Encryption of data in storage systems

• US 20070256142A1
• Filed: 04/18/2006
• Published: 11/01/2007
• Est. Priority Date: 04/18/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hsu, Yu-Cheng, Kern, Robert, Hartung, Michael
• Granted Patent: US 7,752,676 B2
• Time in Patent Office: Days
• US Class Current: 726/28
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 2221/2107 File encryption

Abstract

Provided are a method, system and article of manufacture, wherein a request to access data is received from a requestor. A determination is made as to whether the requestor is authorized to access the data. In response to determining that the requestor is authorized to access the data, a determination is made as to whether the data is encrypted. An encryption key is requested from the requester, in response to determining that the data is not encrypted.

Claims

1. A method, comprising:

receiving, from a requestor, a request to access data;

determining whether the requestor is authorized to access the data;

determining whether the data is encrypted, in response to determining that the requestor is authorized to access the data; and

requesting an encryption key from the requester, in response to determining that the data is not encrypted.

2. The method of claim 1, further comprising:

receiving the encryption key from the requestor;

encrypting the data by using the encryption key; and

allowing the requestor to access the data.

3. The method of claim 2, further comprising:

requesting a decryption key, in response to subsequent requests for accessing the data.

4. The method of claim 1, wherein the request to access the data is made by addressing a logical unit, a file, a byte, a record, a block, a volume or an entire subsystem that includes the data.

5. The method of claim 1, wherein the data is legacy data that is stored in a storage unit, wherein the legacy data is maintained in an unencrypted state at least until the time an attempt is made to access the legacy data, and wherein data that is not legacy data is maintained in an encrypted state in the storage unit.

6. A system, comprising:

memory; and

processor coupled to the memory, wherein the processor executes;

receiving, from a requestor, a request to access data;

determining whether the requestor is authorized to access the data;

determining whether the data is encrypted, in response to determining that the requestor is authorized to access the data; and

requesting an encryption key from the requestor, in response to determining that the data is not encrypted.

7. The system of claim 6, wherein the processor further executes:

receiving the encryption key from the requester;

encrypting the data by using the encryption key; and

allowing the requestor to access the data.

8. The system of claim 7, wherein the processor further executes:

requesting a decryption key, in response to subsequent requests for accessing the data.

9. The system of claim 7, wherein the request to access the data is made by addressing a logical unit, a file, a byte, a record, a block, a volume or an entire subsystem that includes the data.

10. The system of claim 7, wherein the data is legacy data that is stored in a storage unit, wherein the legacy data is maintained in an unencrypted state at least until the time an attempt is made to access the legacy data, and wherein data that is not legacy data is maintained in an encrypted state in the storage unit.

11. A system, comprising:

a host; and

a storage subsystem, wherein the storage subsystem receives from the host a request to access data, wherein the storage subsystem determines whether the host is authorized to access the data, wherein the storage subsystem determines whether the data is encrypted, in response to determining that the host is authorized to access the data, and wherein the storage subsystem requests an encryption key, in response to determining that the data is not encrypted.

12. The system of claim 11, wherein the storage system further performs:

receiving the encryption key;

encrypting the data by using the encryption key; and

allowing the host to access the data.

13. The system of claim 12, wherein the storage system further performs:

requesting a decryption key, in response to subsequent requests for accessing the data.

14. The system of claim 11, wherein the request to access the data is made by addressing a logical unit, a file, a byte, a record, a block or a volume.

15. The system of claim 11, wherein the data is legacy data that is stored in the storage subsystem, wherein the legacy data is maintained in an unencrypted state at least until the time an attempt is made to access the legacy data, and wherein data that is not legacy data is maintained in an encrypted state in the storage subsystem.

16. An article of manufacture, wherein the article of manufacture includes code that when executed on a machine performs operations, the operations comprising:

receiving, from a requester, a request to access data;

determining whether the requester is authorized to access the data;

determining whether the data is encrypted, in response to determining that the requestor is authorized to access the data; and

requesting an encryption key from the requester, in response to determining that the data is not encrypted.

17. The article of manufacture of claim 16, the operations further comprising:

receiving the encryption key from the requestor;

encrypting the data by using the encryption key; and

allowing the requestor to access the data.

18. The article of manufacture of claim 17, the operations further comprising:

requesting a decryption key, in response to subsequent requests for accessing the data.

19. The article of manufacture of claim 16, wherein the request to access the data is made by addressing a logical unit, a file, a byte, a record, a block, a volume or an entire subsystem that includes the data.

20. The article of manufacture of claim 16, wherein the data is legacy data that is stored in a storage unit, wherein the legacy data is maintained in an unencrypted state at least until the time an attempt is made to access the legacy data, and wherein data that is not legacy data is maintained in an encrypted state in the storage unit.

21. A method for deploying computer infrastructure, comprising integrating computer-readable code into a controller, wherein the code in combination with the controller is capable of performing:

receiving, from a requester, a request to access data;

determining whether the requestor is authorized to access the data;

determining whether the data is encrypted, in response to determining that the requester is authorized to access the data; and

requesting an encryption key from the requestor, in response to determining that the data is not encrypted.

22. The method of claim 21, wherein the code in combination with the controller is further capable of performing:

receiving the encryption key from the requestor;

encrypting the data by using the encryption key; and

allowing the requestor to access the data.

23. The method of claim 22, wherein the code in combination with the controller is further capable of performing:

requesting a decryption key, in response to subsequent requests for accessing the data.

24. The method of claim 21, wherein the request to access the data is made by addressing a logical unit, a file, a byte, a record, a block, a volume or an entire subsystem that includes the data.

25. The method of claim 21, wherein the data is legacy data that is stored in a storage unit, wherein the legacy data is maintained in an unencrypted state at least until the time an attempt is made to access the legacy data, and wherein data that is not legacy data is maintained in an encrypted state in the storage unit.

26. A system, comprising:

means for receiving, from a requester, a request to access data;

means for determining whether the requestor is authorized to access the data;

means for determining whether the data is encrypted, in response to determining that the requester is authorized to access the data; and

means for requesting an encryption key from the requester, in response to determining that the data is not encrypted.

27. The system of claim 26, further comprising:

means for receiving the encryption key from the requestor;

means for encrypting the data by using the encryption key; and

means for allowing the requestor to access the data.

28. The system of claim 27, further comprising:

means for requesting a decryption key, in response to subsequent requests for accessing the data.

29. The system of claim 26, wherein the request to access the data is made by addressing a logical unit, a file, a byte, a record, a block, a volume or an entire subsystem that includes the data.

30. The system of claim 26, wherein the data is legacy data that is stored in a storage unit, wherein the legacy data is maintained in an unencrypted state at least until the time an attempt is made to access the legacy data, and wherein data that is not legacy data is maintained in an encrypted state in the storage unit.