Tracking replica data using key management

Patent metadata

Field	Value
Publication number	US-9830278-B1
Application number	US-201615275926-A
Country	US
Kind code	B1
Filing date	Sep 26, 2016
Priority date	Mar 6, 2008
Publication date	Nov 28, 2017
Grant date	Nov 28, 2017

Abstract

Source and replica data in a storage area network is tracked during management of data encryption keys. Association of source and replica data allows for all copies of customer information in an enterprise to be managed as a single entity for deletion or tracked for management purposes by using referenced data encryption keys upon creation of replicas. Any replica from a source storage object can be created using the source storage object data encryption key or an associated key and tracked by these keys as a subset of the number of replicas created. Management of the data encryption keys can control the lifetime of data on a storage array and in the storage area network without managing every replicated instance for the lifetime of the data.

First claim

What is claimed is:

1. A computer-implemented method for generating a wrapped data encryption key, the method comprising:
generating, at a server, an encryption key based on a secure pseudo-random number generator;
concatenating an object identifier to the encryption key, the object identifier associated with an object to be encrypted;
generating a ciphertext by encrypting the concatenated encryption key with a key encryption key;
generating an authenticity code by encrypting the encrypted concatenated encryption key with a redundancy key; and
generating a wrapped data encryption key by concatenating the ciphertext with the authenticity code.

2. The method of claim 1 , further comprising:
receiving, at a storage processor from a host processor via a storage area network, a request to write the object to a logical unit number of a disk drive set;
receiving, from the server via a computer network, the wrapped data encryption key;
encrypting the object with the wrapped data encryption key; and
storing the object to the logical unit number.

3. The method of claim 1 , further comprising:
receiving, at a second storage processor from the first storage processor via the storage area network, a request to replicate the object;
storing, by the second storage processor, the object in a second logical unit number of a second disk drive set; and
transmitting, by the second storage processor to the server via a computer network, an request to associate the wrapped encryption key with the object stored in the second logical unit number of the second disk drive set.

4. A system for generating a wrapped data encryption key, the method comprising:
a processor;
a memory storing instructions, the instructions being adapted to cause the processor to execute steps comprising:
generating, at a server, an encryption key based on a secure pseudo-random number generator;
concatenating an object identifier to the encryption key, the object identifier associated with an object to be encrypted;
generating a ciphertext by encrypting the concatenated encryption key with a key encryption key;
generating an authenticity code by encrypting the encrypted concatenated encryption key with a redundancy key; and
generating a wrapped data encryption key by concatenating the ciphertext with the authenticity code.

5. The system of claim 4 , the instructions being adapted to cause the processor to execute steps comprising:
receiving, at a storage processor from a host processor via a storage area network, a request to write the object to a logical unit number of a disk drive set;
receiving, from the server via a computer network, the wrapped data encryption key;
encrypting the object with the wrapped data encryption key; and
storing the object to the logical unit number.

6. The system of claim 3 , the instructions being adapted to cause the processor to execute steps comprising:
receiving, at a second storage processor from the first storage processor via the storage area network, a request to replicate the object;
storing, by the second storage processor, the object in a second logical unit number of a second disk drive set; and
transmitting, by the second storage processor to the server via a computer network, an request to associate the wrapped encryption key with the object stored in the second logical unit number of the second disk drive set.

7. A non-transitory computer readable medium including computer code adapted to be executed on electronic computer hardware, the code comprising:
code for generating, at a server, an encryption key based on a secure pseudo-random number generator;
code for concatenating an object identifier to the encryption key, the object identifier associated with an object to be encrypted;
code for generating a ciphertext by encrypting the concatenated encryption key with a key encryption key;
code for generating an authenticity code by encrypting the encrypted concatenated encryption key with a redundancy key; and
code for generating a wrapped data encryption key by concatenating the ciphertext with the authenticity code.

8. The non-transitory computer readable medium of claim 7 , the code further comprising:
code for receiving, at a storage processor from a host processor via a storage area network, a request to write the object to a logical unit number of a disk drive set;
code for receiving, from the server via a computer network, the wrapped data encryption key;
code for encrypting the object with the wrapped data encryption key; and
code for storing the object to the logical unit number.

9. The non-transitory computer readable medium of claim 7 , the code further comprising:
code for receiving, at a second storage processor from the first storage processor via the storage area network, a request to replicate the object;
code for storing, by the second storage processor, the object in a second logical unit number of a second disk drive set; and
code for transmitting, by the second storage processor to the server via a computer network, an request to associate the wrapped encryption key with the object stored in the second logical unit number of the second disk drive set.

Assignees

• Emc Ip Holding Co Llc

Inventors

• Harwood John S
• Linnell Thomas E
• Fitzgerald John T

Classifications

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• G06F3/067

  Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS] · CPC title

• G06F12/1408 Primary

  by using cryptography (for digital transmission H04L9/00) · CPC title

• G06F3/0689

  Disk arrays, e.g. RAID, JBOD · CPC title

• G06F3/065

  Replication mechanisms · CPC title