# US 11,113,409 B2 · Efficient rekey in a transparent decrypting storage array

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,113,409 B2
- Document ID: US11113409B2
- Status: Granted
- Kind: B2
- Application number: 16/172,329
- Filed: 2018-10-26
- Published: 2020-04-30
- Granted: 2021-09-07
- Earliest claimed: 2018-10-26
- Assignees: Pure Storage, Inc.
- Applicants: Pure Storage, Inc.
- Inventors: Constantine P. Sapuntzakis; Kiron Vijayasankar; Yuval Frandzel
- Web page: https://patentgrep.com/patent/US11113409B2

## CPC

- G06F 21/602: {Providing cryptographic facilities or services}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00)
- H04L 9/0822: {using key encryption key}
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 67/1095: Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
- H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
- G06F 2212/1052: Security improvement
- G06F 2212/402: Encrypted data
- G06F 2221/2107: File encryption
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method of efficient rekey in a transparent decrypting storage array includes receiving an instruction to rekey data on a storage array, wherein the instruction identifies first encryption information and second encryption information. The method further includes decrypting, by a processing device of a storage array controller, the data using the first encryption information to generate decrypted data. The method further includes encrypting the decrypted data using the second encryption information to generate encrypted data.

## Claims

### Claim 1

A method, comprising:
decrypting, by a processing device of a storage array controller, encrypted write data to be stored at a storage array and encrypting, by the processing device of the storage array controller, read data to be sent by the storage array controller to a client device using a first encryption key;
receiving an instruction to rekey data at the storage array, wherein the instruction identifies first encryption information that identifies the first encryption key and second encryption information that identifies a second encryption key, and;
writing, by the processing device of the storage array controller, metadata that instructs a storage application executed by the processing device of the storage array controller to use the second encryption key to encrypt the data for subsequent read operations and decrypt the data for subsequent write operations.

### Claim 2 (depends on 1)

The method of claim 1, wherein the first encryption information comprises: a current encryption algorithm and a current initialization vector scheme.

### Claim 3 (depends on 2)

The method of claim 2, wherein the first encryption information further comprises: a proof of possession of the current key.

### Claim 4 (depends on 2)

The method of claim 2, wherein the second encryption information comprises: a desired key, a desired encryption algorithm, and a desired initialization vector scheme.

### Claim 5 (depends on 1)

The method of claim 1, wherein the instruction further identifies a range of logical block addresses corresponding to the data.

### Claim 6 (depends on 1)

The method of claim 1, wherein the rekey instruction is part of a Small Computer System Interface (SCSI), Non-Volatile Memory Express (NVMe), Presentational State Transfer (REST), or vStorage Application Programming Interface for Storage Awareness (VASA) instruction set.

### Claim 7 (depends on 1)

The method of claim 1, further comprising: before the instruction to rekey the data on the storage array is accepted, authenticating the application to verify that the application is authorized to modify the data.

### Claim 8 (depends on 1)

The method of claim 1, further comprising: copying the encrypted data to a target location, wherein the rekey instruction comprises an instruction to copy the data to the target location identified by the rekey instruction.

### Claim 9

A storage system comprising:
a storage array comprising one or more storage devices; and
a storage array controller coupled to the storage array, the storage array controller to:
decrypt encrypted write data to be stored at a storage array and encrypt read data to be sent by the storage array controller to a client device using a first encryption key;
receive an instruction to rekey data at the storage array, wherein the instruction identifies first encryption information that identifies the first encryption key and second encryption information that identifies a second encryption key, and;
writing, by the storage array controller, metadata that instructs a storage application executed by the storage array controller to use the second encryption key to encrypt the data for subsequent read operations and decrypt the data for subsequent write operations.

### Claim 10 (depends on 9)

The storage system of claim 9, wherein the first encryption information comprises: a current encryption algorithm and a current initialization vector scheme.

### Claim 11 (depends on 10)

The storage system of claim 10, wherein the first encryption information further comprises: a proof of possession of the current key.

### Claim 12 (depends on 10)

The storage system of claim 10, wherein the second encryption information comprises: a desired key, a desired encryption algorithm, and a desired initialization vector scheme.

### Claim 13 (depends on 9)

The storage system of claim 9, wherein the instruction further identifies a range of logical block addresses corresponding to the data.

### Claim 14 (depends on 9)

The storage system of claim 9, wherein the rekey instruction is part of a Small Computer System Interface (SCSI), Non-Volatile Memory Express (NVMe), Presentational State Transfer (REST), or vStorage Application Programming Interface for Storage Awareness (VASA) instruction set.

### Claim 15 (depends on 9)

The storage system of claim 9, the storage array controller further to: before the instruction to rekey the data on the storage array is accepted, authenticating the application to verify that the application is authorized to modify the data.

### Claim 16 (depends on 9)

The storage system of claim 9, wherein the rekey instruction comprises an instruction to copy the data to a target location identified by the rekey instruction, and wherein the storage array controller is further to: copy the encrypted data to the target location.