System and method for providing encryption in pipelined storage operations in a storage network

• US 20050257062A1
• Filed: 11/15/2004
• Published: 11/17/2005
• Est. Priority Date: 03/11/1998
• Status: Active Grant

• Current Assignee: CommVault Systems Incorporated
• Original Assignee: Anand Prahlad, Arun Amarendran, Mahesh Tyagarajan, Manoj Vijayan Retnamma, Paul Ignatius, Rajiv Kottomtharayil
• Inventors: Prahlad, Anand, Kottomtharayil, Rajiv, Amarendran, Arun, Retnamma, Manoj Vijayan, Tyagarajan, Mahesh, Ignatius, Paul
• Granted Patent: US 7,277,941 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 2209/125 Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

In accordance with embodiments of the invention, a method is provided for performing a storage operation in a pipeline storage system in which one or more data streams containing data to be stored are written into data chunks. The method includes generating an encryption key associated with a first archive file to be stored when encryption is requested for the storage operation, encrypting the archive data from the data stream using the encryption key to create an encrypted data chunk when a data stream containing the archive file is processed in the pipeline storage system, storing the encrypted data chunk on a storage medium, and storing the encryption key in a manner accessible during a restore operation of the encrypted data chunk.

Claims

1. A method for performing a storage operation in a pipeline storage system in which one or more data streams containing data to be stored are written into data chunks, the method comprising:

when encryption is requested for the storage operation, generating an encryption key associated with a first archive file to be stored;

when a data stream containing the archive file is processed in the pipeline storage system, encrypting the archive data from the data stream using the encryption key to create an encrypted data chunk;

storing the encrypted data chunk on a storage medium; and

storing the encryption key in a manner accessible during a restore operation of the encrypted data chunk.

2. The method of claim 1, wherein the pipeline storage system comprises a plurality of processes arranged in stages including an encryption process, and wherein encrypting the archive data is performed by the encryption process.

3. The method of claim 1, comprising scrambling the encryption key before it is stored.

4. The method of claim 1, comprising encrypting the encryption key before it is stored.

5. The method of claim 1, wherein storing the encryption key comprises storing the encryption key on the storage medium on which the encrypted data chunk is stored.

6. The method of claim 1, comprising storing on a first storage device an index of storage media used by the pipeline storage system, and wherein storing the encryption key comprises storing the encryption key on the first storage device.

7. The method of claim 1, wherein the pipeline storage system includes a storage management component, and wherein storing the encryption key comprises storing the encryption key on the storage management component.

8. The method of claim 1, comprising inserting a tag in the data chunk indicating that the archive data is encrypted.

9. The method of claim 8, comprising inserting the encryption key in the tag in the data chunk.