# US 10,484,174 B1 · Protecting an encryption key for data stored in a storage system that includes a plurality of storage devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,174 B1 - Document ID: US10484174B1 - Status: Granted - Kind: B1 - Application number: 15/801,139 - Filed: 2017-11-01 - Granted: 2019-11-19 - Earliest claimed: 2017-11-01 - Assignees: Pure Storage, Inc. - Applicants: Pure Storage, inc. - Inventors: Andrew Bernat; Alexandre Duchâteau; Marco Sanvido; Constantine Sapuntzakis; Kiron Vijayasankar - Web page: https://patentgrep.com/patent/US10484174B1 ## CPC - H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes} - H04L 9/0816: {Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 63/068: {using time-dependent keys, e.g. periodically changing keys (cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088)} - H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] - H04W 12/0431: Key distribution or pre-distribution; Key agreement - G06F 9/455: Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines - G06F 21/602: {Providing cryptographic facilities or services} - G06F 2221/2107: File encryption - H04L 9/321: {involving a third party or a trusted authority} - H04L 63/0815: {providing single-sign-on or federations} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 2463/062: applying encryption of the keys - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Protecting an encryption key for data stored in a storage system that includes a plurality of storage devices, including: reading, from at least a majority of the storage devices, a portion of an apartment key; reconstructing the apartment key using the portions of the apartment key read by the majority of the storage devices; unlocking the main portion of each of the storage devices utilizing the apartment key; reading, from the main portion of one of the storage devices, a portion of a third-party resource access key; requesting, from the third-party resource utilizing the third-party resource access key, an encryption key; receiving, from the third-party resource, the encryption key; and decrypting the data stored on the storage devices utilizing the encryption key. ## Claims ### Claim 1 A method of protecting an encryption key for data stored in a storage system that includes a plurality of storage devices, the method comprising: reading, from a majority of each of the storage devices, a portion of an apartment key, wherein the portion of the apartment key is stored in an unlocked portion of the majority of each of the storage devices, and wherein a main portion of the majority of each of the storage devices is locked; reconstructing the apartment key using portions of the apartment key read from the majority of each of the storage devices; unlocking the main portion of the majority of each of the storage devices by utilizing the apartment key; reading, from a main portion of a majority of one of the storage devices, a third-party resource access key; requesting, from third-party resource utilizing the third-party resource access key, the encryption key for data stored on the storage devices; receiving, from the third-party resource, the encryption key for data stored on the storage devices; and decrypting the data stored on the storage devices by utilizing the encryption key. ### Claim 2 (depends on 1) The method of claim 1 wherein unlocking the main portion of each of the storage devices utilizing the apartment key further comprises, for each storage device: hashing the apartment key with a device specific identifier; and unlocking the main portion of each of the storage devices utilizing the hash of the apartment key and the device specific identifier. ### Claim 3 (depends on 1) The method of claim 1 further comprising: detecting that the third-party resource access key is invalid; receiving a new third-party resource access key; and updating, in dependence upon the new third-party resource access key, the third-party resource access key that is stored within the storage devices. ### Claim 4 (depends on 1) The method of claim 1 wherein the third-party resource access key is encrypted. ### Claim 5 (depends on 4) The method of claim 4 wherein the third-party resource access key is encrypted with the apartment key. ### Claim 6 (depends on 1) The method of claim 1 wherein the third-party resource access key includes a Key Management Interoperability Protocol (‘KMIP’) certificate. ### Claim 7 (depends on 1) The method of claim 1 further comprising updating, upon the expiration of a predetermined period of time, each portion of the apartment key stored on each of the storage devices. ### Claim 8 An apparatus for protecting an encryption key for data stored in a storage system that includes a plurality of storage devices, the apparatus comprising: a computer processor; and a computer memory operatively coupled to the computer processor; wherein the computer memory having disposed within it computer program instructions that, when executed by the computer processor, cause the apparatus to carry out the steps of: reading, from a majority of each of the storage devices, a portion