Patent Application
20080063209
Selected embodiments of the present invention may be understood, and its numerous objects, features and advantages obtained, when the following detailed description is considered in conjunction with the following drawings, in which:
A method, system and program are disclosed for enabling access to encrypted data in a removable storage medium, such as a tape cartridge, by storing one or more encryption encapsulated data keys (or externally encrypted data keys) (EEDKs) in multiple places in a tape cartridge (such as in the cartridge memory and/or on the tape medium that are designed for holding this type of information). For example, when data is to be encrypted and stored on the removable storage medium, the data is encrypted with a data key, such as by performing an AES encryption with a randomly generated 256-bit data key. The data key may then be encrypted or wrapped with a different encrypting key (a.k.a. key encrypting key) to create an EEDK, such as by using public key cryptography techniques (such as Rivest, Shamir, and Adleman (RSA) or Elliptic Curve Cryptography (ECC)), and the EEDK may be stored in one or more locations in the cartridge memory and/or tape medium of the removable storage medium. By encrypting the data key with an encrypting key to form an EEDK and then storing the EEDK to multiple locations on the tape cartridge, the original data key can be discarded from the host system and the multiple copies of the EEDK on the tape cartridge provide redundancy/backup protection against loss of one or more EEDKs (and thereby the underlying data key), so long as there are other EEKD(s) which were not lost. The result is a distributed key store system that permits the encrypted data to be securely transported along with the encrypted or wrapped data key, requiring only that a key encrypting key (or key pair) be retained at the host system. Since the EEDK(s) is in specially designated areas of the cartridge memory or the tape medium, a user who loads the tape cartridge can access the EEDK (and thereby obtain the underlying data key) from any of the designated areas, so long as the user has the required keys to decrypt the EEDKs.
Various illustrative embodiments of the present invention will now be described in detail with reference to the accompanying figures. It will be understood that the flowchart illustrations and/or block diagrams described herein can be implemented in whole or in part by dedicated hardware circuits, firmware and/or computer program instructions which are provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions (which execute via the processor of the computer or other programmable data processing apparatus) implement the functions/acts specified in the flowchart and/or block diagram block or blocks. In addition, while various details are set forth in the following description, it will be appreciated that the present invention may be practiced without these specific details, and that numerous implementation-specific decisions may be made to the invention described herein to achieve the device designer's specific goals, such as compliance with technology or design-related constraints, which will vary from one implementation to another. While such a development effort might be complex and time-consuming, it would nevertheless be a routine undertaking for those of ordinary skill in the art having the benefit of this disclosure. For example, selected aspects are shown in block diagram form, rather than in detail, in order to avoid limiting or obscuring the present invention. In addition, some portions of the detailed descriptions provided herein are presented in terms of algorithms or operations on data within a computer memory. Such descriptions and representations are used by those skilled in the art to describe and convey the substance of their work to others skilled in the art. Various illustrative embodiments of the present invention will now be described in detail below with reference to the figures.
Referring to
Referring to
In the illustrated example, the EKM/host system 21 includes a host application (not shown), such as a backup program, that transfers data to the tape drive 25 to sequentially write to the tape cartridge 10, such as by using the Small Computer System Interface (SCSI) tape commands to communicate I/O requests to the tape drive 25, or any other data access command protocol known in the art. As will be appreciated, the EKM/host system 21 may be constructed from one or more servers (e.g., the EKM may reside on one server and any application which is reading and writing data to the drive may reside on another server). However implemented, the EKM/host 21 includes a data key generator functionality for generating a data key (DK) 1 for use in performing data encryption, though this functionality may also be provided in the drive 25 or even externally to the system 20. The EKM/host 21 also includes a public key crypto module 22 that is used to form a session encrypted data key (SEDK) 4 from the data key 1, and then to securely pass the SEDK 4 to the tape drive 25 as part of a secure key exchange. The public key crypto module 22 also securely encrypts the data key 1 to form one or more encryption encapsulated data keys (EEDK) 2 (as indicated by the stacked keys). In various embodiments, the public key crypto module 22 uses a predetermined public key encryption technique (such as RSA or ECC) to generate EEDK(s) 2 from DK(s) 1. For example, the public part of a public/private key pair that is retrieved from a key store 23 (which may or may not reside locally with EKM/host 21) may be used to wrap the data key 1 into its encrypted EEDK form. The encrypted EEDK form includes not only the encrypted data key DK itself, but also other structural information, such as a key label or key hash, which identifies the public/private key pair that is used to wrap the data key 1. Once a public key from the key store 23 is used to generate an EEDK, the identifying structural information in the EEDK 2 can be later used by the key module 22 or EKM 21 as an index or reference to the public/private key pair in the key store 23 to retrieve the private key from the key store 23 when the EEDK 2 needs to be processed to unwrap the DK 1.
