RECOVERING REMNANT ENCRYPTED DATA ON A REMOVABLE STORAGE MEDIA

• US 20080065881A1
• Filed: 09/07/2006
• Published: 03/13/2008
• Est. Priority Date: 09/07/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Karp, James Mitchell, Jaquette, Glen Alan, Greco, Paul Merrill, Dawson, Erika Marianna
• Granted Patent: US 7,783,882 B2
• Time in Patent Office: Days
• US Class Current: 713/165
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

Provided are a method, system, and article of manufacture recovering remnant encrypted data on a removable storage media. An end of data (EOD) marker is detected on a removable storage media, wherein a first encryption key is associated with data preceding the EOD marker. Following the EOD marker, an identifier of a second encryption key associated with data following the EOD marker is read in response to detecting the EOD marker. The identifier is used to access the second encryption key and the second encryption key is used to decrypt the data following the EOD marker.

Claims

1. A method, comprising:

detecting an end of data (EOD) marker on a removable storage media, wherein a first encryption key is associated with data preceding the EOD marker;

reading, following the EOD marker, an identifier of a second encryption key associated with data following the EOD marker in response to detecting the EOD marker;

using the identifier to access the second encryption key; and

using the second encryption key to decrypt the data following the EOD marker.

2. The method of claim 1, wherein using the identifier to obtain the second encryption key comprises:

maintaining in a key file stored in the removable storage media encryption keys currently and previously used encryption keys to encrypt data on the removable storage media, wherein the identifier is used to access the second encryption key from the key file.

3. The method of claim 2, further comprising:

receiving selection of a disable mode; and

disabling the maintaining of the previously used encryption keys in the key file, wherein encrypted data following the EOD marker cannot be decrypted in the disable mode.

4. The method of claim 2, wherein a storage drive performs the operations of detecting the EOD marker, reading the identifier of the second encryption key, using the identifier to access the second encryption key, using the second encryption key to decrypt the data, and maintaining the key file on the removable storage media.

5. The method of claim 4, wherein the encryption keys in the key file are encrypted with at least one key encryption key (KEK), wherein the accessed second encryption key is encrypted with one KEK, further comprising:

sending, by the storage drive, the encrypted second encryption key to a key server;

receiving, by the storage drive, from the key server an unencrypted second encryption key, wherein the unencrypted second encryption key is used to decrypt the data following the EOD marker.

6. The method of claim 2, wherein a key index is included in each block of data written to the storage media, wherein the identifier of the second encryption key is read from a first key index following the EOD marker, and wherein the identifier comprises an index to the second encryption key in the key file.

7. The method of claim 1, wherein using the identifier of the second encryption key to access the second encryption key comprises:

sending the identifier to a key manager; and

receiving the second encryption key identified by the identifier from the key manager.

8. The method of claim 1, wherein the EOD marker comprises a first EOD marker, further comprising:

detecting a subsequent EOD marker on the storage media following the first EOD marker;

reading, following the subsequent EOD marker, an identifier of a third encryption key associated with data following the subsequent first EOD marker;

using the identifier of the third encryption key to access the third encryption key; and

using the third encryption key to decrypt the data following the subsequent EOD marker.

9. A system coupled to a removable storage media, comprising:

data recovery code operable to perform operations, the operations comprising;

detecting an end of data (EOD) marker on a removable storage media, wherein a first encryption key is associated with data preceding the EOD marker;

reading, following the EOD marker, an identifier of a second encryption key associated with data following the EOD marker in response to detecting the EOD marker; and

using the identifier to access the second encryption key; and

an encryption engine operable to use the second encryption key to decrypt the data following the EOD marker.

10. The system of claim 9, wherein using the identifier to obtain the second encryption key comprises:

maintaining in a key file stored in the removable storage media encryption keys currently and previously used encryption keys to encrypt data on the removable storage media, wherein the identifier is used to access the second encryption key from the key file.

11. The system of claim 10, wherein the operations performed by the data recovery code further comprise:

receiving selection of a disable mode; and

disabling the maintaining of the previously used encryption keys in the key file, wherein encrypted data following the EOD marker cannot be decrypted in the disable mode.

