Authorization requests from a data storage device to multiple manager devices

A method performed by an access controller of a data storage device the method comprising:

• generating multiple manager device records, each manager device record of the multiple manager device records corresponding to one manager device of multiple different manager devices, wherein each manager device record of the multiple manager device records comprises:
• a first key that is identical for each manager device of the multiple manager device records, and
• a second key that is different for each manager device of the multiple manager device records;
• upon a device to be authorized requesting to be registered as an authorized device, generating an authorization request based on the first key that is identical for each manager device of the multiple manager device records, wherein the authorization request comprises an unlock blinding key usable by each manager device to determine an ephemeral unlock key from an ephemeral unlock key pair for the authorization request;
• providing a challenge for each manager device in the authorization request, the challenge comprising a blinded public key of the ephemeral unlock key pair;
• receiving a response to the challenge generated by that one manager device, wherein the response comprises the blinded public key multiplied by a device-specific private key stored on that one manager device;
• generating a shared secret based on the blinded public key multiplied by the device-specific private key;
• encrypting and storing key data using the shared secret;
• after encrypting the key data, discarding the shared secret;
• receiving a response to the authorization request generated by one manager device of the multiple different manager devices, wherein the response is specific to that one manager device of the multiple different manager devices and comprises a response value based on the ephemeral unlock key and a device-specific private key for that one manager device;
• using at least part of the response to locate one manager device record of the multiple manager device records associated with that one manager device of the multiple different manager devices that generated the response;
• decrypting at least part of the located manager device record to obtain key data;
• and
• generating configuration data based on the key data to register the device to be authorized as an authorized device for enabling a cryptography engine in the data storage device to decrypt encrypted user content data on a non-volatile storage medium of the data storage device for access by a host computer system, wherein:
• the host computer system is a first device;
• the multiple different manager devices are multiple second devices;
• and
• the device to be authorized is a third device.

A data storage device comprising:

• a data path comprising:
• a data port configured to transmit data between a host computer system and the data storage device;
• a non-volatile storage medium configured to store encrypted user content data;
• and
• a cryptography engine connected between the data port and the non-volatile storage medium, wherein the cryptography engine is configured to use a cryptographic key to decrypt the encrypted user content data stored on the non-volatile storage medium in response to a request from the host computer system;
• means for generating multiple manager device records, each manager device record of the multiple manager device records corresponding to one manager device of multiple different manager devices, wherein each manager device record of the multiple manager device records comprises:
• a first key that is identical for each manager device of the multiple manager device records, and
• a second key that is different for each manager device of the multiple manager device records;
• means for, upon a device to be authorized requesting to be registered as an authorized device, generating an authorization request based on the first key that is identical for each manager device of the multiple manager device records, wherein the authorization request comprises an unlock blinding key usable by each manager device to determine an ephemeral unlock key from an ephemeral unlock key pair for the authorization request;
• means for providing a challenge for each manager device in the authorization request, the challenge comprising a blinded public key of the ephemeral unlock key pair;
• means for receiving a response to the challenge generated by that one manager device, wherein the response comprises the blinded public key multiplied by a device-specific private key stored on that one manager device;
• means for generating a shared secret based on the blinded public key multiplied by the device-specific private key;
• means for encrypting and storing key data using the shared secret;
• means for, after encrypting the key data, discarding the shared secret;
• means for receiving a response to the authorization request generated by one manager device of the multiple different manager devices, wherein the response is specific to that one manager device of the multiple different manager devices and comprises a response value based on the ephemeral unlock key and a device-specific private key for that one manager device;
• means for using at least part of the response to locate one manager device record of the multiple manager device records associated with that one manager device of the multiple different manager devices that generated the response;
• means for decrypting part of the located manager device record to obtain key data;
• and
• means for generating configuration data based on the key data to register the device to be authorized as an authorized device, wherein
• the host computer system is a first device;
• the multiple different manager devices are multiple second devices;
• and
• the device to be authorized is a third device.