Certificates in data storage devices

A method comprising:

• generating, by an access controller of a data storage device and responsive to a device to be authorized requesting to be registered as an authorized device, an authorization request for a manager device, wherein:
• the authorization request comprises a certificate;
• the certificate comprises key data;
• the key data in the certificate comprises a blinded public ephemeral unlock key;
• the certificate further comprises an encrypted blinding factor used to blind the blinded public ephemeral unlock key;
• and
• the data storage device comprises a data path comprising:
• a data port configured to transmit data between a host computer system and the data storage device;
• a non-volatile storage medium configured to store encrypted user content data;
• and
• a cryptography engine connected between the data port and the storage medium, wherein the cryptography engine is configured to use a cryptographic key to decrypt the encrypted user content data stored on the storage medium in response to a request from the host computer system;
• discarding, by the access controller, the blinding factor responsive to blinding the blinded public ephemeral unlock key;
• receiving, by the access controller, a response to the authorization request, wherein:
• the response is generated by the manager device;
• the response comprises:
• the blinded public ephemeral unlock key multiplied by a private key stored on the manager device;
• and
• the encrypted blinding factor;
• and
• the private key corresponds to a public key stored in a non-volatile memory of the data storage device;
• generating, by the access controller, a shared secret by decrypting the encrypted blinding factor in the response to unblind the blinded public ephemeral unlock key multiplied by the private key;
• and
• generating, by the access controller and using the shared secret as a key, configuration data based on the key data to register the device to be authorized as an authorized device, wherein:
• the host computer system is a first device;
• the manager device is a second device;
• and
• the device to be authorized is a third device.

A data storage device comprising:

• a non-volatile memory;
• a data path comprising:
• a data port configured to transmit data between a host computer system and the data storage device;
• a non-volatile storage medium configured to store encrypted user content data;
• and
• a cryptography engine connected between the data port and the storage medium, wherein the cryptography engine is configured to use a cryptographic key to decrypt the encrypted user content data stored on the storage medium in response to a request from the host computer system;
• means for generating, responsive to a device to be authorized requesting to be registered as an authorized device, an authorization request for a manager device, wherein:
• the authorization request comprises a certificate;
• the certificate comprises key data;
• the key data in the certificate comprises a blinded public ephemeral unlock key;
• and
• the certificate further comprises an encrypted blinding factor used to blind the blinded public ephemeral unlock key;
• means for discarding the blinding factor responsive to blinding the blinded public ephemeral unlock key;
• means for receiving a response to the authorization request, wherein:
• the response is generated by the manager device;
• the response comprises:
• the blinded public ephemeral unlock key multiplied by a private key stored on the manager device;
• and
• the encrypted blinding factor;
• and
• the private key corresponds to a public key stored in the non-volatile memory;
• means for generating a shared secret by decrypting the encrypted blinding factor in the response to unblind the blinded public ephemeral unlock key multiplied by the private key;
• and
• means for generating, using the shared secret as a key, configuration data based on the key data to register the device to be authorized as an authorized device, wherein
• the host computer system is a first device;
• the manager device is a second device;
• and
• the device to be authorized is a third device.