Data re-encryption in a storage system
AssigneePure Storage, Inc.
InventorsAndrew Bernat, Ethan Miller
Life of this patent
Estimating the term…
Abstract
Periodically re-encrypting user data stored on a storage device, including: detecting that a data encryption key should be decommissioned; and for user data stored on the storage device that is encrypted with the data encryption key: reading the user data that is encrypted with the data encryption key from the storage device; re-encrypting the user data utilizing a current data encryption key; and writing the user data that is encrypted utilizing the current data encryption key to the storage device.
Claims20
A method comprising:
- detecting that a data encryption key should be decommissioned;
- and
- determining, by a garbage collection process, that user data stored in a first location of a storage device is encrypted with the data encryption key:
- reading the user data that is encrypted with the data encryption key from the first location of the storage device;
- re-encrypting the user data utilizing a current data encryption key;
- and
- writing the user data that is encrypted utilizing the current data encryption key to a second location of the storage device.
A storage device that includes a computer processor and a computer memory, the computer memory including computer program instructions that, when executed by the computer processor, cause the storage device to carry out the steps of:
- detecting that a data encryption key should be decommissioned;
- and
- determining, by a garbage collection process, that user data stored in a first location of the storage device is encrypted with the data encryption key:
- reading the user data that is encrypted with the data encryption key from the first location of the storage device;
- re-encrypting the user data utilizing a current data encryption key;
- and
- writing the user data that is encrypted utilizing the current data encryption key to a second location of the storage device.
A storage system that includes a plurality of storage devices, the storage system including a computer processor and a computer memory, the computer memory including computer program instructions that, when executed by the computer processor, cause the computer processor to carry out the steps of:
- detecting that a data encryption key should be decommissioned;
- and
- determining, by a garbage collection process, that user data stored in a first location of the storage system is encrypted with the data encryption key:
- reading the user data that is encrypted with the data encryption key from the first location of the storage system;
- re-encrypting the user data utilizing a current data encryption key;
- and
- writing the user data that is encrypted utilizing the current data encryption key to a second location of the storage system.
Dependencies are inferred from the claim text.