Patent ID: 8315394

Claim:
A method performed on a data storage device for providing security to data stored on the data storage device, the method comprising: encrypting data using a bulk encryption key; storing the encrypted data in non-volatile memory on the data storage device; generating a first password-generated encryption key based on a first password; generating a second password-generated encryption key based on a second password; wrapping an intermediate encryption key with the first password-generated encryption key to generate a first wrapped intermediate key; storing the first wrapped intermediate key in the non-volatile memory; wrapping the intermediate encryption key with the second password-generated encryption key to generate a second wrapped intermediate key; storing the second wrapped intermediate key in the non-volatile memory; wrapping the bulk encryption key with the intermediate encryption key to generate a wrapped bulk encryption key; unwrapping the wrapped bulk encryption key to regenerate the bulk encryption key using the intermediate encryption key regenerated from the first wrapped intermediate key; decrypting the encrypted data stored in the non-volatile memory using the regenerated bulk encryption key; encrypting the data using a new bulk encryption key; wrapping the new bulk encryption key with the intermediate encryption key to generate a new wrapped bulk encryption key; regenerating the second password-generated encryption key based on the second password; unwrapping the second wrapped intermediate key to regenerate the intermediate encryption key using the regenerated second password-generated encryption key; unwrapping the new wrapped bulk encryption key to regenerate the new bulk encryption key using the intermediate encryption key regenerated from the second wrapped intermediate key; and decrypting the data using the regenerated new bulk encryption key.