Key rotation for encrypted storage media
AssigneeHewlett-Packard Development Company, L.P.
InventorsWendy B. Bartlett, Vijaykumar Immanuel, Mihai Damian, Geoffrey Ignatius Iswandhi
Life of this patent
Estimating the term…
Abstract
An I/O module is provided to service I/O requests from a host to access storage media. Data blocks of the storage media are encrypted with an old key, and the I/O module performs key rotation to cause data blocks to be re-encrypted with a new key.
Claims20
A method of performing key rotation in a computing environment having a host, a first storage media, first and second I/O managers coupled between the host and the first storage media, a second storage media that mirrors the first storage media to create a mirrored volume, and a third I/O manager coupled between the host and the second storage media, the method comprising:
- signaling the second I/O manager to suspend servicing I/O requests from the host to access the first storage media;
- signaling the first I/O manager to perform a first key rotation by reading data blocks from the first storage media, decrypting the data blocks using an old key, encrypting the data blocks using a new key, and writing the data blocks to the first storage media;
- and
- once the first key rotation is complete, signaling the third I/O manager to perform a second key rotation on the second storage media.
A non-transitory machine-readable media having computer executable program segments stored thereon, the computer executable program segments comprising:
- a media I/O module operated to receive I/O requests from a host and servicing the I/O requests to a first storage media and a second storage media that mirrors the first storage media;
- a key manager client module to cooperate with a key manager server module to receive a key;
- an encryption/decryption module operated to encrypt data blocks written to the first storage media and decrypting data blocks read from the first storage media using the key;
- and
- a key rotation module operated to:
- use an indication of first storage media usage from the host to rotate keys from an old key to a new key for blocks of the first storage media used by the host during a first key rotation;
- once the first key rotation is complete, rotate keys from the old key to the new key for blocks of the second storage media used by the host during a second key rotation;
- and
- not rotate keys for blocks of the first storage media not used by the host.
A computing environment comprising:
- a host comprising a processor and memory;
- a first storage media;
- first and second I/O managers coupled to the host and the first storage media, wherein the second I/O manager is signaled to suspend servicing I/O requests from the host to the first storage media during key rotation;
- and the first I/O manager includes:
- a media I/O module that receives I/O requests from the host and servicing the I/O requests to the first storage media;
- a second storage media;
- a third I/O manager coupled to the host and the second storage media, wherein the host includes a mirrored volume I/O manager and combines the first and second storage media into a mirrored volume, wherein the third I/O manager is prevented from rotating a key of the second storage media while the first storage media is undergoing key rotation;
- a key manager client module that cooperates with a key manager server module to request and receive a key;
- an encryption/decryption module that encrypts data blocks written to the first storage media and decrypting data blocks read from the first storage media using the key;
- and
- a key rotation module to:
- rotate keys from an old key to a new key for blocks of the first storage media during a first key rotation;
- and
- once the first key rotation is complete, rotate keys from the old key to the new key for blocks of the second storage media during a second key rotation.
Dependencies are inferred from the claim text.