Encryption key management for storage area network devices
AssigneeCisco Technology, Inc.
InventorsPraveen Patnala, Anand Parthasarathy, Makarand Deshmukh
Life of this patent
Estimating the term…
Abstract
An encryption key management system is provided for storage area network devices. A create key request is received at a storage area network switch. The key is created at the storage area network switch and the created key request is transmitted to a key management center. The key object is stored in the key management center and includes a unique identifier, an encrypted key, a wrapper unique identifier, and a key entity. The encrypted key can later be decrypted to generate a decrypted key. The encrypted key is decrypted using keying material accessed using the wrapper unique identifier that identifies another key object.
Claims24
A method, comprising:
- receiving a create key request at a storage area network switch;
- transmitting, from the storage area network switch, the create key request to a key management center, wherein a key object is created at the key management center, the key object including a unique identifier, an encrypted key, and a wrapper unique identifier, and wherein the key object also includes a cluster identifier specifying a particular group of network devices to which the key object belongs;
- receiving the encrypted key at the storage area network switch from the key management center;
- and
- decrypting, at the storage area network switch, the encrypted key to generate a decrypted key, wherein the encrypted key is decrypted using keying material accessed using the wrapper unique identifier, the wrapper unique identifier referencing another key object at the key management center.
A system, comprising:
- an interface operable to receive a create key request at a storage area network switch and transmit the create key request to a key management center, wherein a key object is created at the key management center, the key object including a unique identifier, an encrypted key, and a wrapper unique identifier, wherein the interface is also operable to receive at least the encrypted key from the key management center, and wherein the key object also includes a cluster identifier specifying a particular group of network devices to which the key object belongs;
- and
- a processor operable to decrypt the encrypted key to generate a decrypted key, wherein the encrypted key is decrypted using keying material accessed using the wrapper unique identifier, the wrapper unique identifier referencing another key object at the key management center.
An apparatus, comprising:
- means for receiving a create key request at a storage area network switch;
- means for transmitting the create key request to a key management center, wherein a key object is created at the key management center, the key object including a unique identifier, an encrypted key, and a wrapper unique identifier, and wherein the key object also includes a cluster identifier specifying a particular group of network devices to which the key object belongs;
- means for receiving the encrypted key from the key management center;
- and
- means for decrypting the encrypted key to generate a decrypted key, wherein the encrypted key is decrypted using keying material accessed using the wrapper unique identifier, the wrapper unique identifier referencing another key object at the key management center, wherein the keying material is accessed via the another key object referenced by the wrapper unique identifier.
A non-transitory computer readable medium having computer code embodied therein, the non-transitory computer readable medium, comprising:
- computer code for receiving a create key request at a storage area network switch;
- computer code for transmitting the create key request to a key management center, wherein a key object is created at the key management center, the key object including a unique identifier, an encrypted key, and a wrapper unique identifier, and wherein the key object also includes a cluster identifier specifying a particular group of network devices to which the key object belongs;
- computer code for receiving the encrypted key from the key management center;
- and
- computer code for decrypting the encrypted key to generate a decrypted key, wherein the encrypted key is decrypted using keying material accessed using the wrapper unique identifier, the wrapper unique identifier referencing another key object at the key management center, wherein the keying material is accessed via the another key object referenced by the wrapper unique identifier.
Dependencies are inferred from the claim text.