RENEWAL MANAGEMENT FOR DATA ITEMS

• US 20090245519A1
• Filed: 03/26/2009
• Published: 10/01/2009
• Est. Priority Date: 03/28/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hu, Xiao-Yu, Cachin, Christian, Pawlitzek, Rene A., Haas, Robert, Droz, Patrick, Iliadis, Ilias
• Granted Patent: US 8,681,990 B2
• Time in Patent Office: Days
• US Class Current: 380/277
• CPC Class Codes: G06F 11/1461 Backup scheduling policy
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

A system, method apparatus, and computer readable medium for managing renewal of a dynamic set of data items. Each data item has an associated renewal deadline, in a data item management system. A renewal schedule allocates to each data item a renewal interval for renewal of the data item. On addition of a new data item, if a potential renewal interval having a duration required for renewal of the data item, and having an ending at the renewal deadline for that item does not overlap a time period in the schedule during which the system is busy, the renewal schedule is automatically updated by allocating the potential renewal interval to the new data item. If the potential renewal interval does overlap a busy period, the renewal schedule is automatically updated by selecting an earlier renewal interval for at least one data item in the set.

Claims

1. A method of managing renewal of a dynamic set of data items in a data item management system, each data item having an associated renewal deadline, the method comprising:

maintaining in memory of the data item management system a renewal schedule allocating to each data item in the set a renewal interval for renewal of the data item by the management system;

on addition of a new data item to the set, if a potential renewal interval having a duration required for renewal of the new data item by the management system and having an ending at the renewal deadline for the new data item, does not overlap a time period in the schedule during which the management system is busy, automatically updating the renewal schedule to allocate the potential renewal interval to the new data item;

or

if the potential renewal interval does overlap the time period, automatically updating the renewal schedule by selecting an earlier renewal interval for at least one data item in the set and allocating a renewal interval of the required duration to the new data item such that no data item has a renewal interval extending beyond the associated renewal deadline or overlapping the time period; and

initiating renewal of each data item automatically on commencement of the renewal interval allocated in the schedule to the new data item.

2. The method according to claim 1 further comprising:

on addition of the new data item to the set, applying an update technique comprising determining from the schedule whether the potential renewal interval overlaps the time period; and

if the potential renewal interval overlaps the time period, automatically updating the renewal schedule by selecting the latest earlier interval of the required duration which does not overlap the time period and allocating that interval as the renewal interval for the new data item.

3. The method according to claim 1 further comprising:

on addition of the new data item to the set, applying an update technique comprising automatically updating the renewal schedule by allocating the potential renewal interval to the new data item, and determining from the schedule whether the potential renewal interval overlaps the time period, and if the potential renewal interval overlaps the time period;

(a) moving earlier by the overlap amount another allocated renewal interval which intersects the potential renewal interval by that overlap amount;

(b) if the moved interval overlaps the time period, repeating step (a) for another allocated renewal interval which intersects the moved interval; and

(c) repeating step (b) until no renewal interval overlaps the time period.

4. The method according to claim 1 further comprising:

on addition of a new data item to the set, applying one of first and second update techniques, and adaptively switching between the first and second update techniques in dependence on the number of data items in the set such that the second update technique is applied when the number exceeds a predetermined threshold;

wherein the first update technique comprises determining from the schedule whether the potential renewal interval overlaps the time period and, if the potential renewal interval overlaps the time period, automatically updating the renewal schedule by selecting the latest earlier interval of the required duration which does not overlap the time period and allocating that interval as the renewal interval for the new data item;

and wherein the second update technique comprises automatically updating the renewal schedule by allocating the potential renewal interval to the new data item, and determining from the schedule whether the potential renewal interval overlaps the time period, and if the potential renewal interval overlaps the time period

(a) moving earlier by the overlap amount another allocated renewal interval which intersects the potential renewal interval by that overlap amount,

(b) if the interval moved overlaps the time period, repeating step (a) for another allocated renewal interval which intersects the moved interval, and

(c) repeating step (b) until no renewal interval overlaps the time period.

5. The method according to claim 1 wherein the management system is busy during an allocated renewal interval.

6. A method according to claim 1 wherein the management system is busy during any time period that is the intersection of a predetermined plurality of allocated renewal intervals.

7. A computer readable medium containing executable program instructions which when executed, implements the steps of a method according to claim 1.

8. A method of managing a dynamic set of cryptographic keys, each having an associated renewal deadline, the method comprising:

managing renewal of the set of keys by the method according to claim 1; and

renewing each key on commencement of the renewal interval allocated in the schedule to that key.

9. The method as claimed in claim 8 wherein the duration of renewal intervals is a predetermined constant.

10. A method of managing a dynamic set of data files in a data storage system wherein data files are encrypted using respective cryptographic keys, each having an associated renewal deadline such that renewal of a stored data file by decrypting the file using the key for that file is performed before the renewal deadline for that key, the method comprising:

managing renewal of the set of data files by the method according to claim 1; and

decrypting the data file using the key for that file on commencement of the renewal interval allocated in the schedule to the data file

11. The method according to claim 10 further comprising:

on commencement of the renewal interval allocated in the schedule to the data file, renewing the data file by decrypting the data file using the key for that file, encrypting the data file using a new key for that file and re-storing the file in the data storage system,

wherein the duration of the renewal interval allocated to each data file is sufficient for renewing of that data file.

12. The method according to claim 10 wherein the duration of the renewal interval allocated to each data file is dependent on the size of that data file.

13. A method of managing a dynamic set of data files, each having an associated renewal deadline, in a data storage system wherein renewal of a stored data file by reading and re-storing of the file is performed before the associated renewal deadline, the method comprising:

managing renewal of the set of data files by the method according to claim 1; and

reading and re-storing the data file in the data storage system on commencement of the renewal interval allocated in the schedule to the data file.