The tape drive 25 may connect with the host 21 through a direct interface (such as an SCSI, Fibre Channel (FCP), etc., in the case if the tape drive 25 is connected to the host 21) or may connect over a data channel or network 24 (such as a Local Area Network (LAN), Storage Area Network (SAN), Wide Area Network (WAN), the Internet, an Intranet, etc.). It will be appreciated that the tape drive 25 may be enclosed within the host system 21 or may be a standalone unit or in a tape library system (not shown), which may include one or more tape drives, one or more storage units to store multiple tape cartridges, and a mechanical system (commonly referred to as an accessor) to transfer the tape cartridges between the storage unit(s) and the tape drive(s). As illustrated, the tape drive 25 includes a memory circuit interface 17 for reading information from, and writing information to, the cartridge memory 14 of the data storage cartridge 10 in a contactless manner. In addition, a read/write servo drive system 18 is provided for reading information from, and writing information to, the rewritable tape media 11. The read/write servo drive system 18 controls the movement of a servo head (not shown) relative to the magnetic tape medium 11 by moving the magnetic tape medium 11 across the servo head at a desired velocity, and stops, starts and reverses the direction of movement of the magnetic tape.
A control system (or controller) 27 in the tape drive 25 communicates with the memory interface 17 and the read/write system servo drive 18. To receive commands and exchange information for operating the cartridge handling system 20, the controller 27 also acts as a host interface to communicate over one or more ports 26 with one or more external key management (EKM) subsystems 21 (such as a host computer, library or external key management appliance). In addition, a crypto module 28 and data encryption/decryption module 29 are provided in the tape drive 25 for securely encrypting and storing data to the tape cartridge 10 and for securely retrieving and decrypting data stored on the tape cartridge 10. In operation, the data encryption/decryption module 29 performs the actual data encryption and decryption (such as by using the Advanced Encryption Standard encryption algorithm) using a data key having any desired key length (e.g., 128 or 256-bit data key length), and may also perform other encoding functions, such as data compression and decompression and data buffering. The crypto module 28 controls the data encryption/decryption module 29 by securely exchanging data keys (DKs) 1 using the session encrypted data key (SEDK) 4a which is received from the EKM 21 (where it is originally generated as SEDK 4). At the crypto module 28, the data key la is extracted from the SEDK 4a, and is sent to the data encryption/decryption module 29 where it is used to encode/decode the input data stream. In addition, the crypto module 28 assembles, validates, distributes, stores and retrieves one or more associated encryption encapsulated data keys (EEDKs) 2a (where the letter suffix “a” in the reference numeral indicates that the EEDKs 2 and 2a are logically identical, though physically distinct copies). While the modules 28, 29 may be implemented with any desired combination of hardware and/or software, the data encryption/decryption module 29 may be implemented with an ASIC or FPGA circuit, while the crypto module 28 may be implemented with one or more drive firmware modules that include a microprocessor and microcode stored in a code memory.
