1. Technical Field
The present invention relates to data processing systems in general, and more particularly, to data processing systems utilizing encryption keys. Still more particularly, the present invention relates to a method for updating encryption keystores within a data processing system.
2. Description of Related Art
In general, conventional encryption systems utilize multiple encryption keys with each encryption key being unique and unpredictable. For example, an Advanced Encryption Standard (AES) encryption key is typically a random string of bits generated for scrambling and unscrambling data. The longer an encryption key string, the more difficult it is for a hacker to break the code that is encrypted by the encryption key.
For applications and/or environments that are not capable of performing key management, an Encryption Key Manager (EKM), such as an EKM component for the Java™ platform manufactured by International Business Machines of Armonk, N.Y., is utilized to perform all necessary key management tasks. Some key management tasks include issuing requests for encryption keys and maintaining an updated keystore of known encryption keys. Thus, an EKM can be utilized to work with encryption-enabled tape drives to generate, protect, store, and maintain encryption keys for encrypting and decrypting information being written to and from tape media. Ideally, an EKM should be constantly accessible by multiple peripheral devices that require encryption keys. However, conventional methods of updating a keystore require that an EKM be manually taken offline during the performance of encryption keystone updates.
Consequently, it would be desirable to provide an improved method for updating encryption keystores within a data processing system.
In accordance with a preferred embodiment of the present invention, a computer network includes multiple host computers. A keystore is initially loaded into a key manager within one of the host computers. In response to a key request by a peripheral device within the computer network, a determination is made whether or not the keystore is currently being updated. In a determination that the keystore is not currently being updated, the loaded keystore is utilized to handle the key request. In a determination that the keystore is currently being updated, any incoming key request is redirected to a local queue associated with the key manager. Afterwards, the updated keystore is utilized to handle the key request and any other key request pending in the local queue associated with the key manager.
All features and advantages of the present invention will become apparent in the following detailed written description.
The invention itself, as well as a preferred mode of use, further objects, and advantages thereof, will best be understood by reference to the following detailed description of an illustrative embodiment when read in conjunction with the accompanying drawings, wherein:
With reference now to the drawings, and in particular to
Each of host computers 100A-100N includes a respective keystore controlled by a key manager having a local queue. For example, host computer 100A includes a keystore 139A and a key manager 148A having a local queue 137A, host computer 100B includes a keystore 139B and a key manager 148B having a local queue 137B, and host computer 100N includes a keystore 139N and a key manager 148N having a local queue 137N. Although a keystore is shown to be located within the same host computer as its key manager, the keystore may be located within a different host computer from that of its key manager.
As utilized herein, a key manager refers to a utility, such as an Encryption Key Manager (EKM), for maintaining multiple encryption keys within a keystore. For example, key manager 148A reads one or more encryption keys from keystore 139A in response to a key request from peripheral device 170. The local queue within each key manager is utilized to temporarily store one or more key requests during keystore updates by its key manager. Thus, local queue 137A allows key manager 148A to update keystore 139A without rejecting any key request from peripheral device 170 during the keystore update process. Although an encryption key corresponding to a key request is described to be located in a keystore within the same host computer as the key manager, the encryption key corresponding to the key request may be located in a keystore within a different host computer.
With reference now to
If a valid encryption key exists in the loaded keystore, the key manager determines whether or not the keystore is currently being updated, as depicted in block 225. There are at least three methods for initiating a keystore update. With the first method, the key manager detects a newer timestamp on a keystore, and if the keystore having a newer timestamp is found, the key manager will discard the previous copy of the keystore and loads the keystore having a newer timestamp. With the second method, the key manager compares the contents of the keystores in the computer network with its current keystore. As the third method, a user can initiate a keystore update.
If the keystore is not currently being updated, the current keystore (obtained in block 202) is utilized to handle the pending key request (from block 210), as shown in block 227. Otherwise, if the keystore is currently being updated, the key manager redirects all incoming key request to its local queue, such as local queue 137A for key manager 148A from
In the flow diagram of
As has been described, the present invention provides an improved method for updating encryption keystores within a host computer.
While an illustrative embodiment of the present invention has been described in the context of a fully functional computer system, those skilled in the art will appreciate that the software aspects of an illustrative embodiment of the present invention are capable of being distributed as a program product in a variety of forms, and that an illustrative embodiment of the present invention applies equally regardless of the particular type of media used to actually carry out the distribution. Examples of the types of media include recordable type media such as thumb drives, floppy disks, hard drives, CD ROMs, DVDs, and transmission type media such as digital and analog communication links.
While the invention has been particularly shown and described with reference to a preferred embodiment, it will be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the invention.