DATA TRANSFER DEVICE LIBRARY AND KEY DISTRIBUTION

• US 20130251153A1
• Filed: 07/26/2006
• Published: 09/26/2013
• Est. Priority Date: 10/11/2005
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Topham, Andrew, Drew, John William, Wakelin, Duncan Mark
• Granted Patent: US 8,549,297 B1
• Time in Patent Office: Days
• US Class Current: 380/278
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G11B 20/00086 Circuits for prevention of unauthorised reproduction or copying, e.g. piracy indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
• CPC Class Codes: G11B 20/00246 wherein the key is obtained from a local device, e.g. device key initially stored by the player or by the recorder
• CPC Class Codes: G11B 2220/90 Tape-like record carriers
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method of distributing a key to encrypt data for storing on a removable data storage item in a data transfer device library, the library comprising a controller having a key associated therewith and being connected to a plurality of data transfer devices each being operable to transfer data to a removable data storage item and having a key store, the method comprising: providing the key for the library to the controller; the controller providing the key to the key store of each data transfer device connected to the controller. A data transfer device library is also disclosed.

Claims

1. A method of distributing an encryption key to encrypt data for storing on removable data storage items in a data transfer device library that is connected to a plurality of data transfer devices each being operable to transfer data to one of the removable data storage items and having a key store, the method comprising:

storing the encryption key in the library during manufacturing of the library;

providing the encryption key to a controller in the library; and

writing the encryption key from the controller to each of the plurality of data transfer devices so each of the plurality of data transfer devices encrypt data to the removable data storage items using the encryption key.

2. The method according to claim 1 further comprising:

storing, at a manufacturer of the library, the encryption key and an identification number of the library;

supplying a replacement library as a recovery solution to a customer, the replacement library being pre-programmed with the encryption key to enable the customer to recover data stored on the removable data storage items.

3. The method according to claim 1 further comprising:

shipping the library from a manufacturer to a customer with the encryption key stored in the library.

4. The method according to claim 1, wherein the data are encrypted in each of the plurality of data transfer devices using a block encryption technique in which each block of data is encrypted using the encryption key and a different counter value.

5. The method according to claim 1 further comprising:

encrypting data on the removable data storage items with the encryption key at each of the plurality of data transfer devices so the data on the removable data storage items can be read by any of the plurality of data transfer devices.

6. A data transfer device library comprising:

a controller having an encryption key that is programmed into the controller by a manufacturer of the library; and

a plurality of data transfer devices connected to the controller and each having a key store that stores the encryption key, wherein the controller provides the encryption key to each of the plurality of data transfer devices during initialization of the library so each of the plurality of data transfer devices encrypts data to removable data storage items using the encryption key.

7. The library according to claim 6, wherein the controller is programmed with the encryption key during manufacturing of the library.

8. The library according to claim 6, wherein the library is shipped to a customer with the encryption key programmed into the controller.

9. The library according to claim 6, wherein the manufacturer of the library maintains the encryption key so the manufacturer can provide a customer with a replacement library that is programmed with the encryption key to enable the customer to recover data stored on the removable data storage items.

10. The library according to claim 6, wherein the controller is operable to provide the encryption key to the key store of each data transfer device in response to initialization of the library.

11. The library according to claim 6, wherein the controller is operable to receive a new key and to provide the new key to the key store of each data transfer device.

12. The library according to claim 6, wherein:

the library is a tape drive library;

the data transfer devices are tape drives; and

the data storage items are tape cartridges.

13. The library according to claim 6, wherein each of the plurality of data transfer devices encrypt data to the removable data storage items using a same encryption key so the data on the removable data storage items can be read by any of the plurality of data transfer devices.

14. A method of key management comprising:

generating an encryption key;

storing the encryption key in a data transfer library so the data transfer library can be shipped to a customer with the encryption key, the data transfer library having a unique library identifier and employing the encryption key to encrypt all data transferred to the data transfer library;

storing, with a third party separate from the customer, the encryption key and the unique library identifier; and

subsequently providing a copy of the encryption key from the third party to the customer in the event that a copy of the unique library identifier is provided to the third party by the customer.

15. The method according to claim 14, wherein the encryption key is generated by a manufacturer of a data transfer library.

16. The method according to claim 14 further comprising:

writing the encryption key to each of a plurality of tape drives when the data transfer library is initialized so each of the plurality of tape drives can encrypt data to tape cartridges with the encryption key.

17. The method according to claim 14, wherein the third party is distinct from the customer and a manufacturer of the data transfer library.

18. The method according to claim 14, wherein the encryption key is provided to a controller of the data transfer library, and the controller is operable to distribute the encryption key to all data transfer devices within the data transfer library, each data transfer device using the encryption key to encrypt data and store encrypted data to a removable data storage item.

19. The method according to claim 14 further comprising:

supplying a replacement library as a recovery solution to the customer, the replacement library being pre-programmed with the encryption key to enable the customer to recover data stored on a removable data storage items.