Method, system, and program for securely providing keys to encode and decode data in a storage cartridge

• US 20030074319A1
• Filed: 10/11/2001
• Published: 04/17/2003
• Est. Priority Date: 10/11/2001
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Jaquette, Glen Alan
• Granted Patent: US 7,865,440 B2
• Time in Patent Office: Days
• US Class Current: 705/51
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 21/805 using a security table for the storage sub-system
• CPC Class Codes: G06F 2221/2121 Chip on media, e.g. a disk or tape with a chip embedded in its case

Abstract

Provided is a method, system, and program for enabling access to data in a storage medium within one of a plurality of storage cartridges capable of being mounted into a interface device. An association is provided of at least one coding key to a plurality of storage cartridges. A determination is made of one coding key associated with one target storage cartridge, wherein the coding key is capable of being used to access data in the storage medium within the target storage cartridge. The determined coding key is encrypted. The coding key is subsequently decrypted to use to decode and code data stored in the storage medium.

Claims

1. A method for enabling access to data in a storage medium within one of a plurality of storage cartridges capable of being mounted into a interface device, comprising:

providing an association of at least one coding key to a plurality of storage cartridges;

determining one coding key associated with one target storage cartridge, wherein the coding key is capable of being used to access data in the storage medium within the target storage cartridge; and

encrypting the determined coding key, wherein the coding key is decrypted to use to decode and code data stored in the storage medium.

2. The method of claim 1, further comprising:

using the coding key to encode data to write to the storage medium;

transmitting the encoded data to the interface device to write to the storage medium in one storage cartridge mounted in the interface device;

receiving encoded data from the interface device read from the storage medium; and

using the coding key to decrypt the received encoded data.

3. The method of claim 1, wherein the association of the at least one coding key to the plurality of storage cartridges associates one key with the plurality of storage cartridges, wherein the one key is capable of being used to encode data written to the storage medium and decode data read from the storage medium of the plurality of storage devices.

4. The method of claim 1, wherein the association of the at least one coding key to the plurality of storage cartridges associates a different key with each storage cartridge, wherein the key associated with one storage cartridge is used to encode data written to the storage medium and decode data read from the storage medium of the storage cartridge.

5. The method of claim 1, wherein the coding key comprises a seed value that is used to generate an additional key that is used to directly decode and encode the data in the storage medium in the storage cartridge.

6. The method of claim 1, further comprising:

transmitting the encrypted coding key to the interface device, wherein the interface device decrypts the coding key to use to decode and code data stored in the storage medium.

7. The method of claim 6, wherein encrypting the coding key further comprises:

encrypting the coding key with a first key, wherein a second key used by the interface device is capable of decrypting the coding key encrypted with the first key.

8. The method of claim 6, wherein encrypting the coding key further comprises:

encrypting the coding key with a first key, wherein a second key is capable of decrypting the coding key encrypted with the first key;

encrypting the second key with a third key, wherein a fourth key used by the interface device is capable of decrypting data encrypted with the third key; and

transmitting the coding key encrypted with the first key and the second key encrypted with the third key to the interface device.

9. The method of claim 6, wherein encrypting the coding key further comprises:

encrypting the coding key with a first key, wherein a second key is capable of decrypting the coding key encrypted with the first key;

transmitting the coding key encrypted with the first key to the interface device;

receiving, from the interface device, the coding key encrypted with the first key;

decrypting the coding key with the second key;

encrypting the coding key with a third key, wherein a fourth key used by the interface device is capable of decrypting data encrypted with the third key; and

transmitting the coding key encrypted with the third key to the interface device.

10. A method for accessing data in a removable storage cartridge including a storage medium, comprising:

receiving an encrypted coding key from a host system;

decrypting the encrypted coding key;

using the coding key to encode data to write to the storage medium; and

using the coding key to decode data written to the storage medium.

11. The method of claim 10, wherein encoding the data with the coding key compresses the data and wherein decoding the data written to the storage medium decompresses the data, and wherein the data can only be encoded or decoded using the coding key.

12. The method of claim 10, wherein the coding key is encrypted by a first key maintained at the host system, further comprising;

maintaining a second key that is capable of decrypting data encrypted using the first key, wherein the second key is used to decrypt the coding key encrypted with the first key.

13. The method of claim 12, wherein the second key is stored in an integrated circuit non-volatile memory that is only accessible to decrypting logic that uses the second key to decrypt data encrypted using the first key.

14. The method of claim 13, further comprising:

transmitting the coding key decrypted using the decrypting logic to encoder/decoder logic, wherein the encoder/decoder logic uses the coding key to encode and decode data to the storage medium.