14. A method according to claim 13 wherein the duration of the renewal interval allocated to each data file is dependent on the size of that data file.

15. An apparatus for managing renewal of a dynamic set of data items in a data item management system, each data item having an associated renewal deadline, the apparatus comprising memory and control logic adapted for:

maintaining in the memory a renewal schedule allocating to each data item in the set a renewal interval for renewal of the data item by the management system;

on addition of a new data item to the set, if a potential renewal interval having a duration required for renewal of the new data item by the management system, and having an ending at the renewal deadline for the new data item, does not overlap a time period in the schedule during which the management system is busy, automatically updating the renewal schedule to allocate the potential renewal interval to the new data item;

or

if the potential renewal interval overlaps the time period, automatically updating the renewal schedule by selecting an earlier renewal interval for at least one data item in the set and allocating a renewal interval of the required duration to the new data item such that no data item has a renewal interval extending beyond the associated renewal deadline or overlapping the time period; and

initiating renewal of each data item by the management system on commencement of the renewal interval allocated in the schedule to that data item.

16. The apparatus according to claim 15 wherein the control logic is adapted for applying, on addition of a new data item to the set, an update technique comprising determining from the schedule whether the potential renewal interval overlaps the time period and, if the potential renewal interval overlaps the time period, automatically updating the renewal schedule by selecting the latest earlier interval of the required duration which does not overlap the time period and allocating that interval as the renewal interval for the new data item.

17. The apparatus according to claim 15 wherein the control logic is adapted for applying on addition of a new data item to the set, an update technique comprising automatically updating the renewal schedule by allocating the potential renewal interval to the new data item, and determining from the schedule whether the potential renewal interval overlaps the time period, and if the potential renewal interval overlaps the time period:

(a) moving earlier by the overlap amount another allocated renewal interval which intersects the potential renewal interval by that overlap amount;

(b) if the moved interval overlaps the time period, repeating step (a) for another allocated renewal interval which intersects the moved interval; and

(c) repeating step (b) until no renewal interval overlaps the time period.

18. The apparatus according to claim 15 wherein:

the control logic is adapted for applying, on addition of a new data item to the set, one of first and second update techniques, and switching between the first and second update techniques in dependence on the number of data items in the set such that the second update technique is applied when the number exceeds a predetermined threshold;

the first update technique comprising determining from the schedule whether the potential renewal interval overlaps the time period and, if so, automatically updating the renewal schedule by selecting the latest earlier interval of the required duration which does not overlap the time period, and allocating that interval as the renewal interval for the new data item; and

the second update technique comprising automatically updating the renewal schedule by allocating the potential renewal interval to the new data item, determining from the schedule whether the potential renewal interval overlaps the time period, and if the potential renewal interval overlaps the time period

(a) moving earlier by the overlap amount another allocated renewal interval which intersects the potential renewal interval by that overlap amount,

(b) if the interval moved overlaps the time period, repeating step (a) for another allocated renewal interval which intersects the moved interval, and

(c) repeating step (b) until no renewal interval overlaps the time period.

19. The apparatus according to claim 15 wherein the control logic is adapted such that the management system is busy during an allocated renewal interval.

20. The apparatus according to claim 15 wherein the control logic is adapted such that the management system is busy during any time period that is the intersection of a predetermined plurality of allocated renewal intervals.

21. A cryptographic key management system for managing a dynamic set of cryptographic keys, each having an associated renewal deadline, the system comprising:

memory for storing the keys;

a key controller for renewing keys; and

the renewal management apparatus according to claim 15 for managing renewal of the set of keys, the control logic being adapted to initiate renewal of a key by the key controller on commencement of the renewal interval allocated in the schedule to that key.

22. The system according to claim 21 wherein the duration of renewal intervals is a predetermined constant.

23. A data storage system for storing a dynamic set of data files encrypted using respective cryptographic keys, each having an associated renewal deadline such that renewal of a stored data file by decrypting the file using the key for that file is performed before the renewal deadline for that key, the system comprising:

data storage for storing the set of encrypted data files;

a mechanism adapted for encryption and decryption of data files and reading and writing of encrypted files in the data storage; and

the renewal management apparatus according to claim 15 for managing renewal of the set of data files, the control logic being adapted to initiate renewal of a data file by the mechanism by reading and decryption of the data file using the key for that file on commencement of the renewal interval allocated in the schedule to that data file.

24. The system according to claim 23 adapted such that on commencement of the renewal interval allocated in the schedule to a data file, the renewal of the file by the mechanism comprises reading and decryption of the data file using the key for that file, encryption of the data file using a new key for that file and writing of the encrypted file in the data storage, wherein the duration of the renewal interval allocated to each data file is sufficient for the renewal of that data file.

25. The system according to claim 23 wherein the control logic is adapted such that the duration of the renewal interval allocated to each data file is dependent on the size of that data file.

26. A tape library comprising the system according to claim 23 wherein the data storage comprises a plurality of magnetic tapes.

27. A data storage system for storing a dynamic set of data files, each having an associated renewal deadline, such that renewal of a stored data file by reading and re-storing of the file must be performed before the associated renewal deadline, the system comprising:

data storage for storing the set of data files;

a mechanism for reading and writing of data files in the data storage; and

the renewal management apparatus according to claim 15 for managing renewal of the set of data files, the control logic being adapted to initiate reading and rewriting of a data file in the data storage by the mechanism on commencement of the renewal interval allocated in the schedule to that data file.

28. The system according to claim 27 wherein the control logic is adapted such that the duration of the renewal interval allocated to each data file is dependent on the size of that data file.

29. A tape library comprising the system according to claim 27 wherein the data storage comprises a plurality of magnetic tapes.