Data archiving technique for encrypted data

A computerized data storage system comprising:

• an encryption key management module operable to manage a plurality of encryption keys;
• an archive module operatively coupled with the encryption key management module and one or more entities, the archive module being operable to receive data including encrypted data from the one or more entities and cause the received data to be archived as archived data;
• and
• an archive storage operatively coupled with archive module and operable to store the archived data,
• wherein, in response to receipt of the encrypted data, the archive module is operable to retrieve an encryption key from the encryption key management module, to decrypt the received encrypted data using the retrieved encryption key, provide one or more search indices or metadata for decrypted data and re-encrypt the decrypted data before causing the re-encrypted data to be archived in the archive storage.

A computer-implemented method comprising:

• managing a plurality of encryption keys;
• receiving data including encrypted data from one or more entities, the encrypted data having been encrypted with one or more of the plurality of encryption keys;
• in response to receipt of the encrypted data, retrieving an encryption key from the managed plurality of encryption keys;
• decrypting the received encrypted data using the retrieved encryption key;
• providing one or more search indices or metadata for decrypted data;
• re-encrypting the decrypted data;
• and
• causing the re-encrypted data to be archived in an archive storage system.

A computer-implemented method for retrieving stored data, the method comprising:

• retrieving data;
• invoking a security module if the data includes encrypted data;
• if a encryption key is not found within the encrypted data, requesting the encryption key from a key management service module;
• decrypting the encrypted data using the encryption key;
• creating search indices or metadata for decrypted data;
• re-encrypting the data including the decrypted data;
• and
• storing re-encrypted data and the search indices or metadata,
• wherein the method is carried out at a host computer coupled to a storage system, and the data is retrieved from the storage system by the host computer, the host computer comprising an archive management functionality, and
• wherein the key management service module is located at the host computer.

A computer-implemented method for data storage, the method comprising:

• receiving data;
• invoking a security module if the data includes encrypted data;
• if a encryption key is not found within the encrypted data, requesting the encryption key from a key management service module;
• decrypting the encrypted data using the encryption key;
• creating search indices or metadata for decrypted data;
• re-encrypting the data including the decrypted data;
• and
• storing re-encrypted data and the search indices or metadata,
• wherein the method is carried out at an archive storage coupled to a host computer and the data is received by the archive storage from the host computer, the host computer including archive management functionalities, and
• wherein the key management service module is located at the host computer.

A computer-readable medium embodying one or more sequences of instructions, which, when executed by one or more processors, causes the one or more processors to perform a method comprising:

• managing a plurality of encryption keys;
• receiving data including encrypted data from one or more entities, the encrypted data having been encrypted with one or more of the plurality of encryption keys;
• in response to receipt of the encrypted data, retrieving an encryption key from the managed plurality of encryption keys;
• decrypting the received encrypted data using the retrieved encryption key;
• providing one or more search indices or metadata for decrypted data;
• re-encrypting the decrypted data;
• and
• causing the re-encrypted data to be archived.