15. The method of claim 12, further comprising:

storing the coding key encrypted with the first key within the storage cartridge;

receiving an input/output (I/O) request directed to the storage cartridge; and

accessing the encrypted coding key from the storage cartridge, wherein the accessed coding key is decrypted using the second key, and wherein the decrypted coding key is used to encode and decode data to execute the I/O request to the storage cartridge.

16. The method of claim 10, wherein the received encrypted coding key is encrypted by a first key maintained at the host system, wherein the host system maintains a second key that is capable of decrypting data encrypted using the first key, further comprising:

receiving, from the host system, the second key encrypted by the host system using a third key, wherein data encrypted using the third key is capable of being decrypted using a fourth key;

accessing the fourth key;

using the fourth key to decrypt the encrypted second key received from the host system; and

using the decrypted second key to decrypt the received coding key encrypted using the first key.

17. The method of claim 10, wherein the coding key is encrypted by a first key maintained at the host system, wherein the host system maintains a second key that is capable of decrypting data encrypted using the first key, further comprising:

transmitting the encrypted coding key received from the host system back to the host system; and

in response to transmitting the encrypted coding key back to the host system, receiving, from the host system, the coding key encrypted using a third key, wherein data encrypted using the third key is decrypted using a fourth key; and

accessing the fourth key, wherein the coding key is decrypted using the fourth key.

18. A system for enabling access to data in a storage medium within one of a plurality of storage cartridges, comprising:

an interface device in which the storage cartridges are capable of being mounted, wherein the interface device is capable of writing data to the storage medium within the storage cartridges and reading data from the storage medium in the storage cartridges;

means for determining one coding key associated with one target storage cartridge, wherein the coding key is capable of being used to access data in the storage medium within the target storage cartridge; and

means for encrypting the determined coding key, wherein the coding key is decrypted to use to decode and encode data stored in the storage medium.

19. The system of claim 18, further comprising:

means for using the coding key to encode data to write to the storage medium;

means for transmitting the encoded data to the interface device to write to the storage medium in one storage cartridge mounted in the interface device;

means for receiving encoded data from the interface device read from the storage medium; and

means for using the coding key to decrypt the received encoded data.

20. The system of claim 18, wherein the association of the at least one coding key to the plurality of storage cartridges associates one key with the plurality of storage cartridges, wherein the one key is capable of being used to encode data written to the storage medium and decode data read from the storage medium of the plurality of storage devices.

21. The system of claim 18, wherein the association of the at least one coding key to the plurality of storage cartridges associates a different key with each storage cartridge, wherein the key associated with one storage cartridge is used to encode data written to the storage medium and decode data read from the storage medium of the storage cartridge.

22. The system of claim 18, further comprising:

means for transmitting the encrypted coding key to the interface device, wherein the interface device decrypts the coding key to use to decode and code data stored in the storage medium.

23. A system for accessing data in a removable storage cartridge including a storage medium, comprising:

means for receiving an encrypted coding key from a host system;

means for decrypting the encrypted coding key;

means for using the coding key to encode data to write to the storage medium; and

means for using the coding key to decode data written to the storage medium.

24. The system of claim 23, wherein the coding key is encrypted by a first key maintained at the host system, further comprising;

means for maintaining a second key that is capable of decrypting data encrypted using the first key, wherein the second key is used to decrypt the coding key encrypted with the first key.

25. The system of claim 24, further comprising:

an integrated circuit non-volatile memory including the second key, wherein the integrated circuit non-volatile memory;

decrypting logic for using the second key to decrypt data encrypted using the first key, wherein the integrated circuit non-volatile memory is only accessible to the decrypting logic.

26. The method of claim 24, further comprising:

means for storing the coding key encrypted with the first key within the storage cartridge;

means for receiving an input/output (I/O) request directed to the storage cartridge; and

means for accessing the encrypted coding key from the storage cartridge, wherein the accessed coding key is decrypted using the second key, and wherein the decrypted coding key is used to encode and decode data to execute the I/O request to the storage cartridge.

27. An article of manufacture including code for enabling access to data in a storage medium within one of a plurality of storage cartridges capable of being mounted into a interface device, wherein the code is capable of causing operations comprising:

providing an association of at least one coding key to a plurality of storage cartridges;

determining one coding key associated with one target storage cartridge, wherein the coding key is capable of being used to access data in the storage medium within the target storage cartridge; and

encrypting the determined coding key, wherein the coding key is decrypted to use to decode and code data stored in the storage medium.

28. The article of manufacture of claim 27, further comprising:

using the coding key to encode data to write to the storage medium;

transmitting the encoded data to the interface device to write to the storage medium in one storage cartridge mounted in the interface device;

receiving encoded data from the interface device read from the storage medium; and

using the coding key to decrypt the received encoded data.

