System and method for providing encryption in storage operations in a storage network, such as for use by application service providers that provide data storage services

A storage management system for storing data for a user, the system comprising:

• means for generating an encryption key associated with data for the user;
• means for encrypting the data belonging to the user using the generated encryption key to create encrypted data;
• means for storing the encrypted data in a data center associated with a third party;
• means for encrypting the encryption key to create an encrypted encryption key such that a password or other information set by the user is required to decrypt the encrypted encryption key;
• and
• means for storing the encrypted encryption key such that the encrypted encryption key is accessible to allow the encrypted data stored in the data center to be restored during a subsequent restore operation;
• wherein the system is configured such that the password or other information for decrypting the encrypted encryption key is set by the user without knowledge of the third party, and
• wherein the third party is unable to decrypt the encrypted data stored in the data center without receiving the password or other information from the user.

A non-transitory computer-readable medium having instructions which, when executed by a processor of a data storage system, cause the data storage system to perform a method for storing data for a user, the method comprising:

• generating an encryption key associated with data for the user;
• encrypting the data belonging to the user using the generated encryption key to create encrypted data;
• storing the encrypted data in a data center associated with a third party;
• encrypting the encryption key to create an encrypted encryption key, wherein a password or other information set by the user is required to decrypt the encrypted encryption key;
• and
• storing the encrypted encryption key, wherein the encrypted encryption key is accessible to allow the encrypted data stored in the data center during a subsequent restore operation;
• wherein the password or other information for decrypting the encrypted encryption key is set by the user without knowledge by the third party, and
• wherein the third party is unable to decrypt the encrypted data stored in the data center without first receiving the password or other information from the user.