Back to results
US 7,461,267 B2Granted
Method and apparatus for cryptographic conversion in a data storage system
AssigneeHitachi, Ltd.
InventorNobuyuki Osaki
Life of this patent
Estimating the term…
Abstract
When data is encrypted and stored for a long time, encryption key(s) and/or algorithm(s) should be updated so as not to be compromised due to malicious attack. To that end, stored encrypted data is converted in the storage system with new set of cryptographic criteria. During this process, read and write requests can be serviced.
Claims14
A storage system configured to be coupled to a host computer via a network, the storage system comprising:
- a storage having at least one physical storage device;
- an encrypted data area in the storage, the encrypted data area comprising data encrypted with a first encryption key;
- a re-encrypted data area in the storage, the re-encrypted data area comprising data encrypted with a second encryption key;
- and
- a controller coupled to the storage,
- wherein the controller maintains re-encryption progress information for distinguishing between the encrypted data area and the re-encrypted data area, updates the re-encryption progress information by decryption of the data stored in the encrypted data area using the first encryption key and encryption of the decrypted data using the second encryption key, and processes a read request from the host computer via the network with one of the first encryption key or the second encryption key based on the re-encryption progress information,
- wherein said read request is received while said controller performs decryption and subsequent encryption of the data.
4 more elements
A storage system configured to be coupled to a host computer via a network, the storage system comprising:
- a storage including a first encrypted data area storing data encrypted with a first encryption key and a second encrypted data area storing data encrypted with a second encryption key;
- and
- a controller coupled to the storage,
- wherein the controller maintains re-encryption progress information for distinguishing between the encrypted data area and the re-encrypted data area, updates the re-encryption progress information by decryption of the data stored in the encrypted data area using the first encryption key and encryption of the decrypted data using the second encryption key, and processes a read request from the host computer via the network with one of the first encryption key or the second encryption key based on the re-encryption progress information,
- wherein said read request is received while said controller performs decryption and subsequent encryption of the data.
2 more elements
A storage system comprising;
- an interface to receive read and write requests from a host computer;
- a storage including at least one physical storage device;
- a controller including a processor and a memory;
- wherein said memory stores computer program code for encrypting data using a first encryption key and for re-encrypting said encrypted data using said first encryption key and a second encryption key,
- wherein said controller performs said re-encrypting by decrypting said encrypted data using said first encryption key and by encrypting said decrypted data using said second encryption key, and updates re-encryption progress information,
- wherein if said read request from said host computer is received, said controller selects said first encryption key or said second encryption key based on said re-encryption progress information,
- wherein said read request is received while said controller performs said re-encryption.
4 more elements
Dependencies are inferred from the claim text.