Patent Application
20090220089
This invention relates to providing access to information on data storage medium in a computer system, and particularly to providing access to a user by mapping encrypted and decrypted data via a key management system.
The current method of doing hardware tape encryption, and in the future, disk data encryption, requires that a volume be encrypted with a single key. This poses a problem in that when trying to share an encrypted tape or disk between two or more entities, the current procedure will require that all entities have access to the key to decrypt the data from the media device. Thus, all parties interested in their disparate data on the same encrypted tape or disk will have to come to an agreement for sharing the key. Another drawback is that if one entity's key is compromised, all of the data on the disk is also subject to being compromised. Also, every party interested in encrypting data may have their own tape or disk on which data is to be encrypted. Additionally once a key is compromised, all interested parties have to get a new key creating a potential progression of key management activities that will force the use of single party disk or tapes. With the ever increasing capacity of a unit of disk or tape having a single key per volume become less financially desirable.
U.S. Pat. No. 5,546,557 issued Aug. 13, 1996 to Allen et al. for SYSTEM FOR STORING AND MANAGING PLURAL LOGICAL VOLUMES IN EACH OF SEVERAL PHYSICAL VOLUMES INCLUDING AUTOMATICALLY CREATING LOGICAL VOLUMES IN PERIPHERAL DATA STORAGE SUBSYSTEM discloses a peripheral data storage subsystem for mounting and accessing smaller logical data-storage volumes from peripheral data storage.
U.S. Pat. No. 6,336,121 B1 issued Jan. 1, 2002 to Lyson et al. for METHOD AND APPARATUS FOR SECURING AND ACCESSING DATA ELEMENTS WITHIN A DATABASE discloses a method and apparatus for securing and accessing data elements within a database and is accomplished by securing a symmetric key based on an encryption public key.
U.S. Pat. No. 6,405,315 B1 issued Jun. 11, 2002 to Burns et al. for DECENTRALIZED REMOTELY ENCRYPTED FILE SYSTEM discloses a decentralized distributed file system based on a network of remotely encrypted storage. The disclosed system encrypts and decrypts at a data object level with metadata describing the directory structure of the file being encrypted.
US Patent Application Publication No. 2004/0161112 A1 published Aug. 19, 2004 by Kekinuma et al. for DATA RECORDING METHOD, DATA RECORDING SYSTEM, DATA RECORDING APPARATUS, DATA READING METHOD, ADAT READING SYSTEM, COUNTING METHOD, COUNTING SYSTEM, METHOD OF SUPPLYING ENCRYPTION KEY, SYSTEM FOR SUPPLYING ENCRYPTION KEY AND PROGRAM discloses data recorded in a recording medium encrypted with an encryption/decryption key, and the encryption/decryption key is encrypted with an decryption-only key to that key in a program for reading. The data cannot be read without the program for reading, and the program for reading cannot be used for recording other data, even if copied.
US Patent Application Publication No. 2005/0273861 A1 published Dec. 8, 2005 by Benaloh et al. for METHODS AND SYSTEMS OF PROTECTING DIGITAL CONTENT discloses a method of protecting digital content by partitioning it and uniquely marking and encryption each partition with a different key.
US Patent Application Publication No. 2006/0262927 A1 published Nov. 23, 2006 by Rutkowski et al. for SYSTEM AND METHOD FOR MANAGING ENCRYPTED CONTENT USING LOGICAL PARTITIONS discloses managing title keys by establishing logical partitions of title keys encrypted with the same binding information. Provided is a type of real-time, dynamic method or associating data with title keys and deciding whether or not certain elements are stale and/or need to be encrypted/re-encrypted.
International Application WO 81/00782 published 19 Mar. 1981 by Minnesota Mining and Manufacturing Company for HIGH CAPACITY DATA CARTRIDGE SYSTEM discloses a data recorder in which a preformatted tape is employed to enable automatic detection of the beginning of the tape and the end of the tape, as will as to location of preidentifiable record locations positioned along a plurality of parallel tracks. Also disclosed is using key patterns to enable control of the spatial location of data.
UK Patent Application No. GB 2 264 373 A published Aug. 25, 1993 by Eurologic Research Limited for DATA ENCRYPTION discloses an apparatus for encrypting data to be stored on a tape or other storage medium including encrypting different blocks of data using respective different keys which are derived from a common key as a function of the storage location of the data.
An article by Crowley for MERCY: A FAST LARGE BLOCK CIPHER FOR DISK SECTOR ENCRYPTION, Fast Software Encryption, 7th International Workshop, volume 1978 of Lecture Notes in Computer Science, pages 49-64 discloses a randomized block cipher accepting a 4096-bit block (a typical sector) designed specifically for the needs of disk sector encryption.
An article by Dowdeswell et al. for THE CRYPTOGRAPHIC DISK DRIVER, FREENIX Track 2003 USENIX Annual Technical Conference Proceeding, pp 17-168 (9-14 Jun. 2003), discloses a disk driver with encrypts an entire disk partition to protect against physical loss of data by theft or other unauthorized use on laptops or single user system/storage devices where protection from concurrent or multiple users is not an issue.
It is a object of the present invention to provide a volume which is encrypted with a single key.
It is a further object of the present invention to allow different parts of a volume to be encrypted with different keys.
It is a further object of the present invention to provide for both secure data from disparate parties as well as insecure data to be stored on the same volume, requiring a smaller number of tapes needed to archive a particular set of data.
It is a further object of the present invention to provide for multiple keys to a data structure combination.
It is an additional object of the present invention to provide that the owning entities be added to the data structure with a method for describing key database operations to ensure no inappropriate entity and key relationships are disclosed.
System and computer program products corresponding to the above-summarized methods are also described and claimed herein.
Additional features and advantages are realized through the techniques of the present invention. Other embodiments and aspects of the invention are described in detail herein and are considered a part of the claimed invention. For a better understanding of the invention with advantages and features, refer to the description and to the drawings.
The subject matter which is regarded as the invention is particularly pointed out and distinctly claimed in the claims at the conclusion of the specification. The foregoing and other objects, features, and advantages of the invention are apparent from the following detailed description taken in conjunction with the accompanying drawings in which:
The detailed description explains the preferred embodiments of the invention, together with advantages and features, by way of example with reference to the drawings.
The capabilities of the present invention can be implemented in software, firmware, hardware or some combination thereof.
As one example, one or more aspects of the present invention can be included in an article of manufacture (e.g., one or more computer program products) having, for instance, computer usable media. The media has embodied therein, for instance, computer readable program code means for providing and facilitating the capabilities of the present invention. The article of manufacture can be included as a part of a computer system or sold separately.
Additionally, at least one program storage device readable by a machine, tangibly embodying at least one program of instructions executable by the machine to perform the capabilities of the present invention can be provided.
The flow diagrams depicted herein are just examples. There may be many variations to these diagrams or the steps (or operations) described therein without departing from the spirit of the invention. For instance, the steps may be performed in a differing order, or steps may be added, deleted or modified. All of these variations are considered a part of the claimed invention.
While the preferred embodiment to the invention has been described, it will be understood that those skilled in the art, both now and in the future, may make various improvements and enhancements which fall within the scope of the claims which follow. These claims should be construed to maintain the proper protection for the invention first described.
