CONFIGURING A STORAGE DRIVE TO COMMUNICATE WITH ENCRYPTION AND KEY MANAGERS

• US 20080065882A1
• Filed: 09/07/2006
• Published: 03/13/2008
• Est. Priority Date: 09/07/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Goodman, Brian Gerard, Jaquette, Glen Alan, Greco, Paul Merrill, Jesionowski, Leonard George
• Granted Patent: US 7,877,603 B2
• Time in Patent Office: Days
• US Class Current: 713/165
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00

Abstract

Provided are a method, system, and article of manufacture for configuring a storage drive to communicate with encryption and key managers. A storage drive receives a request to access a coupled removable storage media for drive operations. The storage drive obtains encryption status for the coupled removable storage media from an encryption manager. The storage drive determines from the obtained encryption status whether to encrypt the coupled removable storage media to access. The storage drive obtains at least one key from a key manager in response to determining to encrypt with respect to the coupled removable storage media. The storage drive performs data operations using the at least one key to encrypt data.

Claims

1. A method, comprising:

receiving, at a storage drive, a request to access a coupled removable storage media for drive operations;

obtaining, by the storage drive, encryption status for the coupled removable storage media from an encryption manager;

determining, by the storage drive, from the obtained encryption status whether to encrypt the coupled removable storage media to access;

obtaining, by the storage drive, at least one key from a key manager in response to determining to encrypt with respect to the coupled removable storage media; and

performing, by the storage drive, data operations using the at least one key to encrypt data.

2. The method of claim 1, wherein the encryption manager is a member of a set of encryption managers comprising a host application, a host system component, and a storage library.

3. The method of claim 2, wherein the storage drive obtains the encryption status from the host application and host system component over a first communication interface and obtains the encryption status from the storage library over a second communication interface.

4. The method of claim 1, wherein the key manager is associated with a host application, a host system component or a storage library.

5. The method of claim 4, wherein the storage drive obtains the at least one key from the key manager associated with the host application and the host system component over a first communication interface and obtains the at least one key from the key manager associated with the storage library over a second communication interface.

6. The method of claim 1, wherein the storage drive obtains the encryption status by requesting the encryption status from the encryption manager.

7. The method of claim 1, wherein the storage drive obtains the encryption status from the encryption manager without soliciting the encryption status from the encryption manager.

8. The method of claim 1, wherein the storage drive obtains the at least one key by requesting the at least one key from the key manager.

9. The method of claim 1, wherein the storage drive obtains the at least one key from the key manager without soliciting the at least one key from the key manager.

10. The method of claim 1, wherein the at least one key is obtained from the key manager by using an encryption manager as a proxy for the key manager.

11. The method of claim 1, wherein the encryption manager comprises the key manager.

12. The method of claim 1, further comprising:

receiving, at the storage drive, drive configuration information indicating at least one encryption method, wherein each encryption method indicates an encryption manager that provides the encryption status; and

storing, by the storage drive, the received configuration information in the storage drive.

13. The method of claim 12, wherein the configuration information indicates a hierarchical encryption manager ordering of encryption managers, wherein the available encryption manager having a highest order in the hierarchical encryption manager ordering provides the encryption status.

14. The method of claim 1, further comprising:

receiving, at the storage drive configuration information indicating at least one key path, wherein each key path indicates the key manager that provides the at least one key; and

storing, by the storage drive, the received configuration information in the storage drive.

15. The method of claim 14, wherein the configuration information indicates a hierarchical key path ordering of key paths, wherein the at least one key is obtained from the available key manager having a highest order in the hierarchical key path ordering.

16. A system in communication with an encryption manager and key manager, and capable of being coupled to a removable storage media, comprising:

an Input/Output manager enabled to receive a request to access the coupled removable storage media for drive operations;

key management code enabled to perform operations comprising;

obtaining encryption status for the coupled removable storage media from an encryption manager;

determining from the obtained encryption status whether to encrypt the coupled removable storage media to access;

obtaining at least one key from a key manager in response to determining to encrypt with respect to the coupled removable storage media; and

an encryption engine enabled to perform data operations using the at least one key to encrypt data.

17. The system of claim 16, wherein the encryption manager is a member of a set of encryption managers comprising a host application, a host system component, and a storage library.

18. The system of claim 17, further comprising:

a first communication interface through which the encryption status from the host application and host system component is obtained; and

a second communication interface through which the encryption status from the storage library is obtained.

19. The system of claim 16, wherein the key manager is associated with a host application, a host system component or a storage library.

20. The system of claim 19, further comprising:

a first communication interface through which the at least one key from the key manager associated with the host application and the host system component is obtained; and

a second communication interface through which the at least one key from the key manager associated with the storage library is obtained.