As described herein, the cartridge handling system 20 performs a variety of functions, including but not limited to, encrypting data to be stored on the cartridge 10 using a data key (such as an AES encryption key); using public key cryptography techniques to wrap the data key with a different key to form one or more encrypted data keys; writing and reading the encrypted data and encrypted data key(s) to and from the tape cartridge media; and decrypting the stored encrypted data with the data key that is obtained by unwrapping the encrypted data key. In this way, the cartridge handling system 20 provides a distributed key store which permits different users to access the encrypted data on a single tape cartridge 10 by generating separate EEDKs using each user's public key to wrap the data key 1. For example, at least a first EEDK 2 is generated for local use by using a public key of the local key manager to wrap the data key 1, and the EEDK 2 is then transferred via the tape drive 25 (where it may be temporarily stored as 2a) for storage on the tape cartridge 10 at one or more predetermined locations, as indicated at 2b, 2c, 2d, 2e and 2f. As a result, the transferred EEDK 2 may be stored in the cartridge memory 14 and/or one or more non-user data areas of the tape media 11, such as a read-in area 15 or an end of tape area 16. Though a single copy of the EEDK may be stored on the tape cartridge 10, security and reliability are enhanced by using one or more non-user areas 15, 16 of the tape 11 to store multiple (e.g., three or more) copies of the EEDK 2, thereby allowing deletion of the EEDKs 2, 2a at the EKM 21 and tape drive 25. Since the only non-volatile copies of the EEDKs are stored within the tape cartridge 10, multiple copies of the EEDKs (2b, 2c, etc) provides multiple ways to access the EEDKs and thus the data key 1 in the cases where one or more copies of the EEDKs cannot be read or otherwise processed due to errors or degraded media or drive conditions.
When a plurality of EEDKs 2 are generated from a single data key 1—such as when a second EEDK is generated for a remote user (e.g., a business partner) by using a public key of the remote user to wrap the data key 1—the plurality of EEDKs 2 are transferred via the tape drive 25 for storage on the tape cartridge 10 at one or more locations (as indicated by the copies of the EEDKs 2b-f that are stored in one or more non-user data areas 15, 16 of the tape media 11 and/or the cartridge memory 14). By storing multiple EEDKs on the tape cartridge 10 in specially designated locations (such as the cartridge memory 14 or outside of the tape's user data area), the tape cartridge 10 can have one EEDK wrapped for local use and another for remote exchange. In theory, any number of different EEDKs could be stored, provided there is storage space for them.
To illustrate how data may be securely encoded and stored on a removable tape cartridge that has not previously acquired its own encrypted data keys, reference is now made to the process flow depicted in
While a variety of different encryption techniques may be used, an initial key generation process at the EKM 21 encrypts the DK 1 to form one or more EEDKs using an encryption method, such as a pubic key cryptographic method (step 32). It is umimportant whether the encryption method is known outside of the EKM. In a selected embodiment, the EEDK creation process in the EKM 21 uses asymmetric encryption by performing RSA 2048-bit encryption of the DK 1 with the public part of a public/private key pair to render the data key 1 within the EEDK 2 completely secure to any entity who does not possess the private part of the key pair. To associate the generated EEDK(s) 2 with the public/private key pair used to encrypt the DK 1, structural information about the public/private key pair is included in each generated EEDK by the EKM 21 which can be extracted from the EEDK for future access to the data key and consequently the encrypted data itself.
At this time, a secure key exchange is established to encrypt the data key DK 1 with a session key (e.g., the public key from the tape drive 25), thereby generating a session encrypted data key 4 (SEDK) (step 33) which can be securely passed, along with the EEDK(s) 2, to the tape drive 25. Once the EKM 21 sends the encrypted data keys to the tape drive 25, the data key 1 and encrypted data key(s) 2, 4 may be discarded by the EKM 21 (step 34). As will be appreciated, there are several methodologies which may be used for secure key exchanges, including wrapping the data key 1 in a session key, though other techniques may be used, including but not limited to RSA, Diffie-Hellman (DH), elliptic curve Diffie Hellman (ECDH), Digital Signature Algorithm (DSA), elliptic curve DSA (ECDSA), etc. The session key may come from the drive or the host.
