Encryption key recovery in the event of storage management failure
First Claim
1. A method of encryption key recovery, said method comprising a hardware processor executing computer instructions in memory to perform the steps of:
- (a) creating a storage object for containing encrypted data in data storage of a data storage system, assigning an object identifier to the storage object for identifying the storage object in the data storage system, assigning a data encryption key to the storage object, assigning a key identifier to the data encryption key, storing the data encryption key in the data storage system in association with the object identifier, and storing the key identifier in the data storage system in association with the object identifier; and
(b) when performing an operation upon the storage object using the data encryption key in the data storage system, detecting failure of the data encryption key in the data storage system, and in response to detecting failure of the data encryption key in the data storage system, the data storage system requesting a first copy of the data encryption key by sending a first request to a key server computer, the first request specifying the object identifier; and
then(c) the key server computer receiving the first request from the data storage system, and the key server computer searching a key store for the data encryption key associated with the object identifier specified by the first request, and the key server computer returning, to the data storage system, a first copy of the data encryption key found in the key store to be associated with the object identifier specified by the first request; and
then(d) the data storage system receiving the first copy of the data encryption key from the key server computer, and when performing the operation upon the storage object using the first copy of the data encryption key, the data storage system detecting failure of the first copy of the data encryption key, and in response to the data storage system detecting failure of the first copy of the data encryption key, the data storage system fetching the key identifier stored in association with the object identifier in the data storage system and the data storage system sending a second request to the key server computer, the second request specifying the key identifier stored in association with the object identifier in the data storage system; and
then(e) the key server computer receiving the second request from the data storage system, and the key server computer searching the key store for the data encryption key associated with the key identifier specified by the second request, and the key server computer returning, to the data storage system, a second copy of the data encryption key found in the key store to be associated with the key identifier specified by the second request; and
then(f) resuming the operation upon the storage object using the second copy of the data encryption key fetched from the key server computer.
9 Assignments
0 Petitions
Accused Products
Abstract
A data processing system stores encrypted data. Object identifiers are assigned to storage objects, and data encryption keys are assigned to the storage objects. When performing an operation upon a storage object, data encryption key failure may occur due to a corrupt or incorrect key. In this case, a copy of the data encryption key is fetched from a key server. It is possible for the association of the object identifiers with the data encryption keys to become lost or confused, so that the key server may fail to provide the correct key for a specified object identifier. Therefore, an absolute key identifier that is unique across the key server namespace also is stored in association with the object identifier in the storage system and in the key store of the key server, and the absolute key identifier is used as a failsafe for recovery of encrypted data.
-
Citations
21 Claims
-
1. A method of encryption key recovery, said method comprising a hardware processor executing computer instructions in memory to perform the steps of:
-
(a) creating a storage object for containing encrypted data in data storage of a data storage system, assigning an object identifier to the storage object for identifying the storage object in the data storage system, assigning a data encryption key to the storage object, assigning a key identifier to the data encryption key, storing the data encryption key in the data storage system in association with the object identifier, and storing the key identifier in the data storage system in association with the object identifier; and (b) when performing an operation upon the storage object using the data encryption key in the data storage system, detecting failure of the data encryption key in the data storage system, and in response to detecting failure of the data encryption key in the data storage system, the data storage system requesting a first copy of the data encryption key by sending a first request to a key server computer, the first request specifying the object identifier; and
then(c) the key server computer receiving the first request from the data storage system, and the key server computer searching a key store for the data encryption key associated with the object identifier specified by the first request, and the key server computer returning, to the data storage system, a first copy of the data encryption key found in the key store to be associated with the object identifier specified by the first request; and
then(d) the data storage system receiving the first copy of the data encryption key from the key server computer, and when performing the operation upon the storage object using the first copy of the data encryption key, the data storage system detecting failure of the first copy of the data encryption key, and in response to the data storage system detecting failure of the first copy of the data encryption key, the data storage system fetching the key identifier stored in association with the object identifier in the data storage system and the data storage system sending a second request to the key server computer, the second request specifying the key identifier stored in association with the object identifier in the data storage system; and
then(e) the key server computer receiving the second request from the data storage system, and the key server computer searching the key store for the data encryption key associated with the key identifier specified by the second request, and the key server computer returning, to the data storage system, a second copy of the data encryption key found in the key store to be associated with the key identifier specified by the second request; and
then(f) resuming the operation upon the storage object using the second copy of the data encryption key fetched from the key server computer. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A method of encryption key recovery, said method comprising a hardware processor executing computer instructions in memory to perform the steps of:
-
(a) creating a storage object for containing encrypted data in data storage of a data storage system, assigning an object identifier to the storage object for identifying the storage object in the data storage system, obtaining a key identifier and a data encryption key assigned to the storage object from a key server computer, storing the key identifier and the data encryption key in the data storage system in association with the object identifier, and storing the key identifier and a copy of the data encryption key in association with the object identifier and an identifier of the data storage system in a key store of the key server computer; and (b) when performing an operation upon the storage object using the data encryption key in the data storage system, detecting failure of the data encryption key in the data storage system, and in response to detecting failure of the data encryption key in the data storage system, the data storage system requesting a first copy of the data encryption key by sending a first request to the key server computer, the first request specifying the object identifier; and
then(c) the key server computer receiving the first request from the data storage system, and the key server computer searching the key store for the data encryption key associated with the object identifier specified by the first request, and the key server computer returning, to the data storage system, a first copy of the data encryption key found in the key store to be associated with the object identifier specified by the first request; and
