external OS dependence worsen
Solution Approach 1:
The access control functionality is extracted from the external operating system and embedded directly into the portable device. The portable device now contains its own access control logic, cryptographic key management, and authorization verification mechanisms, making the system independent of external OS implementations and enabling seamless portability across different host systems.
Solution Approach 2:
The portable device is designed with universal functionality to work across multiple operating systems and host environments. It implements a standardized interface that can authenticate and manage access to the data storage device regardless of the external OS, providing consistent access control capabilities portably across different platforms without requiring OS-specific implementations.
3Reliability
If multiple roles are defined for device management, then access security is improved, but system complexity increases
Solution Approach 1:
Different access security levels are implemented through local quality by assigning specific cryptographic keys and authorization levels to different user roles. The system maintains simple overall structure while providing differentiated access control by giving managers full cryptographic access rights and users limited decryption rights, with role-specific key pairs stored and managed locally for each user type.
Data Source
AI summary
Disclosed herein is a data storage device. A data port transmits data between a host computer system and the data storage device. A non-volatile storage medium stores encrypted user content data and a cryptography engine uses a cryptographic key to decrypt the encrypted user content data stored on the storage medium in response to a request from the host computer system. An access controller receives a request from a manager device to initialize the data storage device. The controller generates the cryptographic key, generates a manager key configured to provide manager access for the manager device and provide access to the cryptographic key, and stores, on a data store, authorization data indicative of the manager key and accessible based on a private key stored on the manager device.