KEY GENERATION AND RETRIEVAL USING KEY SERVERS

• US 20080065889A1
• Filed: 09/07/2006
• Published: 03/13/2008
• Est. Priority Date: 09/07/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Jaquette, Glen Alan, Greco, Paul Merrill, Hahn, Timothy James
• Granted Patent: US 7,953,978 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]

Abstract

Provided are techniques for key generation and retrieval. Unique identifiers of two or more key servers are stored, wherein each key server is capable of generating keys for encryption of data and of returning keys for decryption of data. A key request is received. A technique for selecting one of the key servers to which the key request is to be forwarded is identified. One of the key servers is selected using the identified technique. The key request is sent to the identified key server.

Claims

1. A computer-implemented method for key generation and retrieval, comprising:

storing unique identifiers of two or more key servers, wherein each key server is capable of generating keys for encryption of data and of returning keys for decryption of data;

receiving a key request;

identifying a technique for selecting one of the key servers to which the key request is to be forwarded;

selecting one of the key servers using the Identified technique; and

sending the key request to the selected key server.

2. The method of claim 1, wherein the key request is a request for a key to be generated to encrypt data.

3. The method of claim 1, wherein the key request is a request to retrieve an existing key used to decrypt a protected key.

4. The method of claim 1, wherein the unique identifiers are Internet Protocol (IP) addresses.

5. The method of claim 4, wherein the identified technique selects one of the key servers using an order of the IP addresses of the key servers.

6. The method of claim 4, wherein the identified technique selects one of the key servers based on local IP addresses and remote IP addresses, such that local IP addresses are selected before remote IP addresses.

7. The method of claim 1, wherein the identified technique selects one of the key servers using connection information, such that a last key server to which there was a successful connection is selected before other key servers.

8. The method of claim 1, wherein the identified technique selects one of the key servers based on load balancing among key servers.

9. The method of claim 1, wherein the key request is received from a data storage drive and further comprising:

receiving a response to the key request, from the selected key server; and

returning the response to the key request to the data storage drive.

10. The method of claim 9, wherein the key request asks for an encryption key and wherein the response includes an encryption key readable by the data storage drive and an encryption key readably by the selected key server.

11. The method of claim 9, wherein the key request asks for a first encryption key and provides a second encryption key readable by the key server and wherein the response includes an encryption key readable by the data storage drive.

12. The method of claim 9, wherein the key request asks to change a first encryption key and provides a second encryption key readable by the key server and wherein the response includes an encryption key readable by the key server.

13. The method of claim 9, wherein the data storage drive receives the response, wherein the response includes an encryption key, and wherein knowledge of the encryption key is removed from the data storage drive once the data storage drive has used that encryption key to encrypt data.

14. A computer program product comprising a computer useable medium including a computer readable program, wherein the computer readable program when executed on a computer causes the computer to:

store unique identifiers of two or more key servers, wherein each key server is capable of generating keys for encryption of data and of returning keys for decryption of data;

receive a key request;

identify a technique for selecting one of the key servers to which the key request is to be forwarded;

selecting one of the key servers using the identified technique; and

send the key request to the selected key server.

15. The computer program product of claim 14, wherein the key request is a request for a key to he generated to encrypt data.

16. The computer program product of claim 14, wherein the key request is a request to retrieve an existing key used to decrypt a protected key.

17. The computer program product of claim 14, wherein the unique identifiers are Internet Protocol (IP) addresses.

18. The computer program product of claim 17, wherein the identified technique selects one of the key servers using an order of the IP addresses of the key servers.

19. The computer program product of claim 17, wherein the identified technique selects one of the key servers based on local IP addresses and remote IP addresses, such that local IP addresses are selected, before remote IP addresses.

20. The computer program product of claim 14, wherein the identified technique selects one of the key servers using connection information, such that a last keyserver to which there was a successful connection is selected before other key servers.

21. The computer program product of claim 14, wherein the identified technique selects one of the key servers based on load balancing among key servers.

22. The computer program product of claim 14, wherein the key request is received from a data storage drive and the computer readable program when executed on a computer causes the computer to:

receiving a response to the key request from the selected key server; and

returning the response to the key request to the data storage drive.

23. The computer program product of claim 22, wherein the key request asks for an encryption key and wherein the response includes an encryption key readable by the data storage drive and an encryption key readably by the selected key server.

24. The computer program product of claim 22, wherein the key request asks for a first encryption key and provides a second encryption key readable by the key server and wherein the response includes an encryption key readable by the data storage drive.

25. The computer program product of claim 22, wherein the key request asks to change a first encryption key and provides a second encryption key readable by the key server and wherein the response includes an encryption key readable by the key server.

26. The computer program product of claim 22, wherein the data storage drive receives the response, wherein the response includes an encryption key, and wherein knowledge of the encryption key is removed from the data storage drive once the data storage drive has used that encryption key to encrypt data.

27. A system for key generation and retrieval, comprising:

logic capable of performing operations, the operations comprising;

storing unique identifiers of two or more key servers, wherein each key sewer is capable of generating keys for encryption of data and of returning keys for decryption of data;

receiving a key request;

identifying a technique for selecting one of the key servers to which the key request is to be forwarded;

selecting one of the key servers using the identified technique; and

sending the key request to the selected key server.

28. The system of claim 27, wherein the key request is a request for a key to be generated to encrypt data.

29. The system of claim 27, wherein tire key request is a request to retrieve an existing key used to decrypt a protected key.

30. The system of claim 27, wherein the unique identifiers are Internet Protocol (IP) addresses.

31. The system of claim 30, wherein the identified technique selects one of the key servers using an order of the IP addresses of the key servers.

32. The system of claim 30, wherein the identified technique selects one of the key servers based on local IP addresses and remote IP addresses, such that local IP addresses are selected before remote IP addresses.

33. The system of claim 27, wherein the identified technique selects one of the key servers using connection information, such that a last key server to which there was a successful connection is selected before other key servers.

34. The system of claim 27, wherein the identified technique selects one of the key servers based on load balancing among key servers.

35. The system of claim 27, wherein the key request is received from a data storage drive and the operations further comprise:

receiving a response to the key request from the selected key server; and

returning the response to the key request to the data storage drive.

36. The system of claim 35, wherein the key request asks for an encryption key and wherein the response includes an encryption key readable by the data storage drive and an encryption key readably by the selected key server.

37. The system of claim 35, wherein the key request asks for a first encryption key and provides a second encryption key readable by the key server and wherein the response includes an encryption key readable by the data storage drive.

38. The system of claim 35, wherein the key request asks to change a first encryption key and provides a second encryption key readable by the key server and wherein the response includes an encryption key readable by the key server.

39. The system of claim 35, wherein the data storage drive receives the response, wherein the response includes an encryption key, and wherein knowledge of the encryption key is removed from the data storage drive once the data storage drive has used that encryption key to encrypt data.

40. The system of claim 27, wherein the key request is received from a tape drive in a tape library.

41. The system of claim 27, wherein the logic is implemented in a proxy server.

42. The system of claim 27, wherein the logic is implemented in a data storage drive.