Retrieval and Display of Encryption Labels From an Encryption Key Manager

A data storage drive comprising:

• a read/write drive for reading data from and writing data to a storage medium housed in a data storage cartridge loaded in the data storage drive;
• and
• a controller coupled to the read/write drive that is configured to process a first data key, a derived data key, and one or more encryption encapsulated data keys by:
• encoding data with the first data key to form encoded data;
• directing the read/write drive to:
• store the encoded data on the storage medium;
• store the first encrypted key comprising a firs valid key label to one or more locations on the storage medium;
• retrieve the first encrypted data key comprising a first key the valid label from one or more locations on the storage medium, and;
• decoding the stored encoded data with the extracted first data key to form unencoded data.

A storage system for enabling secure access to data in a removable storage cartridge, comprising:

• at least one key manager for generating a data key, wrapping the data key with an encrypting key to generate an encrypted data key with an associated valid key label, and subsequently discarding the data key and the encrypted data key;
• a tape storage library for generating a list of a plurality of valid key labels provided by at least one key manager;
• a tape drive for securely receiving the data key from the key manager and for encoding data with the data key to form encoded data;
• and
• a removable storage cartridge for storing the encoded data and for storing the encrypted data key in one or more locations on the removable storage cartridge.

A tamper-resistant data storage cartridge, comprising:

• a housing;
• a re-writable recording medium contained within the housing;
• and
• one or more encrypted data keys comprising respective valid key labels stored on the recording medium, where each encrypted data key is formed by encrypting a data key with a key encrypting key and where the data key is used to encrypt data for storage on the recording medium.