Access control system and a data storage device

A removable data storage device (DSD) comprising:

• a non-transitory storage medium configured to store user data, wherein the non-transitory storage medium includes:
• a Replay Protected Memory Block (RPMB) formed in a plurality of non-transitory memory cells;
• and
• an access key set;
• a data port configured to transmit data between a host computing system and the DSD by way of a data path to a bus of the host computing system;
• and
• a controller configured to:
• in response to the access key set including a host-specific RPMB key value, authenticate one or more operations of the host computing system to access the RPMB;
• and
• adjust the access key set in response to one or more key control operations performed on the DSD by an access control system and through the host computing system,
• wherein the access control system is configured to:
• receive, from the host computing system and over a network, a request to enable access of the host computing system to the RPMB of the DSD;
• process the request to determine whether the host computing system is authorized to access the RPMB of the DSD;
• and
• in response to determining that the host computing system is authorized to access the RPMB of the DSD:
• generate the host-specific RPMB key value that is unique to a combination of a host identifier for the host computing system and a RPBM key of the DSD;
• securely program the host computing system with the host-specific RPMB key value;
• and
• send a secure key programming operation to cause the controller to add the host-specific RPMB key value to the access key set.

A system comprising:

• a removable data storage device (DSD) comprising a non-transitory storage medium configured to store user data, wherein the non-transitory storage medium includes a Replay Protected Memory Block (RPMB) formed in a plurality of non-volatile memory cells;
• a host computing system, wherein the DSD is connected by way of a data interface to a bus of the host computing system;
• and
• an access control system in communication with the host computing system over a network and comprising:
• at least one memory;
• at least one processor;
• means for receiving, from the host computing system and over the network, a request to enable access of the host computing system to the RPMB of the DSD;
• means for processing the request to determine whether the host computing system is authorized to access the RPMB of the DSD;
• and
• means for, in response to determining that the host computing system is authorized to access the RPMB of the DSD:
• generating a host-specific RPMB key value that is unique to a combination of a host identifier for the host computing system and a RPBM key of the DSD;
• securely programming the host computing system with the host-specific RPMB key value;
• and
• securely programming, through the bus of the host computing system, the DSD with the host-specific RPMB key value, wherein the DSD is configured to authenticate, using the host-specific RPMB key value, the host computing system to access the RPMB by way of a data path of the DSD.