Loading patent…
AssigneeInternational Business Machines Corporation
InventorsZah Barzik, Ronen Gazit, Ofer Leneman, Amit Margalit
Estimating the term…
A storage system (system) includes two storage devices (first device and second device). The first device stores encrypted user data prior to being enrolled with an external key server. The system generates a device access key (DAK) and a device encryption key (DEK) used to encrypt such user data and encrypts the DEK with the DAK to generate an encrypted DEK (DEK′). The system stores DEK′ in the second device and stores DAK in the first device. The system enrolls the first device with the key server and receives a secure encryption key (SEK). The system obtains DEK′ and DAK, which are subsequently deleted from the first and second storage device, respectively. A new DAK′ is generated utilizing SEK and a first device identifier. The DEK is encrypted utilizing DAK′ to form DEK″. The system indicates DAK′ is an externally derived key and saves DEK″ to the second device.
A storage system comprising:
A computer program product for a storage system hot encrypting user data being stored upon a first storage device that stores user data received by one or more computers communicatively connected to the storage system, prior to the first storage device being enrolled with an external key server and resultantly being assigned a secure access key (SEK), the computer program product comprising computer readable storage medium having program instructions embodied therewith, the program instructions are readable to cause a processor to:
A hot encryption method of a storage system comprising a first storage device that stores user data received by one or more computers communicatively connected to the storage system, a second storage device that does not store any user data received by any of the one or more computers communicatively connected to the storage system, the method comprising:
Dependencies are inferred from the claim text.