29. The article of manufacture of claim 27, wherein the association of the at least one coding key to the plurality of storage cartridges associates one key with the plurality of storage cartridges, wherein the one key is capable of being used to encode data written to the storage medium and decode data read from the storage medium of the plurality of storage devices.

30. The article of manufacture of claim 27, wherein the association of the at least one coding key to the plurality of storage cartridges associates a different key with each storage cartridge, wherein the key associated with one storage cartridge is used to encode data written to the storage medium and decode data read from the storage medium of the storage cartridge.

31. The article of manufacture of claim 27, wherein the coding key comprises a seed value that is used to generate an additional key that is used to directly decode and encode the data in the storage medium in the storage cartridge.

32. The article of manufacture of claim 27, further comprising:

transmitting the encrypted coding key to the interface device, wherein the interface device decrypts the coding key to use to decode and code data stored in the storage medium.

33. The article of manufacture of claim 32, wherein encrypting the coding key further comprises:

encrypting the coding key with a first key, wherein a second key used by the interface device is capable of decrypting the coding key encrypted with the first key.

34. The article of manufacture of claim 32, wherein encrypting the coding key further comprises:

encrypting the coding key with a first key, wherein a second key is capable of decrypting the coding key encrypted with the first key;

encrypting the second key with a third key, wherein a fourth key used by the interface device is capable of decrypting data encrypted with the third key; and

transmitting the coding key encrypted with the first key and the second key encrypted with the third key to the interface device.

35. The article of manufacture of claim 32, wherein encrypting the coding key further comprises:

encrypting the coding key with a first key, wherein a second key is capable of decrypting the coding key encrypted with the first key;

transmitting the coding key encrypted with the first key to the interface device;

receiving, from the interface device, the coding key encrypted with the first key;

decrypting the coding key with the second key;

encrypting the coding key with a third key, wherein a fourth key used by the interface device is capable of decrypting data encrypted with the third key; and

transmitting the coding key encrypted with the third key to the interface device.

36. An article of manufacture including code for accessing data in a removable storage cartridge including a storage medium, wherein the code causes operations comprising:

receiving an encrypted coding key from a host system;

decrypting the encrypted coding key;

using the coding key to encode data to write to the storage medium; and

using the coding key to decode data written to the storage medium.

37. The article of manufacture of claim 36, wherein encoding the data with the coding key compresses the data and wherein decoding the data written to the storage medium decompresses the data, and wherein the data can only be encoded or decoded using the coding key.

38. The article of manufacture of claim 36, wherein the coding key is encrypted by a first key maintained at the host system, further comprising;

maintaining a second key that is capable of decrypting data encrypted using the first key, wherein the second key is used to decrypt the coding key encrypted with the first key.

39. The article of manufacture of claim 38, wherein the second key is stored in an integrated circuit non-volatile memory that is only accessible to decrypting logic that uses the second key to decrypt data encrypted using the first key.

40. The article of manufacture of claim 36, further comprising:

transmitting the coding key decrypted using the decrypting logic to encoder/decoder logic, wherein the encoder/decoder logic uses the coding key to encode and decode data to the storage medium.

41. The article of manufacture of claim 38, further comprising:

storing the coding key encrypted with the first key within the storage cartridge;

receiving an input/output (I/O) request directed to the storage cartridge; and

accessing the encrypted coding key from the storage cartridge, wherein the accessed coding key is decrypted using the second key, and wherein the decrypted coding key is used to encode and decode data to execute the I/O request to the storage cartridge.

42. The article of manufacture of claim 36, where in the received encrypted coding key is encrypted by a first key maintained at the host system, wherein the host system maintains a second key that is capable of decrypting data encrypted using the first key, further comprising:

receiving, from the host system, the second key encrypted by the host system using a third key, wherein data encrypted using the third key is capable of being decrypted using a fourth key;

accessing the fourth key;

using the fourth key to decrypt the encrypted second key received from the host system; and

using the decrypted second key to decrypt the received coding key encrypted using the first key.

43. The article of manufacture of claim 36, wherein the coding key is encrypted by a first key maintained at the host system, wherein the host system maintains a second key that is capable of decrypting data encrypted using the first key, further comprising:

transmitting the encrypted coding key received from the host system back to the host system; and

in response to transmitting the encrypted coding key back to the host system, receiving, from the host system, the coding key encrypted using a third key, wherein data encrypted using the third key is decrypted using a fourth key; and

accessing the fourth key, wherein the coding key is decrypted using the fourth key.