12. The system of claim 10, wherein a storage drive performs the operations of detecting the EOD marker, reading the identifier of the second encryption key, using the identifier to access the second encryption key, using the second encryption key to decrypt the data, and maintaining the key file on the removable storage media.

13. The system of claim 12, wherein the encryption keys in the key file are encrypted with at least one key encryption key (KEK), wherein the accessed second encryption key is encrypted with one KEK, further comprising:

key management code enabled to perform operations comprising;

sending, by the storage drive, the encrypted second encryption key to a key server; and

receiving, by the storage drive, from the key server an unencrypted second encryption key, wherein the unencrypted second encryption key is used to decrypt the data following the EOD marker.

14. The system of claim 10, wherein a key index is included in each block of data written to the storage media, wherein the identifier of the second encryption key is read from a first key index following the EOD marker, and wherein the identifier comprises an index to the second encryption key in the key file.

15. The system of claim 9, wherein using the identifier of the second encryption key to access the second encryption key comprises:

sending the identifier to a key manager; and

receiving the second encryption key identified by the identifier from the key manager.

16. The system of claim 9, wherein the EOD marker comprises a first EOD marker, wherein the data recovery code is further operable to perform:

detecting a subsequent EOD marker on the storage media following the first EOD marker;

reading, following the subsequent EOD marker, an identifier of a third encryption key associated with data following the subsequent first EOD marker;

using the identifier of the third encryption key to access the third encryption key; and

wherein the encryption engine is further operable to use the third encryption key to decrypt the data following the subsequent EOD marker.

17. The system of claim 9, further comprising:

at least one storage drive, wherein the encryption engine and the data recovery code are included within each instance of the storage drive;

a storage array including a plurality of removable storage media capable;

an autochanger mechanism enabled to transfer removable storage media in the storage array to the at least one storage drive to couple the removable storage media to the at least one storage drive; and

a controller to control operations of the storage drive and the autochanger mechanism.

18. An article of manufacture including code to cause operations with respect to a removable storage media, the operations comprising:

detecting an end of data (EOD) marker on the removable storage media, wherein a first encryption key is associated with data preceding the EOD marker;

reading, following the EOD marker, an identifier of a second encryption key associated with data following the EOD marker in response to detecting the EOD marker;

using the identifier to access the second encryption key; and

using the second encryption key to decrypt the data following the EOD marker.

19. The article of manufacture of claim 18, wherein using the identifier to obtain the second encryption key comprises:

maintaining in a key file stored in the removable storage media encryption keys currently and previously used encryption keys to encrypt data on the removable storage media, wherein the identifier is used to access the second encryption key from the key file.

20. The article of manufacture of claim 19, further comprising:

receiving selection of a disable mode; and

disabling the maintaining of the previously used encryption keys in the key file, wherein encrypted data following the EOD marker cannot be decrypted in the disable mode.

21. The article of manufacture of claim 19, wherein a storage drive performs the operations of detecting the EOD marker, reading the identifier of the second encryption key, using the identifier to access the second encryption key, using the second encryption key to decrypt the data, and maintaining the key file on the removable storage media.

22. The article of manufacture of claim 21, wherein the encryption keys in the key file are encrypted with at least one key encryption key (KEK), wherein the accessed second encryption key is encrypted with one KEK, wherein the operations further comprise:

sending, by the storage drive, the encrypted second encryption key to a key server;

receiving, by the storage drive, from the key server an unencrypted second encryption key, wherein the unencrypted second encryption key is used to decrypt the data following the EOD marker.

23. The article of manufacture of claim 19, wherein a key index is included in each block of data written to the storage media, wherein the identifier of the second encryption key is read from a first key index following the EOD marker, and wherein the identifier comprises an index to the second encryption key in the key file.

24. The article of manufacture of claim 18, wherein using the identifier of the second encryption key to access the second encryption key comprises:

sending the identifier to a key manager; and

receiving the second encryption key identified by the identifier from the key manager.

25. The article of manufacture of claim 18, wherein the EOD marker comprises a first EOD marker, wherein the operations further comprise:

detecting a subsequent EOD marker on the storage media following the first EOD marker;

reading, following the subsequent EOD marker, an identifier of a third encryption key associated with data following the subsequent first EOD marker;

using the identifier of the third encryption key to access the third encryption key; and

using the third encryption key to decrypt the data following the subsequent EOD marker.