Selective encryption of data stored on removable media in an automated data storage library

A data storage system, comprising:

• a plurality of storage shelves for storing data cartridges within a library housing unit, a data storage cartridge including data storage medium;
• a data storage drive operable to write data to the data storage medium;
• a library controller coupled to receive data access requests from a host computer;
• a robot accessor for transporting data storage cartridges between the storage shelves and the data storage drive under the direction of the library controller;
• a key server, coupled to the library controller, on which one or more encryption keys are stored;
• an encryption policy table in which are stored one or more encryption policies, each encryption policy including an identifier of one or more data cartridges associated with the encryption policy, and an identification of an encryption key to be used to encrypt data written to media in the at least one data cartridge;
• and
• a library-drive interface through which the data storage drive transmits a request for an encryption key for a specified data cartridge to the library controller in response to the storage drive matching the specified data cartridge with a corresponding encryption policy and through which the library controller, after obtaining the requested encryption key from the key server, transmits the requested encryption key to the data storage drive, after which the storage drive encrypts data in accordance with the requested encryption key and writes the encrypted data on the media in the specified data cartridge.

A controller associated with a data storage library, comprising:

• a user interface through which to receive a user input of one or more encryption policies, including a level of encryption, one or more cartridge identifiers to be associated with each encryption policy, each cartridge identifier representing a data cartridge or a range of data cartridges, and an identification of an encryption key to be used to encrypt data written to media in the at least one data cartridge;
• an encryption policy table in which the at least one encryption policy is stored;
• a key server interface coupled to a key server from which encryption keys are obtained;
• a library-drive interface through which to transmit the encryption policies and associated cartridge identifiers to a storage drive in the library;
• a host interface through which to receive a request from a host to access a specified data cartridge stored in a storage cell in the library;
• an accessor interface through which to control a robotic accessor to retrieve and transport the specified data cartridge to a storage drive;
• the library-drive interface further operable to receive a request from the storage drive for an encryption key in response to the storage drive matching the specified data cartridge with a corresponding encryption policy;
• the key server interface further operable for obtaining the requested encryption key from the key server;
• and
• the library-drive interface further operable to transmit the encryption key to the storage drive, whereupon the storage drive encrypts data and writes the encrypted data to the specified data cartridge.

A computer readable non-transitory medium usable with a programmable computer having computer-readable code embodied therein for encrypting data on removable media in a data storage library, the computer-readable code comprising instructions for:

• creating an encryption policy table;
• entering one or more encryption policies into the table, each encryption policy including a level of encryption, an identifier of at least one data cartridge to be associated with the encryption policy, and an identification of an encryption key to be used to encrypt data written to media in the at least one data cartridge;
• storing the encryption key in one of a key server and a key store coupled to the key server;
• receiving a request from a host to access a specified data cartridge;
• selecting and transporting the specified data cartridge from the storage cell to a storage drive;
• receiving a request from the storage drive for the encryption key in response to the storage drive matching the specified data cartridge with the encryption policy associated with the specified data cartridge;
• accessing the encryption policy table to select the encryption policy associated with the specified data cartridge;
• in response to the selected encryption policy, transmitting the encryption key for the specified data cartridge from the key server to the storage drive;
• and
• encrypting data in the storage drive in accordance with the obtained encryption key and writing the encrypted data on media in the specified data cartridge.