Method and apparatus for managing encrypted data on a computer readable medium

• US 20060179327A1
• Filed: 02/09/2005
• Published: 08/10/2006
• Est. Priority Date: 02/09/2005
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Mittal, Hemant, Musa, Mehmet
• Granted Patent: US 7,590,868 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries

Abstract

A method and apparatus for managing encrypted data on a computer readable medium wherein an encryption key is determined for a received quantum of data. The quantum of data is encrypted according to the encryption key at a volume level when the quantum of data comprises volume data. The quantum of data is encrypted according to the encryption key at a file level when the data comprises file data. The encrypted data is then directed to a computer readable medium

Claims

1. A method for managing encrypted data on a computer readable medium comprising:

receiving a quantum of data;

determining an encryption key;

encrypting the quantum of data according to the encryption key at a volume level when the quantum of data comprises a quantum of volume data;

encrypting the quantum of data according to the encryption key at a file level when the quantum of data comprises a quantum of file data; and

directing the encrypted data to a first computer readable medium.

2. The method of claim 1 wherein determining an encryption key comprises:

receiving a user access key;

retrieving an encrypted volume key from a computer readable medium; and

decrypting the encrypted volume key according to the user access key.

3. The method of claim 1 wherein determining an encryption key comprises retrieving a temporal key from a memory when a quantum of data comprises at least one of a temporary file, a transient volume and a swap volume.

4. The method of claim 1 wherein determining an encryption key comprises:

receiving a user access key;

retrieving an encrypted file key from a computer readable medium; and

decrypting the encrypted file key according to the user access key.

5. The method of claim 1 further comprising:

receiving a file creation directive;

creating a file encryption key;

receiving a user access key; and

encrypting the file encryption key according to the user access key.

6. The method of claim 5 further comprising:

receiving one or more recovery keys; and

encrypting the file encryption key according to the one or more recovery keys.

7. The method of claim 1 further comprising:

receiving a volume creation directive;

creating a volume encryption key;

receiving a user access key; and

encrypting the volume encryption key according to the user access key.

8. The method of claim 7 further comprising:

receiving one or more recovery keys; and

encrypting the volume encryption key according to the one or more recovery keys.

9. The method of claim 1 wherein directing the encrypted data to a first computer readable medium comprises directing the encrypted data to at least one of a local physical file system, a local temporary file system and a remote file system.

10. The method of claim 1 further comprising:

receiving a request for a quantum of data;

retrieving from the computer readable medium a quantum of data according to the request;

determining a decryption key;

decrypting the quantum of data at a volume level when the quantum of data comprises a quantum of volume data;

decrypting the quantum of data at a file level when the quantum of data comprises a quantum of file data; and

providing the decrypted data in response to the request.

11. The method of claim 10 wherein determining a decryption key comprises:

receiving a user access key;

retrieving an encrypted volume key from a computer readable medium; and

decrypting the encrypted volume key according to the user access key.

12. The method of claim 10 wherein determining a decryption key comprises retrieving a temporal key from a memory when a quantum of data comprises at least one of a temporary file, a transient volume and a swap volume.

13. The method of claim 10 wherein determining a decryption key comprises:

receiving a user access key;

retrieving an encrypted file key from a computer readable medium; and

decrypting the encrypted file key according to the user access key.

14. A system for managing data on a computer readable medium in an encrypted manner comprising:

processor capable of executing an instruction sequence;

media interface unit capable of directing data to and retrieving data from a computer readable medium;

memory capable of storing one or more instruction sequences and further capable of storing data;

one or more instruction sequences stored in the memory including;

data management module that, when executed by the processor, minimally causes the processor to receive a quantum of data from a executing process;

encryption module that, when executed by the processor, minimally causes the processor to;

determine an encryption key for the received quantum of data;

encrypt the quantum of data at a volume level when the quantum of data comprises volume data;

encrypt the quantum of data at a file level when the quantum of data comprises file data;

load-store module that, when executed by the processor, minimally causes the processor to direct the encrypted quantum of data to a media driver module.

