Method and apparatus for deleting data upon expiration

• US 20060143443A1
• Filed: 02/04/2005
• Published: 06/29/2006
• Est. Priority Date: 02/04/2004
• Status: Active Grant

• Current Assignee: NetApp, Inc.
• Original Assignee: Alacritus, Inc. (NetApp, Inc.)
• Inventors: Trimmer, Donald Alvin, Blaser, Rico, Cohen, Gavin David
• Granted Patent: US 7,559,088 B2
• Time in Patent Office: Days
• US Class Current: 713/158
• CPC Class Codes: G06F 11/1448 Management of the data involved in backup or backup restore
• CPC Class Codes: G06F 2201/84 Using snapshots, i.e. a logical point-in-time copy of the data
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method and apparatus for efficiently deleting data including backup or snapshots upon expiration are disclosed. The data can be deleted even without physical access to the data. A data generation unit generates a data. Each data has an expiration time and should be deleted upon expiration. An encryption unit encrypts the data, and the encrypted data is stored in data storage. A controller monitors whether there is an expired data, and if there is an expired data, the controller deletes a key necessary for decrypting the expired data.

Claims

1. A method for deleting data upon expiration comprising:

generating data;

encrypting the data;

storing the encrypted data in a data storage; and

deleting a key necessary for decrypting the encrypted data when the encrypted data expires.

2. The method of claim 1 wherein the data is a snapshot of the original data.

3. The method of claim 1 wherein the data is a backup copy stored on a tape or a virtual tape.

4. The method of claim 1 wherein each data is encrypted using a different encryption key.

5. The method of claim 1 wherein the data which expire during the same period are encrypted using the same encryption key.

6. An apparatus for deleting data upon expiration comprising:

a data generation unit for generating data;

an encryption unit for encrypting the data; and

a controller for deleting a key necessary for decrypting the encrypted data when the encrypted data expires; and

a storage for storing the encrypted data.

7. The apparatus of claim 6 wherein the data is a snapshot of the original data.

8. The apparatus of claim 6 wherein the data is a backup copy stored on a tape or a virtual tape.

9. The apparatus of claim 6 wherein the storage comprises a primary data volume and a secondary data volume, whereby the data is stored in the secondary data volume.

10. The apparatus of claim 6 further comprising an encryption key storage for storing a list of a plurality of data, encryption/decryption keys for each of the data, and an expiration time for each of the data.

11. The apparatus of claim 6 wherein each data is encrypted using a different encryption key.

12. The apparatus of claim 6 wherein data which expire during the same period are encrypted using the same encryption key.