Encryption key management in a data storage system communicating with asynchronous key servers

A system, comprising:

• a data storage device having a processor and a computer program product;
• and
• an encryption key server and another key server, each configured to store an encryption key;
• wherein the computer program product comprises a computer readable storage medium having program instructions embodied therewith, the program instructions executable by the processor of the data storage device to cause processor operations, the processor operations comprising:
• issuing a prepare for enable command to request a first encryption key from the encryption key server;
• in association with the prepare for enable command, transitioning state machine logic from an unconfigured state to a prepare for enable state;
• in association with the prepare for enable state:
• upon receiving the requested first encryption key, storing the received first encryption key and transitioning state machine logic from the prepare for enable state to an enabling state;
• and
• in association with the enabling state:
• enablement logic attempting to retrieve a mirror copy of the first encryption key from another key server to confirm successful mirroring of the first encryption key to another key server, and upon successful retrieval of at least one mirror copy of the first encryption key from another key server, activating the first encryption key to become an activated encryption key, enabling data encryption using the activated first encryption key, and causing state machine logic to transition from the enabling state to an enabled state in which encryption of data using the activated encryption key has been enabled so that encryption of data using the activated first encryption key is enabled in response to a combination of receipt of the first encryption key from one encryption key server and retrieval of the mirror copy of the first encryption key from another key server.

A method comprising:

• processor operations of a data storage device for use with an encryption key server and another key server, each configured to store an encryption key, the processor operations comprising:
• issuing a prepare for enable command to request a first encryption key from the encryption key server;
• in association with the prepare for enable command, transitioning state machine logic from an unconfigured state to a prepare for enable state;
• in association with the prepare for enable state:
• upon receiving the requested first encryption key, storing the received first encryption key and transitioning state machine logic from the prepare for enable state to an enabling state;
• and
• in association with the enabling state:
• enablement logic attempting to retrieve a mirror copy of the first encryption key from another key server to confirm successful mirroring of the first encryption key to another key server, and upon successful retrieval of at least one mirror copy of the first encryption key from another key server, activating the first encryption key to become an activated encryption key, enabling data encryption using the activated encryption key, and causing state machine logic to transition from the enabling state to an enabled state in which encryption of data using the activated first encryption key has been enabled so that encryption of data using the activated first encryption key is enabled in response to a combination of receipt of the first encryption key from one encryption key server and retrieval of the mirror copy of the first encryption key from another key server.