15. The system of claim 14 wherein the encryption module causes the processor to determine an encryption key by minimally causing the processor to:

receive a user access key from the executing process;

retrieve an encrypted volume key from a volume key table; and

decrypt the encrypted volume key according to the received user access key.

16. The system of claim 14 wherein the encryption module causes the processor to determine an encryption key by minimally causing the processor to retrieve a temporal key from a temporal key table when the quantum of data comprises at least one of a temporary file, a transient volume and a swap volume.

17. The system of claim 14 wherein the encryption module causes the processor to determine an encryption key by minimally causing the processor to:

receive a user access key from the executing process;

retrieve an encrypted file key from a file key table; and

decrypt the encrypted file key according to the received user access key.

18. The system of claim 14 wherein the encryption module further minimally causes the processor to:

receive a file creation directive from the executing process;

create a file encryption key;

receive a user access key;

encrypt the file encryption key according to the user access key; and

store the encrypted file encryption key in a file key table.

19. The system of claim 18 wherein the encryption module further minimally causes the processor to:

generate a recovery key;

encrypt the file encryption key according to the recovery key; and

store the encrypted file encryption key in the file key table.

20. The system of claim 14 wherein the encryption module further minimally causes the processor to:

receive a volume creation directive from the executing process;

create a volume encryption key;

receive a user access key;

encrypt the volume encryption key according to the user access key; and

store the encrypted volume encryption key in a volume key table.

21. The system of claim 20 wherein the encryption module further minimally causes the processor to:

retrieve a recovery key;

encrypt the volume encryption key according to the recovery key; and

store the encrypted volume encryption key in the volume key table.

22. The system of claim 14 further comprising a local temporary file module that, when executed by the processor, minimally causes the processor to store the encrypted quantum of data in the memory.

23. The system of claim 14 wherein the media interface comprises a computer readable medium controller further comprising a local file module that, when executed by the processor, minimally causes the processor to direct the encrypted quantum of data to the computer readable medium controller.

24. The system of claim 14 wherein the media interface comprises a network interface further comprising a protocol stack that, when executed by the processor, minimally causes the processor to establish a communications connection with a remote file system using the network interface and further comprising a remote file mode that, when executed by the processor, minimally causes the processor to establish a communications channel with a remote file system using the protocol stack and direct the encrypted quantum of data to the remote file system using the established communications connection.

25. The system of claim 14 further comprising a decryption module that, when executed by the processor, minimally causes the processor to:

determine a decryption key for a quantum of encrypted data; and

decrypt a quantum of encrypted data according to the determined decryption key

wherein the load-store module, when executed by the processor, further minimally causes the processor to dispatch to the media driver a request for a quantum of encrypted data and wherein the data management module further minimally causes the processor to;

receive a request for a quantum of data from the executing module;

execute the load-store module in order to retrieve a quantum of encrypted data from the media driver;

execute the decryption module in order to decrypt a quantum of encrypted data; and

provide the decrypted quantum of data to the executing process.

26. The system of claim 25 wherein the decryption module causes the processor to determine a decryption key by minimally causing the processor to:

receive a user access key from the executing process;

retrieve an encrypted volume key from a volume key table; and

decrypt the encrypted volume key according to the received user access key.

27. The system of claim 25 wherein the decryption module causes the processor to determine a decryption key by minimally causing the processor to retrieve a temporal key from a temporal key table when the quantum of data comprises at least one of a temporary file, a transient volume and a swap volume.

28. The system of claim 25 wherein the decryption module causes the processor to determine a decryption key by minimally causing the processor to:

receive a user access key from the executing process;

retrieve an encrypted file key from a file key table; and

decrypt the encrypted file key according to the received user access key.

