Method and apparatus for encryption and decryption in remote data storage systems

• US 7,240,197 B1
• Filed: 07/18/2000
• Issued: 07/03/2007
• Est. Priority Date: 07/18/2000
• Status: Expired due to Fees

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Yamamoto, Masayuki, Yamamoto, Akira, Iwami, Naoko, Yamagami, Kenji
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): HOFFMAN, BRANDON S
• Application Number:
  US09/618,202
• Time in Patent Office: 2,541 Days
• Field of Search: 713/193
• US Class Current: 713/168
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

In a storage system having local and remote disk systems, a system is described for selectively controlling the security of data on a volume by volume basis, for transparently exchanging encryption keys between the local and remote disk systems, and for controlling when encryption is used in the storage of data.

Claims

1. A method of controlling security of data in a storage system having a local disk system and a remote disk system that are coupled to at least one host computer, the method comprising:

in the local disk system coupled to a first host computer and a management console, the local disk system having first and second volumes of storage, the first and second volumes being associated with first and second encryption keys, respectively, the first and second encryption keys being provided to the local disk system by the management console;

when a write of data is to be made to the first volume of the local disk system, retrieving the first encryption key;

encrypting the data using the first encryption key, the encrypting being performed by the local disk system;

transferring the encrypted data to the remote disk system via a first communication link;

then

in the remote disk system coupled to a second host computer;

determining whether the data is to be stored in an encrypted form or a decrypted form, the determining being performed by the remote disk system;

determining an address for storage of the data in the remote disk system;

if the data is to be stored in a decrypted form, decrypting and writing the data in the remote disk system;

if the data is to be stored in an encrypted form, writing the data in the remote disk system without decrypting the data; and

notifying the local disk system via the first communication link that the step of writing the data is complete,

wherein the local disk system is coupled to the first host computer via a second communication link to allow the first host computer to access data stored in the local disk system, the first and second communication links being different,

wherein the remote disk system includes third and fourth volumes corresponding to the first and second volumes, respectively.

2. A method of controlling security of data in a storage system having a local disk system and a remote disk system that are coupled to at least one host computer, the method comprising:

in the local disk system coupled to a first host computer and a management console, the local disk system having a first set of volumes of storage and a second set of volumes of storage, the first and second sets of volumes being associated with first and second encryption keys, respectively, the first and second encryption keys being provided to the local disk system by the management console;

when a write of data is to be made to the local disk system, retrieving the first encryption key, wherein the first encryption key is a previously stored encryption key;

encrypting the data using the first encryption key, the encrypting being performed by the local disk system;

transferring the encrypted data to the remote disk system via a first communication link;

then

in the remote disk system;

determining whether the data is to be stored in an encrypted form, the determining being performed by the remote disk system;

determining an address for storage of the data in the remote disk system;

if the data is to be stored in a decrypted form, decrypting and writing the data in the remote disk system;

if the data is to be stored in an encrypted form, writing the data in the remote disk system without decrypting the data; and

notifying the local disk system via the first communication link that the step of writing the data is complete,

wherein the local disk system is coupled to the first host computer via a second communication link to allow the first host computer to access data stored in the local disk system, the first and second communication links being different,

wherein the method further comprises maintaining an encryption control table on the local disk system, the encryption control table including a list of encryption keys for selected volumes of the local and the remote disk system, the list of encryption keys including the first and second encryption keys,

wherein the data transfer between the local disk system and the remote disk system occurs via the first communication link that couples the local disk system to the remote disk system, so that the local disk system may send the data to the remote disk system without direct involvement from the host computer,

wherein the retrieving step includes accessing the encryption control table to obtain an appropriate encryption key, where the data are encrypted using the first key if the data to be transferred to the remote disk system are associated with the first set of volumes and encrypted using the second key if the data to be transferred to the remote disk system are associated with the second set of volumes,

wherein the remote disk system is coupled to a second host computer.

3. A method as in claim 2 wherein the list of encryption keys further includes information relating to the use and non-use of encryption on the local disk system.

4. A method as in claim 3 wherein the encryption keys are applicable to less than all of the storage on the local disk system.

