Methods and devices for secure access control to a data storage system and for data archiving

An access control device for secure access control to a data storage system, the access control device comprising:

• a processor;
• and
• a memory having stored therein a set of instructions which, when executed by the processor, causes the processor to control access to a data storage system for a host apparatus by:
• as part of a first operating mode of the access control device, receiving user data (D) from the host apparatus and transmitting of the same in unchanged or modified form (D/D′) to the data storage system for local storage;
• exchanging a first cryptographic secret (K) with a computer system to enable data to be encrypted by the access control device as a function of the first cryptographic secret (K);
• receiving a data read request (RR) for at least a portion of the user data stored in the data storage system;
• in response to the data read request (RR), transitioning the access control device to a second mode of operation in which the access control device is configured to carry out read access but no write or delete access to the data storage system;
• and
• in the second operating mode, retrieving user data (D/D′) requested according to the data read request (RR) from the data storage system, encrypting the same using the first cryptographic secret (K) or a key derived as a function thereof in accordance with a key generation rule and transmitting the user data encrypted in this way (K(D/D′)) to a predetermined user data recipient;
• wherein as part of the method, the user data (D/D′) is processed in such a way that the encrypted user data (K/D/D′) transmitted as part of the second operating mode represent an information which is extractable therefrom for the user data recipient without any decryption of the encrypted user data (K(D/D′)), which information represents an identity (ID) of the access control device and/or of the data storage system or which allows a clear deduction of the same.

A non-transitory, computer-readable medium comprising instructions stored therein which, when executed by a processor of an access control device causes the processor to control access to a data storage system for a host apparatus by:

• as part of a first operating mode of the access control device, receiving user data (D) from the host apparatus and transmitting of the same in unchanged or modified form (D/D′) to the data storage system for local storage;
• exchanging a first cryptographic secret (K) with a computer system to enable data to be encrypted by the access control device as a function of the first cryptographic secret (K);
• receiving a data read request (RR) for at least a portion of the user data stored in the data storage system;
• in response to the data read request (RR), transitioning the access control device to a second mode of operation in which the access control device is configured to carry out read access but no write or delete access to the data storage system;
• and
• in the second operating mode, retrieving user data (D/D′) requested according to the data read request (RR) from the data storage system, encrypting the same using the first cryptographic secret (K) or a key derived as a function thereof in accordance with a key generation rule and transmitting the user data encrypted in this way (K(D/D′)) to a predetermined user data recipient;
• wherein as part of the method, the user data (D/D′) is processed in such a way that the encrypted user data (K/D/D′) transmitted as part of the second operating mode represent an information which is extractable therefrom for the user data recipient without any decryption of the encrypted user data (K(D/D′)), which information represents an identity (ID) of the access control device and/or of the data storage system or which allows a clear deduction of the same.

A data archiving method for protected archiving of data from a data storage system protected against access by an access control device, wherein the data archiving method is executed by a data archiving device and comprises:

• transmitting a data read request (RR) to the access control device in order to request the latter to read and transmit user data (D/D′) stored in the data storage device to the data archiving device;
• forwarding between the access control device and the computer system of key exchange information used between the two as part of an exchange of a first cryptographic secret (K) between the two;
• as a user data recipient, receiving user data cryptographically encrypted as a function of the first cryptographic secret (K) and read from the data storage system by the access control device in response to the data read request (RR);
• and
• archiving the received encrypted user data (K/D/D′) in a data archive.

A data archiving device comprising:

• a processor;
• and
• a memory having stored therein a set of instructions which, when executed by the processor, causes the processor to archive protected data in a data archive protected against access by an access device, wherein archiving the protected data comprises:
• transmitting a data read request (RR) to the access control device in order to request the latter to read and transmit user data (D/D′) stored in the data storage device to the data archiving device;
• forwarding between the access control device and the computer system of key exchange information used between the two as part of an exchange of a first cryptographic secret (K) between the two;
• as a user data recipient, receiving user data cryptographically encrypted as a function of the first cryptographic secret (K) and read from the data storage system by the access control device in response to the data read request (RR);
• and
• archiving the received encrypted user data (K/D/D′) in a data archive.

A non-transitory, computer-readable medium comprising instructions stored therein which, when executed by a processor of a data archiving device, causes the processor to archive protected data in a data archive protected against access by an access device, wherein archiving the protected data comprises:

• transmitting a data read request (RR) to the access control device in order to request the latter to read and transmit user data (D/D′) stored in the data storage device to the data archiving device;
• forwarding between the access control device and the computer system of key exchange information used between the two as part of an exchange of a first cryptographic secret (K) between the two;
• as a user data recipient, receiving user data cryptographically encrypted as a function of the first cryptographic secret (K) and read from the data storage system by the access control device in response to the data read request (RR);
• and
• archiving the received encrypted user data (K/D/D′) in a data archive.

A data archiving system comprising:

• an access control device;
• and
• a data archiving device;
• wherein the access control device provides secure access control to a data storage system for a host apparatus by:
• as part of a first operating mode of the access control device, receiving user data (D) from the host apparatus and transmitting of the same in unchanged or modified form (D/D′) to the data storage system for local storage;
• exchanging a first cryptographic secret (K) with a computer system to enable data to be encrypted by the access control device as a function of the first cryptographic secret (K);
• receiving a data read request (RR) for at least a portion of the user data stored in the data storage system;
• in response to the data read request (RR), transitioning the access control device to a second mode of operation in which the access control device is configured to carry out read access but no write or delete access to the data storage system;
• and
• in the second operating mode, retrieving user data (D/D′) requested according to the data read request (RR) from the data storage system, encrypting the same using the first cryptographic secret (K) or a key derived as a function thereof in accordance with a key generation rule and transmitting the user data encrypted in this way (K(D/D′)) to a predetermined user data recipient;
• wherein as part of the method, the user data (D/D′) is processed in such a way that the encrypted user data (K/D/D′) transmitted as part of the second operating mode represent an information which is extractable therefrom for the user data recipient-without any decryption of the encrypted user data (K(D/D′)), which information represents an identity (ID) of the access control device and/or of the data storage system or which allows a clear deduction of the same;
• and
• wherein the data archiving device provides protected archiving of data from the data storage system by:
• transmitting a data read request (RR) to the access control device in order to request the latter to read and transmit user data (D/D′) stored in the data storage device to the data archiving device;
• forwarding between the access control device and the computer system of key exchange information used between the two as part of an exchange of a first cryptographic secret (K) between the two;
• as a user data recipient, receiving user data cryptographically encrypted as a function of the first cryptographic secret (K) and read from the data storage system-by the access control device in response to the data read request (RR);
• and
• archiving the received encrypted user data (K/D/D′) in a data archive.