Method and apparatus for deleting data upon expiration

• US 7,559,088 B2
• Filed: 02/04/2005
• Issued: 07/07/2009
• Est. Priority Date: 02/04/2004
• Status: Active Grant

• Current Assignee: NetApp, Inc.
• Original Assignee: NetApp, Inc.
• Inventors: Cohen, Gavin David, Trimmer, Donald Alvin, Blaser, Rico
• Primary Examiner(s): Hoffman; Brandon S
• Application Number:
  US11/051,952
• Publication Number:
  US 20060143443A1
• Time in Patent Office: 1,614 Days
• Field of Search: None
• US Class Current: 726/26
• CPC Class Codes: G06F 11/1448 Management of the data involved in backup or backup restore
• CPC Class Codes: G06F 2201/84 Using snapshots, i.e. a logical point-in-time copy of the data
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method and apparatus for efficiently deleting data including backup or snapshots upon expiration are disclosed. The data can be deleted even without physical access to the data. A data generation unit generates a data. Each data has an expiration time and should be deleted upon expiration. An encryption unit encrypts the data, and the encrypted data is stored in data storage. A controller monitors whether there is an expired data, and if there is an expired data, the controller deletes a key necessary for decrypting the expired data.

Claims

1. A method for managing expiration operations of a backup management system to render expired backup data inaccessible, the method comprising:

generating backup data from original data contained in a primary data volume as indicated by a data backup policy, wherein the data backup policy governs generation, storage, and expiration of the backup data;

storing the backup data in a backup storage unit and encrypting the backup data, wherein the backup data but not the original data is encrypted;

storing a decryption key and an associated expiration time in an encryption storage unit for each of a plurality of backup data, wherein;

the decryption key is for decrypting the encrypted data;

the expiration time is indicated by the data backup policy and indicates the time at which each of the plurality of backup data should be rendered inaccessible;

a first backup data and a second backup data of the plurality of backup data are assigned an identical decryption key when the first backup data and the second backup data have an identical expiration time;

the first backup data and the second backup data are assigned distinct decryption keys when the first backup data and the second backup data have different expiration times; and

deleting the decryption key at a time indicated by the expiration time for each of the plurality of backup data, such that an expired backup data becomes inaccessible even if the expired backup data is not deleted from the backup storage unit.

2. The method of claim 1 wherein the backup data is a snapshot of the original data.

3. The method of claim 1 wherein the backup data is a backup copy stored on a tape or a virtual tape.

4. The method of claim 1 wherein each backup data is encrypted using a different encryption key.

5. An apparatus for managing expiration operations of a backup management system to render expired backup data inaccessible, the apparatus comprising:

a data generation unit to generate backup data from original data contained in a primary data volume, wherein a data backup policy governs generation, storage, and expiration of the backup data;

an encryption unit to encrypt the backup data, wherein the encryption unit encrypts the backup data but not the original data;

a backup storage unit to store the encrypted backup data;

an encryption storage unit to store a decryption key and an expiration time for each of a plurality of backup data, wherein;

the decryption key is for decrypting the encrypted data;

the expiration time is indicated by the data backup policy and indicates the time and which each of the plurality of backup data should be rendered inaccessible;

a first backup data and a second backup data of the plurality of backup data are assigned an identical decryption key when the first backup data and the second backup data have an identical expiration time;

the first backup data and the second backup data are assigned distinct decryption keys when the first backup data and the second backup data have different expiration times; and

a controller to delete the decryption key at a time indicated by the expiration time for each of the plurality of backup data, such that an expired backup data becomes inaccessible even if the expired backup data is not deleted from the backup storage unit.

6. The apparatus of claim 5 wherein the backup data is a snapshot of the original data.

7. The apparatus of claim 5 wherein the backup data is a backup copy stored on a tape or a virtual tape.

8. The apparatus of claim 5 wherein each backup data is encrypted using a different encryption key.

9. The apparatus of claim 5 wherein the backup data targeted to expire during the same period are encrypted using the same encryption key.