Encryption key management using content-based datasets

Patent metadata

Field	Value
Publication number	US-12339976-B2
Application number	US-202217975505-A
Country	US
Kind code	B2
Filing date	Oct 27, 2022
Priority date	Oct 27, 2022
Publication date	Jun 24, 2025
Grant date	Jun 24, 2025

Abstract

Providing content-based encryption to content data in a data processing system by creating datasets by grouping metadata for data objects that are intended to be encrypted with a common encryption key, where each dataset spans multiple storage devices of different storage types, and defines a single data encryption unit for the data objects referenced by a respective dataset. Each dataset is tagged with an encryption tag to enable or disable use of a self-selected encryption key. Encryption keys stored in or made available to the system are accessed for encrypting the data objects using an encryption process. A key management component maps each dataset to a corresponding encryption key of the encryption keys, and an encryption component encrypts, for each dataset, referenced data objects using a corresponding mapped encryption key.

First claim

What is claimed is:

1. A computer-implemented method of providing content-based encryption to content data having disparate file formats in a data processing system, comprising:
defining protection policies to protect the content data using different protection policies depending on a respective file format;
creating datasets by grouping metadata for data objects that are intended to be encrypted with a common encryption key, wherein each dataset spans multiple storage devices of different storage types for the respective file format, and wherein each dataset defines a single data encryption unit for the data objects referenced by a respective dataset;
iteratively processing each dataset to tag constituent data objects according to a native file format;
attaching multiple tags to the dataset to indicate that the data objects of the dataset are of different file types according to the disparate file formats;
merging the protection policies to protect the dataset under a merged protection policy utilizing a most restrictive policy of the different protection policies;
further tagging each dataset with an encryption tag to enable or disable use of a self-selected encryption key;
accessing encryption keys stored in or made available to the system for encrypting the data objects using an encryption process;
mapping each dataset to a corresponding encryption key of the encryption keys; and
encrypting, for each dataset, referenced data objects using a corresponding mapped encryption key.

2. The method of claim 1 wherein the dataset comprises a set of metadata organized in a table, and wherein the encryption tag comprises an alphanumeric label appended to the table, and further wherein the method further comprises applying the merged protection policy to the dataset to protect or otherwise operate on the constituent data objects referenced by the metadata.

3. The method of claim 1 further comprising:
processing new data objects received by the system;
assigning, to an assigned dataset, each new data object based on an encryption requirement; and
applying an encryption key mapped to the assigned dataset to the assigned new data objects.

4. The method of claim 1 wherein the accessing step comprises accessing one or more encryption keys from a local key manager memory store, a remote network key manager store, or a key provisioning service.

5. The method of claim 1 wherein the encryption key mapped to the dataset comprises a plurality of keys mapped to different data objects referenced by the dataset, and wherein the each key of the plurality of keys for the dataset applies a different encryption strength or encryption type.

6. The method of claim 1 wherein the common encryption key is generated by an encryption policy specifying a key rotation schedule that rotates keys at cadence to encrypt data at rest comprising user data stored in persistent storage of an active storage tier.

7. The method of claim 1 wherein the encryption process uses the corresponding mapped encryption key to transform plain text of the data object into cipher text for an encryption operation, and to transform the cipher text into the plain text for a decryption operation.

8. The method of claim 7 wherein the encryption and decryption operations utilize an encryption standard comprising one of: Advanced Encryption Standard (AES), RSA, or Triple Data Encryption Standard (3DES).

9. A system for providing content-based encryption to content data having disparate file formats and organized as datasets in a data processing system, comprising:
a data protection component defining protection policies to protect the content data using different protection policies depending on a respective file format, iteratively processing each dataset to tag constituent data objects according to a native file format, attaching multiple tags to the dataset to indicate that the data objects of the dataset are of different file types according to the disparate file formats, and merging the protection policies to protect the dataset under a merged protection policy utilizing a most restrictive policy of the different protection policies;
a hardware-based dataset management component creating the datasets by grouping metadata for data objects that are intended to be encrypted with a common encryption key, wherein each dataset spans multiple storage devices of different storage types, and wherein each dataset defines a single data encryption unit for the data objects referenced by a respective dataset;
a dataset key management system (DSKMS) component further tagging each dataset with an encryption tag to enable or disable use of a self-selected encryption key, accessing encryption keys stored in or made available to the system for encrypting the data objects using an encryption process, and mapping each dataset to a corresponding encryption key of the encryption keys; and
an encryption processing component encrypting, for each dataset, referenced data objects using a corresponding mapped encryption key.

10. The system of claim 9 wherein the dataset comprises a set of metadata organized in a table, and wherein the encryption tag comprises an alphanumeric label appended to the table and further wherein the data protection component further applies the merged protection policy to the dataset to protect or otherwise operate on the constituent data objects referenced by the metadata.

11. The system of claim 9 wherein the DSKMS further processes new data objects received by the system; assigns, to an assigned dataset, each new data object based on an encryption requirement; and applies an encryption key mapped to the assigned dataset to the assigned new data objects.

12. The system of claim 9 wherein the DSKMS accesses one or more encryption keys from a local key manager memory store, a remote network key manager store, or a key provisioning service.

13. The system of claim 9 wherein the encryption key mapped to the dataset comprises a plurality of keys mapped to different data objects referenced by the dataset, and wherein the each key of the plurality of keys for the dataset applies a different encryption strength or encryption type.

14. The system of claim 9 wherein the common encryption key is generated by an encryption policy specifying a key rotation schedule that rotates keys at cadence to encrypt data at rest comprising user data stored in persistent storage of an active storage tier.

15. The system of claim 9 wherein the encryption process uses the corresponding mapped encryption key to transform plain text of the data object into cipher text for an encryption operation, and to transform the cipher text into the plain text for a decryption operation.

16. The system of claim 15 wherein the encryption and decryption operations utilize an encryption standard comprising one of: Advanced Encryption Standard (AES), RSA, or Triple Data Encryption Standard (3DES).

17. A non-transitory tangible computer program product having stored thereon, programming code that, when executed by a processor, causes the processor to perform a method of providing content-based encryption to content data having disparate file formats in a data processing system, comprising:
defining protection policies to protect the content data using different protection policies depending on a respective file format;
creating datasets by grouping metadata for data objects that are intended to be encrypted with a common encryption key, wherein each dataset spans multiple storage devices of different storage types for the respective file format, and wherein e

Assignees

• Dell Products Lp

Inventors

• Brenner Adam
• Shemer Jehuda
• Sadhwani Steven
• Lotosh Valerie
• Sharvit Erez

Classifications

• G06F21/107

  License processing; Key processing · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F21/602 Primary

  Providing cryptographic facilities or services · CPC title