Patent ID: 8307217

Claim:
A method for authenticating access to an encrypted content on a storage medium, wherein the encrypted content is encrypted according to a full disk encryption (FDE) key, the storage medium including an encrypted version of the FDE key and an encrypted version of a protected storage area (PSA) key, and wherein the encrypted version of the FDE key is encrypted according to the PSA key, the method comprising: providing an authenticated communication channel between a host and a storage engine associated with the storage medium; at the storage engine, receiving a pass code from the host over the authenticated communication channel; at the storage engine, hashing the received pass code to form a derived key, wherein the encrypted version of the PSA key is encrypted according to the derived key; at the storage engine, verifying an authenticity of the received pass code; if the received pass code is authentic, decrypting the encrypted version of the PSA key to recover the PSA key at the storage engine; at the storage engine, decrypting the encrypted FDE key using the recovered PSA key to recover the FDE key; and at the storage engine, decrypting the encrypted content using the FDE key; wherein verifying the authenticity includes hashing a corresponding pass code associated with the user record to generate an entity authentication code (EAC), encrypting the EAC, storing the encrypted EAC in a user record on the storage medium, and hashing the received pass code, decrypting the stored encrypted EAC to recover the EAC, and comparing the hashed received pass code to the EAC.