REKEYING ENCRYPTION FOR REMOVABLE STORAGE MEDIA

• US 20080063210A1
• Filed: 09/07/2006
• Published: 03/13/2008
• Est. Priority Date: 09/07/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Goodman, Brian Gerard, Jaquette, Glen Alan, Jesionowski, Leonard George, Fisher, James Arthur
• Granted Patent: US 8,130,959 B2
• Time in Patent Office: Days
• US Class Current: 380/286
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

Provided are a method, system, and article of manufacture for rekeying encryption keys for removable storage media. A rekey request is received for a coupled removable storage media, wherein encryption on the coupled removable storage media uses a first key and wherein the rekey request indicates a second key. The first key and the second key are accessed in response to the rekey request. The first key is used to perform decryption for the coupled removable storage media and the second key is used to perform encryption for the coupled removable storage media.

Claims

1. A method of rekeying removable storage media, comprising:

receiving a rekey request for a coupled removable storage media, wherein encryption on the coupled removable storage media uses a first key and wherein the rekey request indicates a second key;

accessing the first key and the second key in response to the rekey request;

using the first key to perform decryption for the coupled removable storage media; and

using the second key to perform encryption for the coupled removable storage media.

2. The method of claim 1, wherein the data in the coupled removable storage media is encrypted with an encryption key, wherein the encryption key is further encrypted, wherein using the first key to perform decryption comprises decrypting the encryption key with the first key, and wherein using the second key to perform encryption comprises encrypting the encryption key with the second key.

3. The method of claim 2, wherein the encrypted encryption key is stored on the coupled removable storage media.

4. The method of claim 2, wherein the coupled removable storage media comprises a cartridge memory, and wherein the encrypted encryption key is stored in the cartridge memory.

5. The method of claim 2, wherein the second key is included in the rekey request.

6. The method of claim 1, wherein the rekey request is sent by a component that is a member of a set of components comprising a storage library, a host application, and a host system component.

7. The method of claim 1, wherein a storage drive performs the operations of receiving the rekey request and causing a key manager to performs the operations of accessing and using the first and second keys.

8. The method of claim 1, wherein the rekey request includes an identifier of the second key, further comprising:

sending a request for the first key to a remote key manager; and

sending a request to the remote key manager including the identifier of the second key for the second key, wherein the first and second keys are accessed from the remote key manager.

9. A method of rekeying media in an automated data storage library comprising:

selecting, by a storage library, a removable storage media for rekey, wherein the selected removable storage media is encrypted with a first key;

mounting, by the storage library, the removable storage media into a storage drive;

sending, by the storage library, a rekey request to the storage drive, wherein the storage drive and a key manager implement the rekey request;

receiving, by the storage library, a response from the storage drive indicating that the rekey operation performed in response to the rekey request completed.

10. The method of claim 9, wherein selecting a removable storage media for rekey comprises a selection from a user interface of the library.

11. The method of claim 9, wherein selecting a removable storage media for rekey is performed in response to a trigger that is a member of a set of triggers comprising:

a time based event, a time interval, a media export operation, a media access operation, media usage, an expired key, a compromised key, a revoked key, a change in security protocols, the removal of a key.

12. The method of claim 9, further comprising:

receiving a request to move the selected removable storage media before the response from the storage drive indicating that the rekey operation completed; and

queuing the move request for subsequent processing.

13. The method of claim 9, further comprising:

receiving a mount request directed to the storage drive before the response from the storage drive indicating that the rekey operation completed; and

queuing the mount request for subsequent processing.

14. A system of rekeying removable storage media, comprising:

I/O manager code enabled to receive a rekey request for a coupled removable storage media, wherein encryption on the coupled removable storage media uses a first key and wherein the rekey request indicates a second key;

key management code enabled to cause operations to be performed, the operations comprising;

accessing the first key and the second key in response to the rekey request;

using the first key to perform decryption for the coupled removable storage media; and

using the second key to perform encryption for the coupled removable storage media.

15. The system of claim 14, wherein the data in the coupled removable storage media is encrypted with an encryption key, wherein the encryption key is further encrypted, wherein using the first key to perform decryption comprises decrypting the encryption key with the first key, and wherein using the second key to perform encryption comprises encrypting the encryption key with the second key.

16. The system of claim 15, wherein the encrypted encryption key is stored on the coupled removable storage media.

17. The system of claim 15, wherein the coupled removable storage media comprises a cartridge memory, and wherein the encrypted encryption key is stored in the cartridge memory.

18. The system of claim 15, wherein the second key is included in the rekey request.

19. The system of claim 14, wherein the rekey request is sent by a component that is a member of a set of components comprising a storage library, a host application, and a host system component.

