File access control on magnetic tape by encrypting metadata

A computer program product for encrypting metadata on a magnetic tape, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, wherein the computer readable storage medium is not a transitory signal per se, the program instructions readable and/or executable by a processor to cause the processor to perform a method comprising:

• identifying, by the processor, a magnetic tape in a storage library having a plurality of magnetic tapes therein, wherein the identified magnetic tape has an adequate amount of free space thereon to perform a write request and has a lowest access time associated therewith in comparison to access times associated with a remainder of the magnetic tapes in the storage library;
• determining, by the processor, whether the magnetic tape is currently loaded in a tape drive;
• sending, by the processor, one or more instructions to load the magnetic tape into the tape drive in response to determining that the magnetic tape is not currently loaded in a tape drive;
• writing, by the processor, an index to the magnetic tape, wherein the index includes:
• metadata corresponding to a plurality of files stored on the magnetic tape, and
• metadata corresponding to a directory structure of the plurality of files;
• using, by the processor, a first key to encrypt a first portion of the metadata in the index corresponding to the plurality of files;
• using, by the processor, a second key to encrypt a first portion of the metadata in the index corresponding to the directory structure of the plurality of files;
• receiving, by the processor, an access request for data stored on the magnetic tape;
• receiving, by the processor, the first and second keys;
• using, by the processor, the received first and second keys to decrypt a portion of the encrypted metadata in the index of the magnetic tape;
• and
• in response to decrypting a portion of the encrypted metadata in the index of the magnetic tape, outputting, by the processor, a resulting file,
• wherein the resulting file is based on the portion of the metadata in the index of the magnetic tape decrypted by the received first and second keys,
• wherein a remainder of the encrypted metadata which was not decrypted by the received first and second keys is intentionally falsified and included in the resulting file output in decrypted form,
• wherein the index is written to the magnetic tape in response to receiving the write request from a particular entity,
• wherein the first and second keys are key encrypted keys which correspond to the particular entity,
• wherein data in the file itself is not encrypted,
• wherein the data in the file itself is stored on the magnetic tape in compressed form.

A computer-implemented method, comprising:

• receiving an access request for data stored on a magnetic tape, wherein the magnetic tape includes an index having metadata corresponding to files stored on the magnetic tape and metadata corresponding to a directory structure of the files, wherein at least some of the metadata corresponding to the files stored on the magnetic tape is encrypted with a first key, wherein at least some of the metadata corresponding to the directory structure of the files is encrypted with a second key;
• receiving first and second keys which correspond to a particular entity;
• using the received first key to decrypt a portion of the encrypted metadata in the index of the magnetic tape corresponding to the file;
• using the received second key to decrypt a portion of the encrypted metadata in the index of the magnetic tape corresponding to the directory structure of the file;
• outputting a resulting file to a read buffer;
• and
• sending one or more instructions to compile data in the resulting file and/or directory information,
• wherein the resulting file is based on the portion of the metadata in the index of the magnetic tape decrypted by the received key first and second keys,
• wherein a remainder of the encrypted metadata which was not decrypted by the received first and second keys is intentionally falsified and included in the resulting file output to the read buffer in decrypted form,
• wherein data in the file itself is not encrypted,
• wherein the data in the file itself is stored on the magnetic tape in compressed form,
• wherein the index is written to the magnetic tape in response to receiving a write request from a particular entity,
• wherein the first and second keys are key encrypted keys which correspond to the particular entity,
• wherein writing the index to the magnetic tape includes:
• identifying a magnetic tape in a storage library having a plurality of magnetic tapes therein, wherein the identified magnetic tape has an adequate amount of free space thereon to perform the write request and has a lowest access time associated therewith in comparison to access times associated with a remainder of the magnetic tapes in the storage library,
• determining whether the magnetic tape is currently loaded in a tape drive, and
• sending one or more instructions to load the magnetic tape into the tape drive in response to determining that the magnetic tape is not currently loaded in a tape drive,
• wherein the index is written to the magnetic tape.