Challenge response authentication for self encrypting drives
AssigneeIntel Corporation
InventorsAdrian R. Pearson, Jason R. Cox, James Chu
Life of this patent
Estimating the term…
Abstract
Various embodiments are directed to a system for accessing a self-encrypting drive (SED) based on a blind challenge authentication response mechanism (BCRAM). An SED may be authenticated within a system, for example, upon resuming from a sleep state, based on a challenge generated within the SED, signed using a private key by a trusted execution environment (TEE) and authenticated using a corresponding public key within the SED.
Claims8
An apparatus, comprising:
- logic, a portion of which is implemented in hardware, the logic to comprise a blind challenge authentication element (BCAE) component to:
- receive a blind challenge response authentication mechanism (BCRAM) request, the BCRAM request to include an indication to authenticate a self-encrypting drive (SED);
- generate an arbitrary element;
- determine a first challenge authentication element (CAE) based at least in part on the arbitrary element and a public key, the public key corresponding to a private key from a public/private key pair;
- determine a padded challenge authentication element (PCAE) based at least in part on the first CAE and a padding constant, the padding constant determined based at least in part on a length of the public key;
- generate a BCAE based at least in part on the PCAE and the first CAE and in response to receipt of the BCRAM request;
- receive a signed blind challenge authentication element (SBCAE) from a signing entity;
- determine an unblind challenge authentication element (UCAE) based on the SBCAE, a second CAE, and the length of the public key, the second CAE based at least in part on the arbitrary element and the length of the public key;
- determine authentication credentials to access the SED based at least in part on the UCAE;
- and
- a communications bus communicatively coupled to the logic, the communications bus to communicate the BCAE and SBCAE.
At least one non-transitory machine-readable storage medium comprising instructions that when executed by a self-encrypting drive (SED), cause the SED to:
- receive a blind challenge response authentication mechanism (BCRAM) request, the BCRAM request to include an indication to authenticate the SED;
- generate an arbitrary element;
- determine a first challenge authentication element (CAE) based at least in part on the arbitrary element and a public key, the public key corresponding to a private key from a public/private key pair;
- determine a padded challenge authentication element (PCAE) based at least in part on the first CAE and a padding constant, the padding constant determined based at least in part on a length of the public key;
- generate a blind challenge authentication element (BCAE) based at least in part on the PCAE and the first CAE and in response to receipt of the BCRAM request;
- communicate the BCAE to a signing entity;
- receive a signed blind challenge authentication element (SBCAE) from the signing entity;
- determine an unblind challenge authentication element (UCAE) based on the SBCAE, a second CAE, and the length of the public key, the second CAE based at least in part on the arbitrary element and the length of the public key;
- and
- determine authentication credentials to access the SED based at least in part on the UCAE.
Dependencies are inferred from the claim text.