20. The system of claim 14, in communication with a key manager, and further comprising:

a storage drive, wherein the storage drive receives the rekey request and wherein the storage drive causes the key manager to perform the operations of accessing and using the first and second keys.

21. The system of claim 14, wherein the system comprises a storage drive and wherein the storage drive performs the operations of accessing and using the first and second keys.

22. The system of claim 14, in communication with a remote key manager, wherein the rekey request includes an identifier of the second key, wherein the key management code is further enabled to perform operations comprising:

sending a request for the first key to the remote key manager; and

sending a request to the remote key manager including the identifier of the second key for the second key, wherein the first and second keys are accessed from the remote key manager.

23. A system in communication with a storage drive capable of being coupled to removable storage media and key manager, comprising:

a library controller enabled to perform operations comprising;

selecting a removable storage media for rekey, wherein the selected removable storage media is encrypted with a first key;

mounting the selected removable storage media into a storage drive;

sending a rekey request to the storage drive, wherein the storage drive and a key manager implement the rekey request; and

receiving a response from the storage drive indicating that the rekey operation performed in response to the rekey request completed.

24. The system of claim 23, wherein selecting a removable storage media for rekey comprises a selection from a user interface of the library.

25. The system of claim 23, wherein selecting a removable storage media for rekey is performed in response to a trigger that is a member of a set of triggers comprising:

a time based event, a time interval, a media export operation, a media access operation, media usage, an expired key, a compromised key, a revoked key, a change in security protocols, the removal of a key.

26. The system of claim 23, wherein the library controller is further enabled to perform:

receiving a request to move the selected removable storage media before the response from the storage drive indicating that the rekey operation completed; and

queuing the move request for subsequent processing.

27. The system of claim 23, wherein the library controller is further enabled to perform:

receiving a mount request directed to the storage drive before the response from the storage drive indicating that the rekey operation completed; and

queuing the mount request for subsequent processing.

28. An article of manufacture including code to perform operations with respect to a removable storage media, the operations comprising:

receiving a rekey request for a coupled removable storage media, wherein encryption on the coupled removable storage media uses a first key and wherein the rekey request indicates a second key;

causing an accessing of the first key and the second key in response to the rekey request;

causing a using of the first key to perform decryption for the coupled removable storage media; and

causing a using of the second key to perform encryption for the coupled removable storage media.

29. The article of manufacture of claim 28, wherein the data in the coupled removable storage media is encrypted with an encryption key, wherein the encryption key is further encrypted, wherein using the first key to perform decryption comprises decrypting the encryption key with the first key, and wherein using the second key to perform encryption comprises encrypting the encryption key with the second key.

30. The article of manufacture of claim 29, wherein the encrypted encryption key is stored on the coupled removable storage media.

31. The article of manufacture of claim 29, wherein the coupled removable storage media comprises a cartridge memory, and wherein the encrypted encryption key is stored in the cartridge memory.

32. The article of manufacture of claim 29, wherein the second key is included in the rekey request.

33. The article of manufacture of claim 28, wherein the rekey request is sent by a component that is a member of a set of components comprising a storage library, a host application, and a host system component.

34. The article of manufacture of claim 28, wherein a storage drive performs the operations of receiving the rekey request and causing a key manager to perform the operations of accessing and using the first and second keys.

35. The article of manufacture of claim 28, wherein the rekey request includes an identifier of the second key, the operations further comprise:

sending a request for the first key to a remote key manager; and

sending a request to the remote key manager including the identifier of the second key for the second key, wherein the first and second keys are accessed from the remote key manager.

36. A article of manufacture including code to perform operations with respect to a storage drive, key manager, and coupled removable storage media, the operations comprising:

selecting a removable storage media for rekey, wherein the selected removable storage media is encrypted with a first key;

mounting the removable storage media into a storage drive;

sending a rekey request to the storage drive, wherein the storage drive and the key manager implement the rekey request; and

receiving a response from the storage drive indicating that the rekey operation performed in response to the rekey request completed.

37. The article of manufacture of claim 36, wherein selecting a removable storage media for rekey comprises a selection from a user interface.

38. The article of manufacture of claim 36, wherein selecting a removable storage media for rekey is performed in response to a trigger that is a member of a set of triggers comprising:

a time based event, a time interval, a media export operation, a media access operation, media usage, an expired key, a compromised key, a revoked key, a change in security protocols, the removal of a key.

39. The article of manufacture of claim 36, wherein the operations further comprise:

receiving a request to move the selected removable storage media before the response from the storage drive indicating that the rekey operation completed; and

queuing the move request for subsequent processing.

40. The article of manufacture of claim 36, wherein the operations further comprise:

receiving a mount request directed to the storage drive before the response from the storage drive indicating that the rekey operation completed; and

queuing the mount request for subsequent processing.