DISCARDING SENSITIVE DATA FROM PERSISTENT POINT-IN-TIME IMAGE

• US 20090276514A1
• Filed: 04/30/2008
• Published: 11/05/2009
• Est. Priority Date: 04/30/2008
• Status: Active Grant

• Current Assignee: NetApp, Inc.
• Original Assignee: NetApp, Inc.
• Inventors: Subramanian, Ananthan
• Granted Patent: US 8,589,697 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2107 File encryption

Abstract

A network storage server implements a method to discard sensitive data from a Persistent Point-In-Time Image (PPI). The server first efficiently identifies a dataset containing the sensitive data from a plurality of datasets managed by the PPI. Each of the plurality of datasets is read-only and encrypted with a first encryption key. The server then decrypts each of the plurality of datasets, except the dataset containing the sensitive data, with the first encryption key. The decrypted datasets are re-encrypted with a second encryption key, and copied to a storage structure. Afterward, the first encryption key is shredded.

Claims

1. A method comprising:

identifying a dataset to be discarded, wherein the dataset is selected from a plurality of datasets managed in a Persistent Point-in-time Image (PPI), each of the plurality of datasets being read-only and encrypted with a first encryption key;

decrypting each of the plurality of datasets except the dataset to be discarded with the first encryption key;

re-encrypting each of the decrypted datasets with a second encryption key;

copying each of the re-encrypted datasets to a storage structure; and

shredding the first encryption key to render the dataset to be discarded unrecoverable.

2. The method as recited in claim 1, wherein the storage structure is an Active File system (AFS).

3. The method as recited in claim 2, wherein the PPI is created based on the AFS.

4. The method as recited in claim 1, further comprising:

shredding key encryption keys used to encrypt the first encryption key.

5. The method as recited in claim 1, further comprising:

deleting the PPI.

6. The method as recited in claim 1, further comprising:

deleting storage structures that contain datasets encrypted with the first encryption key.

7. The method as recited in claim 1, further comprising:

responding with data-not-available to requests of the datasets encrypted with the first encryption key.

8. A method, comprising:

creating a Persistent Point-in-time Image (PPI) based on an Active File System (AFS), wherein the AFS references a plurality of datasets each of which is encrypted with a corresponding encryption key, and the PPI provides read-only references to the plurality of datasets; and

generating a new encryption key in response to the creation of the PPI, wherein the new encryption key is to encrypt newly allocated datasets in AFS.

9. The method as recited in claim 8, further comprising:

encrypting the new encryption key with a wrapping key associated with the AFS.

10. The method as recited in claim 8, further comprising:

decrypting a dataset, selected from the plurality of datasets, with its corresponding encryption key in response to a user request for the dataset.

11. The method as recited in claim 8, further comprising:

in response to a user request to discard sensitive data stored in a dataset encrypted with a first encryption key, re-keying a subset of datasets with the new encryption key, wherein each dataset of the subset is originally encrypted with the first encryption key and referenced by the PPI and the AFS, the dataset with sensitive data not being part of the subset;

writing the re-keyed subset of datasets to the AFS; and

shredding the first encryption key to render the sensitive data unrecoverable.

21. The storage server system as recited in claim 9, wherein the process further comprising:

shredding key encryption keys used to encrypt the first encryption key.

12. A method to discard a dataset, comprising:

identifying the dataset to be discarded, wherein the dataset is read-only and is encrypted with a first encryption key;

identifying a Persistent Point-in-time Image (PPI) referencing the dataset to be discarded, wherein the PPI is created based on a writable Active File System (AFS), and the PPI references a plurality of datasets each of which is read-only and encrypted with a corresponding encryption key;

identifying a subset of datasets referenced by the PPI and the AFS, wherein the dataset to be discarded is not part of the subset, and each dataset in the subset is encrypted with the first encryption key;

decrypting each dataset of the subset with the first encryption key;

encrypting each dataset of the subset with a second encryption key;

writing each re-encrypted dataset of the subset to the AFS; and

shredding the first encryption key to render the dataset to be discarded unrecoverable.

13. The method as recited in claim 12, further comprising:

shredding key encryption keys used to encrypt the first encryption key.

14. The method as recited in claim 12, further comprising:

deleting the PPI.

15. The method as recited in claim 12, further comprising:

deleting any PPI that contains datasets encrypted with the first encryption key.

16. The method as recited in claim 12, further comprising:

responding with data-not-available to requests of datasets in the PPI that are encrypted with the first encryption key.

18. The storage server system as recited in claim 15, wherein the process further comprising:

deleting any of the PPIs that references the dataset to be discarded.

19. The storage server system as recited in claim 15, wherein the process further comprising:

deleting any of the PPIs that contain datasets encrypted with the first encryption key.

20. The storage server system as recited in claim 15, wherein the process further comprising:

responding with data-not-available to requests of the datasets in any of the identified PPIs.

17. A storage server system comprising:

a network interface through which to receive data access requests from a plurality of storage clients;

a storage interface through which to communicate with a storage facility that stores one or more Persistent Point-in-time Images (PPIs) and an Active File System (AFS), wherein each of the PPIs is created from the AFS and references a corresponding plurality of datasets on the storage facility, each of the corresponding plurality of datasets being read-only and encrypted with a corresponding encryption key;

a processor; and

a machine-readable medium that stores instructions which, if executed by the processor, causes the processor to perform a process comprising;

identifying all PPIs referencing a dataset to be discarded, wherein the dataset to be discarded is encrypted with a first encryption key;

for each of the identified PPIs,

identifying a subset of datasets referenced by the identified PPI and AFS, wherein the dataset to be discarded is not part of the subset, and each dataset of the subset is encrypted with the first encryption key;

decrypting each dataset of the subset with the first encryption key;

encrypting each dataset of the subset with a second encryption key uniquely associated with the AFS;

writing each re-encrypted dataset of the subset to the AFS; and

shredding the first encryption key.

22. A data storage system, comprising:

a storage unit that stores one or more Persistent Point-in-time Images (PPIs) and an Active File System (AFS), wherein each of the PPIs is created from the AFS and references a corresponding plurality of datasets on the storage unit, each of the corresponding plurality of datasets being read-only and encrypted with a corresponding encryption key; and

an encryption engine to decrypt a dataset with the dataset'"'"'s corresponding encryption key in response to a request for the dataset.

23. The data storage system as recited in claim 22, wherein the encryption engine, in response to a request to discard sensitive data stored in a dataset that is encrypted with a first encryption key, identifies and decrypts a subset of datasets using the first encryption key, and re-encrypts the subset of datasets with a second encryption key, each of the subset of datasets being originally encrypted with the first encryption key, and the subset of datasets not including the dataset with sensitive data.

24. The data storage system as recited in claim 23, wherein the encryption engine shreds the first encryption key to render the sensitive data unrecoverable.

25. The data storage system as recited in claim 22, wherein each of the corresponding plurality of datasets includes a CP_COUNT field for identifying the corresponding encryption key.