Upon transfer to the tape drive 25, the EEDK(s) 2a and the SEDK 4a are stored in the crypto module 28. The tape drive 25 decrypts the SEDK 4a with its private session key to produce the data key 1A which is used to set up the encryption hardware module 29. At any point after the encryption hardware module 29 is set up, the SEDK 4a may be discarded from the tape drive (step 35). The tape drive also writes the EEDK(s) 2a to the tape cartridge 10 as part of set up or any point thereafter, and begins encrypting data using the extracted data key 1A. When writing the EEDKs 2a to the tape cartridge 10, the tape drive 25 stores multiple copies of the EEDK 2b-2f in a plurality of locations, such as one or more non-user data areas 15, 16 of tape 11 and in the cartridge memory 14 (step 36). In selected embodiments, the EEDKs are written to the tape cartridge 10 before the encoding or writing of data since such writing may comprise many gigabytes. Also, by recording the EEDKs first, the host system that encounters an error condition can retrieve some portion of the written encoded data by using the previously stored EEDK for that encoded data. While the EEDKs 2a could be discarded from the tape drive after being written to the tape cartridge 10, they may be retained in the tape drive 25 in a volatile fashion for as long as the cartridge is loaded in the drive. Once the input data stream is encrypted and the tape drive 25 has written the encoded data to the tape 11, the tape drive 25 discards the data key 1A (step 36). Once the encoded data and EEDK(s) 2b-2f are stored to the tape cartridge 10, the tape drive 25 discards the encoded data and the EEDK(s) 2a (step 36).
An example of how data may be securely decoded and read from a removable tape cartridge will now be described with reference to the process flow depicted in
To enable the tape device hardware decryption and/or encryption process(es), a key exchange must occur in order to retrieve and decrypt the stored EEDKs 2b-f for purposes of extracting the correct decryption data key. However, when the data keys are not retained or stored on the tape drive 25 or the EKM 21, the EEDKs 2b-f must be used to reacquire the data key 1 at the EKM 21 which is then securely transferred to the tape drive 25. For example, after the tape cartridge 10 is loaded and the EEDKs 2b-f are stored as EEDKs 2a in the crypto module 28 of the tape drive 25, the tape drive 25 sends the EEDKs 2a to the EKM 21 (step 41), either in response to a request from the EKM 21 (or automatically in the case of a library/appliance model). Once the EEDKs 2 are transferred to the EKM 21, the EKM 21 determines their validity and decrypts the EEDKs 2 by extracting structural information from each EEDK and searching the key store 23 for a match, in which case the associated private key is output from the key store 23 and used to decrypt the EEDK, thereby extracting the data key DK 1 (step 42). The data key DK 1 is then securely wrapped in the driver's session key to generate the session encrypted data key SEDK 4 (step 43). Using any desired secure key exchange protocol, the EKM 21 passes the SEDK 4 to the tape drive 25 where it is stored as the SEDK 4a, at which time the EKM 21 discards the SEDK 4 (step 44). The tape drive 25 then decrypts the SEDK 4a with its private session key to produce the data key 1A which is used to setup the decryption hardware module 29 (step 45). Again, the tape drive 25 can discard the SEDK 4a at any point after the decryption hardware module 29 is setup, even before the stored data is decrypted.
At the tape drive 60, the received SEDK 53b is stored and decrypted by the session key 62 to generate a local copy of the data key 51b, all under control of the tape drive controller 63. The data key 51b is then combined in an encryption circuit 61 with the input data stream 58 from the host 50, thereby generating an encrypted data stream 65 that is stored in the tape media 72. In addition, the received EEDKs 55b are forwarded to the storage device 70 where they are collectively stored to one or more locations 55c in the non-user data portion of the tape 72, and/or to predetermined location(s) 55d in the cartridge memory 74. Once the data key 51b and encrypted data keys 53b, 55b are processed at the tape drive 60, they may be discarded, as indicated by the dashed lines.
Upon receiving the EEDKs for a storage device 70 (at block 86), the tape drive controller 63 writes (at block 87) the encrypted data keys (EEDKs) to the storage device 70 and then discards the EEDKs. In addition, once the session encrypted data key (SEDK) is received at the tape drive (block 88), the tape drive controller 63 decrypts the SEDK to extract the data key using the tape drive private session key that corresponds to the public session key, and then uses the extracted data key to encode data being written to the storage device (at block 89). After the data is encoded and stored, the data key and SEDK are discarded and the encoded data is transmitted to the storage device 70 (at block 90).