5. A method as in claim 3 wherein the encryption keys are applicable to at least one disk on the local disk system.

6. A method as in claim 5 wherein the encryption keys are applicable to at least one disk on the remote disk system.

7. A method as in claim 2 wherein the list of encryption keys further includes information relating to the use and non-use of encryption on the remote disk system.

8. A method as in claim 7 wherein the encryption keys are applicable to less than all of the storage on the remote disk system.

9. A method for changing an encryption key while operating a storage system having a local disk system and a remote disk system, the method comprising:

providing an encryption key to the local disk system, the encryption key being provided by a management console coupled to the local disk system;

storing the encryption key in a memory in the local disk system;

transmitting the encryption key to the remote disk system via a first communication link coupling the local and remote disk systems;

storing the encryption key in a memory in the remote disk system;

in the local disk system, determining a boundary for use of the encryption key by the local disk system;

in the remote disk system, receiving the boundary from the local disk system by the remote disk system;

in both the local and the remote disk systems, determining a relationship of present operations to the boundary by each of the local and remote disk systems;

in both the local and the remote disk systems, waiting for the boundary and then changing the encryption key for data stored thereafter by each of the local and remote disk systems,

wherein the local disk system is coupled to a first host computer via a second communication link that is different than the first communication link.

10. A method as in claim 9 wherein operations before the boundary are performed using a first encryption key and operations after the boundary are performed using a second encryption key.

11. A method as in claim 9 wherein the boundary is defined by counting input/output operations and using the count to define the boundary.

12. A method of controlling encryption in a storage system having a local disk system and a remote disk system, the method comprising:

providing an encryption key to the local disk system, the encryption key being provided by a management console coupled to the local disk system;

determining a boundary in the local disk system where encryption is to be switched to an opposite state, the determining performed by the local disk system, wherein the boundary is associated with the encryption key;

transmitting the encryption key and the corresponding boundary to the remote disk system;

in both the local and the remote disk system, determining a relationship of present operations to the boundary;

in both the local and the remote disk system, waiting for the boundary, and then changing the encryption to the opposite state,

wherein the local disk system is coupled to a first host computer via a first communication link, and the remote disk system is coupled to a second host computer via a second communication link, the local disk system and the remote disk system being coupled to each other via a third communication link, the third communication link being different than the first or second communication link.

13. A method as in claim 12 wherein operations performed before the boundary are either encrypted or not encrypted, and operations performed after the boundary are either not encrypted or encrypted oppositely to those operations performed before the boundary.

14. A method as in claim 13 wherein the boundary is defined by counting input/output operations and using the count to define the boundary.

15. A method of controlling encryption in a storage system having a local disk system and a remote disk system, the method comprising:

providing first and second encryption keys to the local disk system, the first and second encryption keys being provided by a management console coupled to the local disk system;

storing the first and second encryption keys in a memory in the local disk system that is coupled to a host computer via a first communication link, the first and second encryption keys being assigned to first and second volumes of the local disk system, respectively;

transmitting via a second communication link the first and second encryption keys to the remote disk system, the remote disk system including third and fourth volumes corresponding to the first and second volumes, respectively;

storing the first and second encryption keys in a memory in the remote disk system;

splitting the local disk system from the remote disk system to allow the local disk system and the remote disk system to operate independently, wherein the splitting is performed according to a first command issued by one of;

the local disk system or the remote disk system;

switching encryption to an opposite state from a previous state after splitting the local disk system and remote disk system; and

re-synchronizing the local disk system and the remote disk system, wherein the re-synchronizing is performed according to a second command issued by one of;

the local disk system or remote disk system,

wherein the first and second communication links are different.

16. A storage system comprising:

a local disk system including a plurality of volumes of media for storing data, the local disk system being coupled to a host computer via a first communication link to enable the host computer to access the volumes, the plurality of volumes in the local disk system including first and second volumes that are associated with first and second encryption keys, respectively;

a management console coupled to the local disk system, the first and second encryption keys being provided to the local disk system by the management console;

a remote disk system including a plurality of additional volumes of media for storing data; and

a second communication link coupling the local disk system to the remote disk system,

wherein the local disk system determines whether encryption is to be employed in the data associated with the first volume in the local disk system, and if so, the local disk system encrypts the data to be transferred to the remote disk system using the first encryption key, and

wherein the remote disk system determines whether to store the data in either encrypted form or unencrypted form and stores the data in the determined form in the remote disk system, and notifies the local disk system that the data has been stored via the second communication link,

wherein the first and second communication links are different.

