# US 9,871,663 B2 · Challenge response authentication for self encrypting drives

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,871,663 B2
- Document ID: US9871663B2
- Status: Granted
- Kind: B2
- Application number: 14/668,657
- Filed: 2015-03-25
- Published: 2016-09-29
- Granted: 2018-01-16
- Earliest claimed: 2015-03-25
- Assignees: Intel Corporation
- Applicants: Intel Corporation
- Inventors: Adrian R. Pearson; Jason R. Cox; James Chu
- Web page: https://patentgrep.com/patent/US9871663B2

## CPC

- H04L 9/3271: {using challenge-response}
- G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)}
- G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- H04L 9/3257: {using blind signatures}
- H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)}
- G06F 2212/1052: Security improvement
- G06F 2221/2139: Recurrent verification
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Various embodiments are directed to a system for accessing a self-encrypting drive (SED) based on a blind challenge authentication response mechanism (BCRAM). An SED may be authenticated within a system, for example, upon resuming from a sleep state, based on a challenge generated within the SED, signed using a private key by a trusted execution environment (TEE) and authenticated using a corresponding public key within the SED.

## Claims

### Claim 1

An apparatus, comprising:
logic, a portion of which is implemented in hardware, the logic to comprise a blind challenge authentication element (BCAE) component to:
receive a blind challenge response authentication mechanism (BCRAM) request, the BCRAM request to include an indication to authenticate a self-encrypting drive (SED);
generate an arbitrary element;
determine a first challenge authentication element (CAE) based at least in part on the arbitrary element and a public key, the public key corresponding to a private key from a public/private key pair;
determine a padded challenge authentication element (PCAE) based at least in part on the first CAE and a padding constant, the padding constant determined based at least in part on a length of the public key;
generate a BCAE based at least in part on the PCAE and the first CAE and in response to receipt of the BCRAM request;
receive a signed blind challenge authentication element (SBCAE) from a signing entity;
determine an unblind challenge authentication element (UCAE) based on the SBCAE, a second CAE, and the length of the public key, the second CAE based at least in part on the arbitrary element and the length of the public key;
determine authentication credentials to access the SED based at least in part on the UCAE; and
a communications bus communicatively coupled to the logic, the communications bus to communicate the BCAE and SBCAE.

### Claim 2 (depends on 1)

The apparatus of claim 1, the BCAE component to execute in the SED.

### Claim 3 (depends on 1)

The apparatus of claim 1, comprising a decryption component implemented in logic, a portion of which comprises hardware, the decryption component to decrypt a least a portion of the SED based on the authentication credentials.

### Claim 4 (depends on 1)

The apparatus of claim 1, comprising an authentication component implemented in logic, a portion of which comprises hardware, the authentication component to:
determine whether the authentication credentials are valid; and
communicate a request for valid authentication credentials to a host based on the determination that the authentication credentials are not valid.

### Claim 5 (depends on 1)

The apparatus of claim 1, the authentication credentials to include media access keys.

### Claim 6

At least one non-transitory machine-readable storage medium comprising instructions that when executed by a self-encrypting drive (SED), cause the SED to:
receive a blind challenge response authentication mechanism (BCRAM) request, the BCRAM request to include an indication to authenticate the SED;
generate an arbitrary element;
determine a first challenge authentication element (CAE) based at least in part on the arbitrary element and a public key, the public key corresponding to a private key from a public/private key pair;
determine a padded challenge authentication element (PCAE) based at least in part on the first CAE and a padding constant, the padding constant determined based at least in part on a length of the public key;
generate a blind challenge authentication element (BCAE) based at least in part on the PCAE and the first CAE and in response to receipt of the BCRAM request;
communicate the BCAE to a signing entity;
receive a signed blind challenge authentication element (SBCAE) from the signing entity;
determine an unblind challenge authentication element (UCAE) based on the SBCAE, a second CAE, and the length of the public key, the second CAE based at least in part on the arbitrary element and the length of the public key; and
determine authentication credentials to access the SED based at least in part on the UCAE.

### Claim 7 (depends on 6)

The at least one non-transitory machine-readable storage medium of claim 6, comprising instructions that further cause the SED to decrypt the SED based on the authentication credentials.

### Claim 8 (depends on 6)

The at least one non-transitory machine-readable storage medium of claim 6, comprising instructions that further cause the SED to:
determine whether the authentication credentials are valid; and
communicate a request for valid authentication credentials to a host based on the determination that the authentication credentials are not valid.