Protected datasets on tape cartridges

A linear-tape open (LTO) tape drive comprising:

• a drive memory to store a shared secret;
• an opening to receive an LTO tape cartridge, wherein the cartridge comprises tape media and a tape memory separate from the tape media, the separate tape memory storing a protected dataset, an authorization code, a creation timestamp, and an initialization drive ID;
• and
• a key engine to generate a decryption key for the protected dataset by inputting the authorization code, the shared secret, and the initialization drive ID into a key derivation function, wherein the authorization code and the initialization drive ID are read from the separate tape memory.

A method comprising:

• receiving, at a processor of a tape drive, a pre-authorization code, a creation timestamp, and an initialization drive ID from a separate tape memory of an LTO tape cartridge;
• deriving, with the processor, an authorization code using a code derivation function, a first shared secret, and the pre-authorization code;
• generating, with the processor, a decryption key using a key derivation function, a second shared secret, the authorization code, the creation timestamp, and the initialization drive ID;
• and
• decrypting, with the processor, a protected dataset from the separate tape memory using the decryption key.