When the EEDKs are received at the storage device (block 91), they are separately stored in multiple locations in the storage device, such as the cartridge memory and the non-user data area of the tape (block 92). In selected embodiments, the EEDKs are written to the storage device 70 prior to storing the encrypted data on the storage device. An example implementation of how EEDKs are stored is depicted in
As illustrated in
When the EEDKs 100, 101 are stored in non-user areas, the data key wrapping technology described herein may be used to change the access to the encrypted data by changing the access to the encrypted data key without re-encrypting the underlying data, thereby providing a variety of additional cartridge control features, such as adding an EEDK to the cartridge, re-keying a cartridge, shredding a cartridge, and setting a cartridge to persistently unencrypted state. In particular, when the DK is encrypted with a first wrapping key (e.g., a public key from a public/private key pair) to form a first EEDK, additional access to the DK can be provided by encrypting the DK with a second wrapping key to form a second EEDK. With this approach, multiple users are able access the encrypted data, and can be added without re-encrypting the data by storing the new EEDK's outside of the user data area of the tape volume. With multiple EEDK structures on the cartridge that are each created using different wrapping keys to wrap the same underlying data key DK, parallel access to the DK (and therefore the data on the tape) is provided to anyone possessing the necessary unwrapping key (e.g., the private key from the public/private key pair) associated with any of the EEDK structures.
Another cartridge control feature is that a cartridge can be re-keyed to change the user access, thereby removing a first user and adding a second user. This may be accomplished by decoding a first EEDK on the cartridge using an appropriate unwrapping key to extract the underlying data key DK, re-wrapping the DK using a different wrapping key (e.g., a new public key from a public/private key pair that belongs to a second user) to generate a new EEDK, and re-storing the new EEDK back on the tape to overwrite the first EEDK. The result is that access is removed for anyone who previously could decode the first EEDK, while enabling access for anyone who could decode the new EEDK, all without having to re-write the data and encrypt it with a different data key.
Yet another cartridge control feature is that cartridge data access can be permanently prevented, effectively “shredding” the cartridge data. This may be accomplished by deleting or erasing the EEDK structures from the tape. Since the EEDK structures are the only repository for the data key needed to decrypt the cartridge data, the data may never be decrypted. Erasing the EEDK structures is much faster (on the order of 2-3 minutes versus 1-2 hours) and actually more secure then erasing all the data from the tape. Another advantage is that the wrapping and unwrapping keys do not need to be deleted from the key store to prevent readability of the tape, since the EEDKs have been deleted. Also, EEDK erasure can be performed more securely (e.g., using multiple erase passes with random patterns), more easily and more quickly then a secure erase of all encrypted data.
A still further cartridge control feature is that the cartridge data can be set to a persistently unencrypted cartridge state. This feature can be useful when there is no longer a need for secure encryption of the cartridge data, thereby enabling all users to access the data as though the data were unencrypted, yet without having to re-write the data without encryption. In this operation, the EEDKs are unwrapped to extract the underlying data key, which is then stored in the clear in the control storage area (that was previously used to store the EEDK structure). As a result, any encrypting drive can access the control storage area and use the clear Data Key without any unwrapping operation so that the encrypted tape is now readable on any encrypting drive with no requirement to hold an unwrapping key. Of course, this process can be reversed by wrapping the data key in a wrapping key to form an EEDK that is re-stored to the control storage area, thus allowing the cartridge access to be limited, if desired (though this may be disallowed in some environments for security reasons).
As will be appreciated by one skilled in the art, the present invention may be embodied in whole or in part as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit,” “module” or “system.” Furthermore, the present invention may take the form of a computer program product on a computer-usable storage medium having computer-usable program code embodied in the medium. For example, the functions of tape drive 25 and tape cartridge 10 may be implemented in software commonly referred to as a virtual tape library. The virtual tape library software may communicate with EKM/host 21 and mimic the functions of a physical tape library, including the functions of reading from and writing to a storage device, such as a tape drive. The virtual tape library software may reside on a separate computer system coupled to EKM/host 21.
The foregoing description has been presented for the purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form disclosed. Many modifications and variations are possible in light of the above teaching. It is intended that the scope of the invention be limited not by this detailed description, but rather by the claims appended hereto. The above specification and example implementations provide a complete description of the manufacture and use of the composition of the invention. Since many embodiments of the invention can be made without departing from the spirit and scope of the invention, the invention resides in the claims hereinafter appended.
