Protected datasets on tape cartridges

A linear-tape open (LTO) tape drive comprising:

• a drive memory to store a first shared secret and a second shared secret;
• an opening to receive an LTO tape cartridge, wherein the LTO tape cartridge comprises tape media and a tape memory separate from the tape media, the separate tape memory storing a protected dataset, a pre-authorization code, a creation timestamp, and an initialization drive ID;
• a hardware processor to derive an authorization code using a code derivation function, the first shared secret, and the pre-authorization code, wherein the pre-authorization code is read by the LTO tape drive from separate tape memory of the LTO tape cartridge;
• a key engine to generate a decryption key for the protected dataset by inputting the authorization code, the second shared secret, the creation timestamp, and the initialization drive ID into a key derivation function, wherein the initialization drive ID is read from the separate tape memory;
• and
• the hardware processor further to decrypt the protected dataset from the separate tape memory using the decryption key, wherein the protected dataset comprises cartridge configuration information.

A method comprising:

• receiving, at a processor of a linear-tape open (LTO) tape drive, a pre-authorization code, a creation timestamp, and an initialization drive ID from a separate tape memory of an LTO tape cartridge;
• deriving, with the processor, an authorization code using a code derivation function, a first shared secret stored on the LTO tape drive, and the pre-authorization code read from the separate tape memory;
• generating, with the processor, a decryption key using a key derivation function, a second shared secret stored on the LTO drive, the authorization code, the creation timestamp, and the initialization drive ID;
• and
• decrypting, with the processor, a protected dataset from the separate tape memory using the decryption key, wherein the protected data comprises cartridge configuration information.