Method and system for automatically migrating encryption keys between key managers in a network storage system

A computer-implemented method comprising:

• authenticating, by a remote key manager, a communication channel between the remote key manager and a protected key manager;
• requesting, by the remote key manager from the protected key manager, a key for performing cryptographic operations on data responsive to a first cryptographic request of a storage system, the key being available at the protected key manager but not at the remote key manager;
• securely receiving the key at the remote key manager from the protected key manager across the authenticated communication channel in response to the requesting, the key encrypted by the protected key manager using a first link key;
• accessing, by the remote key manager, the received key using a second link key, the second link key comprising a replication of the first link key;
• and
• wherein the step of authenticating the communication channel comprises verifying identities of the protected key manager and the remote key manager prior to sending data directly between the protected key manager and remote key manager;
• performing, by the remote key manager using the accessed key, cryptographic operations on the data responsive to a second cryptographic request of the storage system in disaster recovery of the protected key.

A computer-implemented method comprising:

• managing and storing, by a first key manager, an encryption key for securing data responsive to a cryptographic request of a storage system;
• securely providing, by the first key manager, the encryption key to a second key manager across an authenticated secure communication channel in response to a request from the second key manager, the encryption key wrapped with a first link key;
• and
• wherein the step of securely providing the encryption key to the second key manager includes:
• identifying, by the first key manager, the encryption key;
• encrypting, by the first key manager, the encryption key with a first link key to produce an encrypted encryption key;
• and
• sending, by the first key manager, the encrypted encryption key to the second key manager across the authenticated communication channel;
• wherein establishing the authenticated communication channel comprises verifying identities of the first key manager and the second key manager prior to sending data directly between the first key manager and the second key manager;
• managing and storing, by the second key manager, the encryption key for ensuring accessibility to encrypted data of the storage system in response to a failure of the first key manager, the second key manager accessing the encryption key using a second link key having the same encoding as the first link key.

A computer-implemented method comprising:

• generating, by a first key manager, an encryption key for securing data of a storage server;
• securely providing, by the first key manager, the encryption key to a second key manager across an authenticated secure communication channel in response to a request from the second key manager, the encryption key wrapped with a first hardware key;
• wherein the step of securely providing the encryption key to the second key manager includes:
• identifying, by the first key manager, the encryption key;
• encrypting, by the first key manager, the encryption key with the first hardware key to produce an encrypted encryption key;
• and
• sending, by the first key manager, the encrypted encryption key to the second key manager across the authenticated communication channel;
• wherein establishing the authenticated communication channel comprises verifying identities of the first key manager and the second key manager prior to sending data directly between the first key manager and second key manager;
• distributing, by the storage system, requests for cryptographic operations on the data between the first key manager and the second key manager for performing cryptographic operations on the data.

A system comprising:

• a first key manager configured to perform primary cryptographic operations on data of a storage system;
• a second key manager configured to perform secondary cryptographic operations on the data;
• and
• a security manager configured to authenticate a communication channel between the first key manager and the second key manager;
• wherein the security manager is configured to verify identities of the first key manager and the second key manager prior to data being sent directly between the first key manager and the second key manager;
• wherein the first key manager is configured to:
• identify an encryption key;
• encrypt the encryption key with a first hardware key;
• and
• send the encrypted encryption key to the second key manager across the authenticated communication channel in response to a request by the second key manager;
• the second key manager configured to store the encryption key and perform the secondary cryptographic operations on the data using the encryption key when the first key manager fails to perform the primary cryptographic operations on the data.

A system comprising:

• a linking engine configured to authenticate a communication channel between a first key manager and a second key manager for migrating data from the first key manager to the second key manager;
• wherein the linking engine is configured to verify identities of the first key manager and the second key manager prior to data being sent directly between the first key manager and second key manager;
• a key generator configured to generate a key for the first key manager for securing data of a storage system in response to a request from the storage system for the key;
• a wrapping engine configured to wrap the key using a first link key of the first key manager and unwrap the key using a second link key of the second key manager;
• a migration engine configured to send the key wrapped with the first link key across the authenticated communication channel from the first key manager to the second key manager in response to a request from the second key manager for the key;
• and
• a cryptographic engine for performing a cryptographic operation using the unwrapped key at the second key manager for ensuring accessibility to the data in the event the first key manager fails.