Associating a data encryption keystore backup with a computer system

Patent metadata

Field	Value
Publication number	US-9870481-B1
Application number	US-201414503331-A
Country	US
Kind code	B1
Filing date	Sep 30, 2014
Priority date	Sep 30, 2014
Publication date	Jan 16, 2018
Grant date	Jan 16, 2018

Abstract

The techniques presented herein provide for associating a data encryption lockbox backup with a data storage system. A first set of software system stable values (SSV) is derived from data storage system component values unique to the data storage system. A lockbox storing the first set of SSV and a set of encryption keys associated with a corresponding respective set of data storage system drives is created. Access to the lockbox requires providing a first minimum number of SSV that match corresponding SSV in the first set of SSV. A backup copy of the lockbox is created, wherein access to the backup copy requires providing a second minimum number of SSV that match corresponding SSV in the first set of SSV, wherein the minimum number of SSV is equal to a second match value. The backup copy of the lockbox is stored at a remote location.

First claim

What is claimed is:

1. A method for associating a data encryption lockbox backup with a data storage system, the method comprising:
generating a first set of software system stable values (SSV), the first set of SSV including a plurality of values wherein each value is derived from a data storage system component value unique to the data storage system;
creating a lockbox configured to store the first set of SSV and a set of encryption keys associated with a corresponding respective set of data storage system drives, wherein the data storage system drives include a plurality of drives reserved for storage system management operations and are not configured for storing user data, wherein access to the lockbox requires providing a minimum number of SSV that match corresponding SSV in the first set of SSV, wherein the minimum number of SSV is equal to a first match value and less than the number of SSV in the first set;
creating a backup copy of the lockbox, wherein access to the backup copy of the lockbox requires providing a minimum number of SSV that match the corresponding SSV in the first set of SSV, wherein the minimum number of SSV is equal to a second match value; and
storing the backup copy of the lockbox at a remote location.

2. The method of claim 1 , further including determining the lockbox on the data storage systems needs to be restored and initiating a restore procedure.

3. The method of claim 2 , further including downloading the backup copy of the lockbox to the data storage system.

4. The method of claim 3 , further including generating a second set of SSV, wherein the second set of SSV are derived from a current configuration of the data storage system component values.

5. The method of claim 4 further including comparing the second set of SSV to the set of SSV stored in the backup copy of the lockbox to determine a number of matching SSV.

6. The method of claim 5 , wherein if the number of matching SSV is less than the minimum number of SSV where the minimum number is equal to the second match value, terminating the restore procedure.

7. The method of claim 5 , wherein the second match value is set equal to the first match value.

8. The method of claim 7 , further including:
refreshing the backup copy of the lockbox, wherein refreshing includes replacing the set of SSV in the backup copy of the lockbox with the second set of SSV; and
replacing the current lockbox with the backup copy of the lockbox.

9. The method of claim 1 , further including:
determining that a data storage component associated with one or more of the first set of SSV has changed;
generating a third set of SSV, wherein the third set of SSV are derived from a current configuration of the data storage system component values; and
creating and storing a new backup copy of the lockbox using the third set of SSV.

10. The method of claim 1 , wherein the first set of SSV includes a first subset of SSV derived from data storage system software component values and second subset of SSV derived from data storage system hardware component values, the hardware and software component values associated with a unique data storage system.

11. A system for associating a data encryption lockbox backup with a data storage system, the system comprising a special purpose storage processor configured to:
generate a first set of software system stable values (SSV), the first set of SSV including a plurality of values wherein each value is derived from a data storage system component value unique to the data storage system;
create a lockbox configured to store the first set of SSV and a set of encryption keys associated with a corresponding respective set of data storage system drives, wherein the data storage system drives include a plurality of drives reserved for storage system management operations, wherein access to the lockbox requires providing a minimum number of SSV that match corresponding SSV in the first set of SSV, wherein the minimum number of SSV is equal to a first match value and less than the number of SSV in the first set;
create a backup copy of the lockbox, wherein access to the backup copy of the lockbox requires providing a minimum number of SSV that match corresponding SSV in the first set of SSV, wherein the minimum number of SSV is equal to a second match value; and
store the backup copy of the lockbox at a remote location.

12. The system of claim 11 further configured to determine the lockbox on the data storage systems needs to be restored and initiating a restore procedure.

13. The system of claim 12 further configured to download the backup copy of the lockbox to the data storage system.

14. The system of claim 13 , further configured to generate a second set of SSV, wherein the second set of SSV are derived from a current configuration of the data storage system component values.

15. The system of claim 14 further configured to compare the second set of SSV to the set of SSV stored in the backup copy of the lockbox to determine a number of matching SSV.

16. The system of claim 15 , wherein if the number of matching SSV is less than the minimum number of SSV where the minimum number is equal to the second match value, terminate the restore procedure.

17. The system of claim 15 further configured to set the value of the second match value equal to the first match value.

18. The system of claim 17 , further configured to:
refresh the backup copy of the lockbox, wherein refreshing includes replacing the set of SSV in the backup copy of the lockbox with the second set of SSV; and
replace the current lockbox with the backup copy of the lockbox.

19. The system of claim 11 , further configured to:
determine that a data storage component associated with one or more of the first set of SSV has changed;
generate a third set of SSV, wherein the third set of SSV are derived from a current configuration of the data storage system component values; and
create and store a new backup copy of the lockbox using the third set of SSV.

20. The system of claim 11 , wherein the first set of SSV includes a first subset of SSV derived from data storage system software component values and second subset of SSV derived from data storage system hardware component values, the hardware and software component values associated with a unique data storage system.

Assignees

• Emc Corp
• Emc Ip Holding Co Llc

Inventors

• Lazar Gregory W
• Puhov Peter
• Taylor Iii Millard C
• Qui Naizhong Chiu
• Dibb Thomas N

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F11/1448

  Management of the data involved in backup or backup restore · CPC title

• G06F11/1469 Primary

  Backup restoration techniques · CPC title

• G06F11/1458

  Management of the backup or restore process · CPC title

• G06F11/1451

  by selection of backup contents · CPC title