Method and apparatus for generating random data-encryption keys

• US 20100008499A1
• Filed: 04/06/2007
• Published: 01/14/2010
• Est. Priority Date: 04/06/2007
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Lee, Adam Y., Youn, Paul
• Granted Patent: US 8,218,761 B2
• Time in Patent Office: Days
• US Class Current: 380/46
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

One embodiment of the present invention provides a system that facilitates generating random data-encryption keys for data files. During operation, the system receives a command at a computer system to create a data file that may include encrypted data. This data file includes a wrapped data-encryption key to facilitate encrypting and decrypting data. In response to the command, the system generates a bit pattern to be used as the wrapped data-encryption key. Finally, the system creates the data file, which includes the bit pattern as the wrapped data-encryption key.

Claims

1. A method for generating random data-encryption keys for data files, the method comprising:

receiving a command at a computer system to create a data file that may include encrypted data, and wherein the data file includes a wrapped data-encryption key to facilitate encrypting and decrypting data;

in response to the command, generating a bit pattern to be used as the wrapped data-encryption key; and

creating the data file, which includes the bit pattern, as the wrapped data-encryption key.

2. The method of claim 1, further comprising:

receiving a second command at the computer system to perform a cryptographic operation on the data in the data file, wherein the cryptographic operation can include encrypting the data or decrypting the data;

in response to the command, unwrapping a copy of the wrapped data-encryption key with a key-encryption key to reveal a data-encryption key; and

using the data-encryption key to perform the cryptographic operation on the data.

3. The method of claim 2, wherein the key-encryption key is a symmetric key, and wherein the key-encryption key is stored externally to the computer system.

4. The method of claim 1, wherein the computer system is a data storage system.

5. The method of claim 4, wherein the data file is a log file.

6. The method of claim 1, wherein generating the bit pattern involves randomly generating the bit pattern.

7. The method of claim 1, wherein the data file can be stored on a sequential-access storage medium, or transferred to a third-party via a secured streaming socket connection.

8. The method of claim 1, wherein the wrapped data-encryption key is stored in a header of the data file.

9. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for generating random data-encryption keys for data files, the method comprising:

receiving a command at a computer system to create a data file that may include encrypted data, and wherein the data file includes a wrapped data-encryption key to facilitate encrypting and decrypting data;

in response to the command, generating a bit pattern to be used as the wrapped data-encryption key; and

creating the data file, which includes the bit pattern, as the wrapped data-encryption key.

10. The computer-readable storage medium of claim 9, wherein the method further comprises:

receiving a second command at the computer system to perform a cryptographic operation on the data in the data file, wherein the cryptographic operation can include encrypting the data or decrypting the data;

in response to the command, unwrapping a copy of the wrapped data-encryption key with a key-encryption key to reveal a data-encryption key; and

using the data-encryption key to perform the cryptographic operation on the data.

11. The computer-readable storage medium of claim 10, wherein the key-encryption key is a symmetric key, and wherein the key-encryption key is stored externally to the computer system.

12. The computer-readable storage medium of claim 9, wherein the computer system is a data storage system.

13. The computer-readable storage medium of claim 12, wherein the data file is a log file.

14. The computer-readable storage medium of claim 9, wherein generating the bit pattern involves randomly generating the bit pattern.

15. The computer-readable storage medium of claim 9, wherein the data file can be stored on a sequential-access storage medium, or transferred to a third-party via a secured streaming socket connection.

16. The computer-readable storage medium of claim 9, wherein the wrapped data-encryption key is stored in a header of the data file.

17. An apparatus configured for generating random data-encryption keys for data files, comprising:

a receiving mechanism configured to receive a command to create a data file that may include encrypted data, and wherein the data file includes a wrapped data-encryption key to facilitate encrypting and decrypting data;

a key-generation mechanism configured to generate a bit pattern to be used as the wrapped data-encryption key; and

a creation mechanism configured to create the data file, which includes the bit pattern, as the wrapped data-encryption key.

18. The apparatus of claim 17, wherein the receiving mechanism is further configured to receive a second command to perform a cryptographic operation on the data in the data file, wherein the cryptographic operation can include encrypting the data or decrypting the data, and wherein the apparatus further comprises:

a cryptographic mechanism configured to unwrap a copy of the wrapped data-encryption key with a key-encryption key to reveal a data-encryption key; and

wherein the cryptographic mechanism is further configured to use the data-encryption key to perform the cryptographic operation on the data.

19. The apparatus of claim 18, wherein the key-encryption key is a symmetric key, and wherein the key-encryption key is stored externally to the computer system.

20. The apparatus of claim 17, wherein the apparatus is part of a data storage system.