29. A computer readable medium having imparted thereon one or more instruction sequences for managing data on a computer readable medium in an encrypted manner comprising:

data management module that, when executed by a processor, minimally causes a processor to receive a quantum of data from an executing process;

encryption module that, when executed by a processor, minimally causes a processor to;

determine an encryption key for the received quantum of data;

encrypt the quantum of data at a volume level when the quantum of data comprises volume data;

encrypt the quantum of data at a file level when the quantum of data comprises file data;

load-store module that, when executed by a processor, minimally causes a processor to direct the encrypted quantum of data to a media driver module.

30. The computer readable medium of claim 29 wherein the encryption module causes a processor to determine an encryption key by minimally causing the processor to:

receive a user access key from the executing process;

retrieve an encrypted volume key from a volume key table; and

decrypt the encrypted volume key according to the received user access key.

31. The computer readable medium of claim 29 wherein the encryption module causes a processor to determine an encryption key by minimally causing a processor to retrieve a temporal key from a temporal key table when the quantum of data comprises at least one of a temporary file, a transient volume and a swap volume.

32. The computer readable medium of claim 29 wherein the encryption module causes a processor to determine an encryption key by minimally causing a processor to:

receive a user access key from the executing process;

retrieve an encrypted file key from a file key table; and

decrypt the encrypted file key according to the received user access key.

33. The computer readable medium of claim 29 wherein the encryption module further minimally causes a processor to:

receive a file creation directive from an executing process;

create a file encryption key;

receive a user access key;

encrypt the file encryption key according to the user access key; and

store the encrypted file encryption key in a file key table.

34. The computer readable medium of claim 33 wherein the encryption module further minimally causes a processor to:

generate a recovery key;

encrypt the file encryption key according to the recovery key; and

store the encrypted file encryption key in the file key table.

35. The computer readable medium of claim 29 wherein the encryption module further minimally causes a processor to:

receive a volume creation directive from an executing process;

create a volume encryption key;

receive a user access key;

encrypt the volume encryption key according to the user access key; and

store the encrypted volume encryption key in a volume key table.

36. The computer readable medium of claim 35 wherein the encryption module further minimally causes a processor to:

generate a recovery key;

encrypt the volume encryption key according to the recovery key; and

store the encrypted volume encryption key in the volume key table.

37. The computer readable medium of claim 29 further comprising a decryption module that, when executed by a processor, minimally causes a processor to:

determine a decryption key for a quantum of encrypted data; and

decrypt a quantum of encrypted data according to the determined decryption key wherein the load-store module, when executed by a processor, further minimally causes the processor to dispatch to a media driver a request for a quantum of encrypted data and wherein the data management module further minimally causes a processor to;

receive a request for a quantum of data from the executing module;

execute the load-store module in order to retrieve a quantum of encrypted data from a media driver;

execute the decryption module in order to decrypt a quantum of encrypted data; and

provide the decrypted quantum of data to an executing process.

38. The computer readable medium of claim 37 wherein the decryption module causes a processor to determine a decryption key by minimally causing a processor to:

receive a user access key from the executing process;

retrieve an encrypted volume key from a volume key table; and

decrypt the encrypted volume key according to the received user access key.

39. The computer readable medium of claim 37 wherein the decryption module causes a processor to determine a decryption key by minimally causing a processor to retrieve a temporal key from a temporal key table when the quantum of data comprises at least one of a temporary file, a transient volume and a swap volume.

40. The computer readable medium of claim 37 wherein the decryption module causes a processor to determine a decryption key by minimally causing a processor to:

receive a user access key from the executing process;

retrieve an encrypted file key from a file key table; and

decrypt the encrypted file key according to the received user access key.

41. A system for managing data on a computer readable medium in an encrypted manner comprising:

means for determining an encryption key for a quantum of data;

means for determining a type for the quantum of data;

means for encrypting the quantum of data at a volume level when said data comprises volume data; and

means for encrypting the quantum of data at a file level when said data comprises file data.