21. The system of claim 16, wherein the key management code obtains the encryption status by requesting the encryption status from the encryption manager.

22. The system of claim 16, wherein the key management code obtains the encryption status from the encryption manager without soliciting the encryption status from the encryption manager.

23. The system of claim 16, wherein the key management code obtains the at least one key by requesting the at least one key from the key manager.

24. The system of claim 16, wherein the key management code obtains the at least one key from the key manager without soliciting the at least one key from the key manager.

25. The system of claim 16, wherein the at least one key is obtained from the key manager by using one of the encryption managers as a proxy for the key manager.

26. The system of claim 16, wherein the encryption manager comprises the key manager.

27. The system of claim 16, wherein the key management code is further enabled to perform:

receiving configuration information indicating at least one encryption method, wherein each encryption method indicates an encryption manager that provides the encryption status; and

storing the received configuration information in the storage drive.

28. The system of claim 27, wherein the configuration information indicates a hierarchical encryption manager ordering of encryption managers, wherein the available encryption manager having a highest order in the hierarchical encryption manager ordering provides the encryption status.

29. The system of claim 16, wherein the key management code is further enabled to perform:

receiving configuration information indicating at least one key path, wherein each key path indicates the key manager that provides the at least one key; and

causing the storing of the received configuration information in the storage drive.

30. The system of claim 29, wherein the configuration information indicates a hierarchical key path ordering of key paths, wherein the at least one key is obtained from the available key manager having a highest order in the hierarchical key path ordering.

31. The system of claim 16, further comprising:

at least one storage drive, wherein the encryption engine, I/O manager, and key management code are included within each instance of the storage drive;

a storage array including a plurality of removable storage media capable;

an autochanger mechanism enabled to transfer removable storage media in the storage array to the at least one storage drive to couple the removable storage media to the at least one storage drive; and

a controller to control operations of the storage drive and the autochanger mechanism.

32. An article of manufacture including code enabled to perform operations with respect to an encryption manager, key manager, and removable storage media, the operations comprising:

receiving a request to access a coupled removable storage media for drive operations;

obtaining encryption status for the removable storage media from an encryption manager;

determining from the obtained encryption status whether to encrypt the coupled removable storage media to access;

obtaining at least one key from a key manager in response to determining to encrypt with respect to the coupled removable storage media; and

performing data operations using the at least one key to encrypt data.

33. The article of manufacture of claim 32, wherein the encryption manager is a member of a set of encryption managers comprising a host application, a host system component, and a storage library.

34. The article of manufacture of claim 33, wherein the encryption status is obtained from the host application and host system component over a first communication interface and the encryption status is obtained from the storage library over a second communication interface.

35. The article of manufacture of claim 32, wherein the key manager is associated with a host application, a host system component or a storage library.

36. The article of manufacture of claim 35, wherein the at least one key is obtained from the key manager associated with the host application and the host system component over a first communication interface and wherein the at least one key is obtained from the key manager associated with the storage library over a second communication interface.

37. The article of manufacture of claim 32, wherein the encryption status is obtained by requesting the encryption status from the encryption manager.

38. The article of manufacture of claim 32, wherein the encryption status is obtained from the encryption manager without soliciting the encryption status from the encryption manager.

39. The article of manufacture of claim 32, wherein the at least one key is obtained by requesting the at least one key from the key manager.

40. The article of manufacture of claim 32, wherein the at least one key is obtained from the key manager without soliciting the at least one key from the key manager.

41. The article of manufacture of claim 32, wherein the at least one key is obtained from the key manager by using an encryption manager as a proxy for the key manager.

42. The article of manufacture of claim 32, wherein the encryption manager comprises the key manager.

43. The article of manufacture of claim 32, wherein the operations further comprise:

receiving drive configuration information indicating at least one encryption method, wherein each encryption method indicates an encryption manager that provides the encryption status; and

storing the received configuration information in the storage drive.

44. The article of manufacture of claim 43, wherein the configuration information indicates a hierarchical encryption manager ordering of encryption managers, wherein the available encryption manager having a highest order in the hierarchical encryption manager ordering provides the encryption status.

45. The article of manufacture of claim 32, wherein the operations further comprise:

receiving configuration information indicating at least one key path, wherein each key path indicates the key manager that provides the at least one key; and

storing the received configuration information in the storage drive.

46. The article of manufacture of claim 45, wherein the configuration information indicates a hierarchical key path ordering of key paths, wherein the at least one key is obtained from the available key manager having a highest order in the hierarchical key path ordering.