17. A system as in claim 16 further comprising an encryption control table stored on the local disk system, the encryption control table including a list of encryption keys for selected volumes of the local disk system and the remote disk system.

18. A system as in claim 17 wherein the list of encryption keys further includes information relating to the use and non-use of encryption on the local disk system.

19. A system as in claim 18 wherein the list of encryption keys further includes information relating to the use and non-use of encryption on the remote disk system.

20. A system as in claim 19 wherein the first encryption key is applicable to less than all of the storage on the local disk system.

21. A system as in claim 20 wherein the first encryption key is applicable to less than all of the storage on the remote disk system.

22. A system for controlling encryption in a storage system having a local disk system and a remote disk system, the system comprising:

a local memory in the local disk system for storing a first encryption key assigned to a first volume in the local disk system and a second encryption key assigned to a second volume in the local disk system;

a management console coupled to the local disk system, the first and second encryption keys being provided to the local disk system by the management console;

a first communications link for transmitting the first and second encryption keys to the remote disk system and storing the first and second encryption keys in a remote memory of the remote disk system;

a first computer program for splitting the local disk system from the remote disk system to allow the local disk system and the remote disk system to operate independently;

a switch for changing encryption to an opposite state from a previous state after splitting in the local disk system and remote disk system; and

a second computer program for re-synchronizing the local disk system and the remote disk system,

wherein the local disk system is coupled to a host computer via a second communication link that is different than the first communication link,

wherein the local disk system is configured to execute the first computer program or the second computer program, or both,

wherein the local disk system is configured to encrypt data to be transferred to the remote disk system using one of;

the first and second encryption keys stored in the local memory of the local disk system.

23. A method of controlling security of data in a storage system having a local disk system and a remote disk system, the method comprising:

in the local disk system coupled to a management console;

receiving first and second encryption keys from the management console;

assigning first and second volumes to the first and second encryption keys, respectively;

receiving a data update request from a host computer connected to the local disk system, wherein the data update request includes a location of the first volume in the local disk system, the host computer being connected to the local disk system via a first communication link;

encrypting the data associated with the first volume of the local disk system using the first encryption key, the encryption being performed by the local disk system;

transferring the encrypted data to the remote disk system via a second communication link;

then

in the remote disk system;

decrypting the data using the first encryption key; and

writing the decrypted data into a third volume of the remote disk system,

wherein the first and second communication links are different.

24. A storage system comprising:

a local disk system including first and second storage volumes for storing data, the first and second volumes being assigned to first and second encryption keys, respectively, wherein the local disk system is connected to a host computer via a first communication link;

a management console coupled to the local disk system, the first and second encryption keys being provided to the local disk system by the management console;

a remote disk system including third and fourth storage volumes, respectively, for storing data;

a second communications link coupling the local disk system to the remote disk system, the first and second communication links being different,

wherein the local disk system retrieves selected data from the first volume in the local disk system, encrypts the selected data using the first encryption key, and transmits the encrypted data to the remote disk system, and

wherein the remote disk system decrypts the encrypted data received from the local disk system via the second communications link and stores the data in unencrypted form in the third volume in the remote disk system.

25. A system as in claim 24 further comprising an encryption control table stored on the local disk system, the encryption control table including the first and second encryption keys.

26. A method of controlling security of data in a disk system coupled to a management console, a host computer and a remote storage system, the method comprising:

receiving, at the disk system, first and second encryption keys from the management console;

assigning first and second volumes to the first and second encryption keys, respectively;

receiving, at the disk system, data to be stored from the host computer via a first communication link, the data being stored in a given area in the disk system;

encrypting the data received from the host computer using one of;

the first or second encryption keys according to the location of the given area, wherein the first encryption key is used if the given area is in the first volume and the second encryption key is used if the given area is in the second volume, the encrypting being performed by the disk system; and

transferring the encrypted data from the disk system to the remote storage system via a second communication link, the encrypted data being stored in the remote storage system.