then(d) the data storage system receiving the first copy of the data encryption key from the key server computer, and when performing the operation upon the storage object using the first copy of the data encryption key, the data storage system detecting failure of the first copy of the data encryption key, and in response to the data storage system detecting failure of the first copy of the data encryption key, the data storage system fetching the key identifier stored in association with the object identifier in the data storage system and the data storage system sending a second request to the key server computer, the second request specifying the key identifier stored in association with the object identifier in the data storage system; and
then(e) the key server computer receiving the second request from the data storage system, and the key server computer searching the key store for the data encryption key associated with the key identifier specified by the second request, and the key server computer returning, to the data storage system, a second copy of the data encryption key found in the key store to be associated with the key identifier specified by the second request; and
then(f) resuming the operation upon the storage object using the second copy of the data encryption key fetched from the key server computer. - View Dependent Claims (11, 12, 13)
-
-
14. A data storage system comprising:
-
data storage; and at least one storage processor coupled to the data storage for storing data in the data storage; wherein said at least one storage processor is programmed for creating a storage object for containing encrypted data in the data storage, assigning an object identifier to the storage object for identifying the storage object in the data storage system, obtaining a key identifier and a data encryption key assigned to the storage object from a key server computer, and storing the key identifier and the data encryption key in the data storage system in association with the object identifier; and wherein said at least one storage processor is further programmed for performing an operation upon the storage object using the data encryption key in the data storage system, and when performing the operation upon the storage object using the data encryption key in the data storage system; (a) detecting failure of the data encryption key in the data storage system, and in response to detecting failure of the data encryption key in the data storage system, said at least one storage processor requesting a first copy of the data encryption key by sending a first request to the key server computer, the first request specifying the object identifier; and
then(b) the key server computer receiving the first request from said at least one storage processor, and the key server computer searching a key store for the data encryption key associated with the object identifier specified by the first request, and the key server computer returning, to said at least one storage processor, a first copy of the data encryption key found in the key store to be associated with the object identifier specified by the first request; and
then(c) said at least one storage processor receiving the first copy of the data encryption key from the key server computer, and when performing the operation upon the storage object using the first copy of the data encryption key, said at least one storage processor detecting failure of the first copy of the data encryption key, and in response to said at least one storage processor detecting failure of the first copy of the data encryption key, said at least one storage processor fetching the key identifier stored in association with the object identifier in the data storage system and said at least one storage processor sending a second request to the key server computer, the second request specifying the key identifier stored in association with the object identifier in the data storage system; and
then(d) the key server computer receiving the second request from said at least one storage processor, and the key server computer searching the key store for the data encryption key associated with the key identifier specified by the second request, and the key server computer returning, to said at least one storage processor, a second copy of the data encryption key found in the key store to be associated with the key identifier specified by the second request; and
then(e) resuming the operation upon the storage object using the second copy of the data encryption key fetched from the key server computer. - View Dependent Claims (15, 16, 17, 18, 19, 20)
-
-
21. A method of encryption key recovery comprising:
-
(a) a storage processor computer creating a storage object for containing encrypted data in data storage of a data storage system and assigning an object identifier to the storage object for identifying the storage object in the data storage system, and the storage processor computer requesting a new data encryption key for the storage object by sending a first request to a key server computer, the first request specifying the object identifier; and
then(b) the key server computer receiving the first request from the storage processor computer, and the key server computer assigning a data encryption key to the storage object and assigning a key identifier to the data encryption key, and the key server computer storing the data encryption key in a key store of the key server computer, and the key server computer storing the object identifier in the key store in association with the data encryption key, and the key server computer storing the key identifier in the key store in association with the data encryption key, and the key server computer returning the data encryption key and the key identifier to the storage processor computer; and
then(c) the storage processor computer receiving the data encryption key and the key identifier from the key server computer, and the storage processor computer storing the data encryption key in association with the object identifier in the storage processor computer, and the storage processor computer storing the key identifier in association with the object identifier in the storage processor computer, and then (d) when performing an operation upon the storage object using the data encryption key stored in the storage processor computer, the storage processor computer detecting failure of the data encryption key, and in response to the storage processor computer detecting failure of the data encryption key, the storage processor computer requesting a first copy of the data encryption key by sending a second request to the key server computer, the second request specifying the object identifier; and
then(e) the key server computer receiving the second request from the storage processor computer, and the key server computer searching the key store for the data encryption key associated with the object identifier specified by the second request, and the key server computer returning, to the storage processor computer, a first copy of the data encryption key found in the key store to be associated with the object identifier specified by the second request; and
then(f) the storage processor computer receiving the first copy of the data encryption key from the key server computer, and when performing the operation upon the storage object using the first copy of the data encryption key, the storage processor computer detecting failure of the first copy of the data encryption key, and in response to the storage processor computer detecting failure of the first copy of the data encryption key, the storage processor computer fetching the key identifier stored in association with the object identifier in the storage processor computer and the storage processor computer sending a third request to the key server computer, the third request specifying the key identifier stored in association with the object identifier in the first storage system computer; and
then(g) the key server computer receiving the third request from the storage processor computer, and the key server computer searching the key store for the data encryption key associated with the key identifier specified by the third request, and the key server computer returning, to the storage processor computer, a second copy of the data encryption key found in the key store to be associated with the key identifier specified by the third request; and
then(h) the storage processor computer receiving the second copy of the data encryption key from the key server computer, and the storage processor computer resuming the operation upon the storage object using the second copy of the data encryption key fetched from the key server computer.
-
Specification