of an apartment key, wherein the portion of the apartment key is stored in an unlocked portion of the majority of each of the storage devices and wherein a main portion of the majority of each of the storage devices is locked; reconstructing the apartment key using portions of the apartment key read from the majority of each of the storage devices; unlocking the main portion of the majority of each of the storage devices by utilizing the apartment key; reading, from a main portion of a majority of one of the storage devices, a remote resource access key; requesting, from remote resource utilizing the remote resource access key, the encryption key for data stored on the storage devices; receiving, from the remote resource, the encryption key for data stored on the storage devices; and decrypting the data stored on the storage devices by utilizing the encryption key. ### Claim 9 (depends on 8) The apparatus of claim 8 wherein unlocking the main portion of each of the storage devices utilizing the apartment key further comprises, for each storage device: hashing the apartment key with a device specific identifier; and unlocking the main portion of each of the storage devices utilizing the hash of the apartment key and the device specific identifier. ### Claim 10 (depends on 8) The apparatus of claim 8 further comprising computer program instructions that, when executed by the computer processor, cause the apparatus to carry out the steps of: detecting that the remote resource access key is invalid; receiving a new remote resource access key; and updating, in dependence upon the new remote resource access key, the remote resource access key that is stored within the storage devices. ### Claim 11 (depends on 8) The apparatus of claim 8 wherein the remote resource access key is encrypted. ### Claim 12 (depends on 8) The apparatus of claim 8 wherein the remote resource access key includes a Key Management Interoperability Protocol (‘KMIP’) certificate. ### Claim 13 (depends on 8) The apparatus of claim 8 further comprising computer program instructions that, when executed by the computer processor, cause the apparatus to carry out the step of updating, upon the expiration of a predetermined period of time, each portion of the apartment key stored on each of the storage devices. ### Claim 14 (depends on 8) The apparatus of claim 8 wherein requesting, from the remote resource utilizing the remote resource access key, the encryption key for data stored on the storage devices further comprises: reading, from one of the storage devices, an encrypted version of the encryption key; and sending the encrypted version of the encryption key to the remote resource. ### Claim 15 (depends on 14) The apparatus of claim 14 wherein receiving, from the remote resource, the encryption key for data stored on the storage devices further comprises receiving a decrypted version of the encryption key. ### Claim 16 A storage system that includes a plurality of storage devices, the storage system including: a computer processor; and a computer memory operatively coupled to the computer processor; wherein the computer memory having disposed within it computer program instructions that, when executed by the computer processor, cause the storage system to carry out the steps of: reading, from a majority of each of the storage devices, a portion of an apartment key, wherein the portion of the apartment key is stored in an unlocked portion of the majority of each of the storage devices and wherein a main portion of the majority of each of the storage devices is locked; reconstructing the apartment key using portions of the apartment key read from the majority of each of the storage devices; unlocking the main portion of the majority of each of the storage devices by utilizing the apartment key; reading, from a main portion of a majority of one of the storage devices, a remote resource access key; requesting, from remote resource utilizing the remote resource access key, an encryption key for data stored on the storage devices; receiving, from the remote resource, the encryption key for data stored on the storage devices; and decrypting the data stored on the storage devices by utilizing the encryption key. ### Claim 17 (depends on 16) The storage system of claim 16 further comprising unlocking a main portion of each of the storage devices utilizing the apartment key. ### Claim 18 (depends on 16) The storage system of claim 16 further comprising computer program instructions that, when executed by the computer processor, cause the storage system to carry out the steps of: detecting that the remote resource access key is invalid; receiving a new remote resource access key; and updating, in dependence upon the new remote resource access key, the remote resource access key that is stored within the storage devices. ### Claim 19 (depends on 16) The storage system of claim 16 wherein the remote resource access key is encrypted. ### Claim 20 (depends on 16) The storage system of claim 16 wherein the remote resource access key includes a Key Management Interoperability Protocol (‘KMIP’) certificate.