ADDING OR REPLACING DISKS WITH RE-KEY PROCESSING

• US 20130173930A1
• Filed: 12/29/2011
• Published: 07/04/2013
• Est. Priority Date: 01/31/2005
• Status: Active Grant

• Current Assignee: Eric T. Obligacion
• Original Assignee: Eric T. Obligacion
• Inventors: Obligacion, Eric T.
• Granted Patent: US 9,582,676 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0632 by initialisation or re-initialisation of storage systems
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

In a network of multiple storage devices, a storage device may become faulty and need to be replaced or additional capacity may need to be added through additional storage devices. When the storage devices communicate through a secure communications link using an encryption key for cryptographically splitting data, replacement or new storage devices may be re-keyed using an encryption key from an existing or prior storage device on the secure data network. After the storage device is re-keyed, the new or replacement storage device may continue to function on the secure data network without requiring changes to clients accessing the secure data network.

Claims

1. A method, comprising:

receiving a command, at a first storage device, to clone a second storage device;

copying data from the second storage device to the first storage device;

re-keying the first storage device with an encryption key matching an encryption key of the second storage device; and

establishing, by the first storage service, secure communications with the encryption key.

2. The method of claim 1, further comprising receiving a request from a client computing device through the secure communications.

3. The method of claim 1, in which the step of copying the data comprises cloning the second storage device on the first storage device.

4. The method of claim 3, in which the step of cloning comprises reconstructing cryptographically split data from the second storage device.

5. The method of claim 1, in which the first storage device is located remote from the second storage device.

6. The method of claim 1, in which the first storage device is a network attached storage (NAS) device.

7. A computer program product, comprising:

a non-transitory computer readable medium comprising;

code to receive a command, at a first storage device, to clone a second storage device;

code to copy data from the second storage device to the first storage device;

code to re-key the first storage device with an encryption key matching an encryption key of the second storage device; and

code to establish, by the first storage service, secure communications with the encryption key.

8. The computer program product of claim 7, in which the medium further comprises code to receive a request from a client computing device through the secure communications.

9. The computer program product of claim 7, in which the medium further comprises code to clone the second storage device on the first storage device.

10. The computer program product of claim 9, in which the medium further comprises code to reconstruct cryptographically split data from the second storage device.

11. The computer program product of claim 7, in which the first storage device is located remote from the second storage device.

12. The computer program product of claim 7, in which the first storage device is a network attached storage (NAS) device.

13. An apparatus, comprising:

a processor;

a memory connected to the processor;

a secure boot device connected to the processor; and

a network adapter connected to the processor,

in which the processor is configured;

to receive a command, through the network adapter, to clone a second storage device;

to copy data from the second storage device to the memory;

to re-key the secure boot device with an encryption key matching an encryption key of the second storage device; and

to establish, through the network adapter, secure communications with the encryption key.

14. The apparatus of claim 13, in which the processor is further configured to receive a request from a client computing device through the secure communications.

15. The apparatus of claim 13, in which the processor is further configured to clone the second storage device on the first storage device.

16. The apparatus of claim 15, in which the processor is further configured to reconstruct cryptographically split data from the second storage device.

17. The apparatus of claim 13, further comprising a universal serial bus (USB) connected to the secure boot device and the processor.

18. The apparatus of claim 13, in which the secure boot device is integrated into the apparatus.

19. The apparatus of claim 13, in which the apparatus is located remote from the second storage device.

20. The apparatus of claim 13, in which the apparatus is a network attached storage (NAS) device.