Abstract:
A method, apparatus and program product for encryption/decryption of data on a volume of data storage media including dividing the volume into a plurality of locations, assigning a unique key to each location for encryption/decryption of data in the respective location of the volume, mapping the locations and keys in the key manager, and encrypting/decrypting data on the volume based on the data&#39;s physical location on the volume. The owning entity owning each location on the volume may also be mapped, and the keys for each location owned by the same owning entity may be the same.

Description:
FIELD OF THE INVENTION 
       [0001]    This invention relates to providing access to information on data storage medium in a computer system, and particularly to providing access to a user by mapping encrypted and decrypted data via a key management system. 
       BACKGROUND OF THE INVENTION 
       [0002]    The current method of doing hardware tape encryption, and in the future, disk data encryption, requires that a volume be encrypted with a single key. This poses a problem in that when trying to share an encrypted tape or disk between two or more entities, the current procedure will require that all entities have access to the key to decrypt the data from the media device. Thus, all parties interested in their disparate data on the same encrypted tape or disk will have to come to an agreement for sharing the key. Another drawback is that if one entity&#39;s key is compromised, all of the data on the disk is also subject to being compromised. Also, every party interested in encrypting data may have their own tape or disk on which data is to be encrypted. Additionally once a key is compromised, all interested parties have to get a new key creating a potential progression of key management activities that will force the use of single party disk or tapes. With the ever increasing capacity of a unit of disk or tape having a single key per volume become less financially desirable. 
         [0003]    U.S. Pat. No. 5,546,557 issued Aug. 13, 1996 to Allen et al. for SYSTEM FOR STORING AND MANAGING PLURAL LOGICAL VOLUMES IN EACH OF SEVERAL PHYSICAL VOLUMES INCLUDING AUTOMATICALLY CREATING LOGICAL VOLUMES IN PERIPHERAL DATA STORAGE SUBSYSTEM discloses a peripheral data storage subsystem for mounting and accessing smaller logical data-storage volumes from peripheral data storage. 
         [0004]    U.S. Pat. No. 6,336,121 B1 issued Jan. 1, 2002 to Lyson et al. for METHOD AND APPARATUS FOR SECURING AND ACCESSING DATA ELEMENTS WITHIN A DATABASE discloses a method and apparatus for securing and accessing data elements within a database and is accomplished by securing a symmetric key based on an encryption public key. 
         [0005]    U.S. Pat. No. 6,405,315 B1 issued Jun. 11, 2002 to Burns et al. for DECENTRALIZED REMOTELY ENCRYPTED FILE SYSTEM discloses a decentralized distributed file system based on a network of remotely encrypted storage. The disclosed system encrypts and decrypts at a data object level with metadata describing the directory structure of the file being encrypted. 
         [0006]    US Patent Application Publication No. 2004/0161112 A1 published Aug. 19, 2004 by Kekinuma et al. for DATA RECORDING METHOD, DATA RECORDING SYSTEM, DATA RECORDING APPARATUS, DATA READING METHOD, ADAT READING SYSTEM, COUNTING METHOD, COUNTING SYSTEM, METHOD OF SUPPLYING ENCRYPTION KEY, SYSTEM FOR SUPPLYING ENCRYPTION KEY AND PROGRAM discloses data recorded in a recording medium encrypted with an encryption/decryption key, and the encryption/decryption key is encrypted with an decryption-only key to that key in a program for reading. The data cannot be read without the program for reading, and the program for reading cannot be used for recording other data, even if copied. 
         [0007]    US Patent Application Publication No. 2005/0273861 A1 published Dec. 8, 2005 by Benaloh et al. for METHODS AND SYSTEMS OF PROTECTING DIGITAL CONTENT discloses a method of protecting digital content by partitioning it and uniquely marking and encryption each partition with a different key. 
         [0008]    US Patent Application Publication No. 2006/0262927 A1 published Nov. 23, 2006 by Rutkowski et al. for SYSTEM AND METHOD FOR MANAGING ENCRYPTED CONTENT USING LOGICAL PARTITIONS discloses managing title keys by establishing logical partitions of title keys encrypted with the same binding information. Provided is a type of real-time, dynamic method or associating data with title keys and deciding whether or not certain elements are stale and/or need to be encrypted/re-encrypted. 
         [0009]    International Application WO 81/00782 published 19 Mar. 1981 by Minnesota Mining and Manufacturing Company for HIGH CAPACITY DATA CARTRIDGE SYSTEM discloses a data recorder in which a preformatted tape is employed to enable automatic detection of the beginning of the tape and the end of the tape, as will as to location of preidentifiable record locations positioned along a plurality of parallel tracks. Also disclosed is using key patterns to enable control of the spatial location of data. 
         [0010]    UK Patent Application No. GB 2 264 373 A published Aug. 25, 1993 by Eurologic Research Limited for DATA ENCRYPTION discloses an apparatus for encrypting data to be stored on a tape or other storage medium including encrypting different blocks of data using respective different keys which are derived from a common key as a function of the storage location of the data. 
         [0011]    An article by Crowley for MERCY: A FAST LARGE BLOCK CIPHER FOR DISK SECTOR ENCRYPTION, Fast Software Encryption, 7th International Workshop, volume 1978 of Lecture Notes in Computer Science, pages 49-64 discloses a randomized block cipher accepting a 4096-bit block (a typical sector) designed specifically for the needs of disk sector encryption. 
         [0012]    An article by Dowdeswell et al. for THE CRYPTOGRAPHIC DISK DRIVER, FREENIX Track 2003 USENIX Annual Technical Conference Proceeding, pp 17-168 (9-14 Jun. 2003), discloses a disk driver with encrypts an entire disk partition to protect against physical loss of data by theft or other unauthorized use on laptops or single user system/storage devices where protection from concurrent or multiple users is not an issue. 
       SUMMARY OF THE INVENTION 
       [0013]    It is a object of the present invention to provide a volume which is encrypted with a single key. 
         [0014]    It is a further object of the present invention to allow different parts of a volume to be encrypted with different keys. 
         [0015]    It is a further object of the present invention to provide for both secure data from disparate parties as well as insecure data to be stored on the same volume, requiring a smaller number of tapes needed to archive a particular set of data. 
         [0016]    It is a further object of the present invention to provide for multiple keys to a data structure combination. 
         [0017]    It is an additional object of the present invention to provide that the owning entities be added to the data structure with a method for describing key database operations to ensure no inappropriate entity and key relationships are disclosed. 
         [0018]    System and computer program products corresponding to the above-summarized methods are also described and claimed herein. 
         [0019]    Additional features and advantages are realized through the techniques of the present invention. Other embodiments and aspects of the invention are described in detail herein and are considered a part of the claimed invention. For a better understanding of the invention with advantages and features, refer to the description and to the drawings. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0020]    The subject matter which is regarded as the invention is particularly pointed out and distinctly claimed in the claims at the conclusion of the specification. The foregoing and other objects, features, and advantages of the invention are apparent from the following detailed description taken in conjunction with the accompanying drawings in which: 
           [0021]      FIG. 1  is a diagram of a system of the present invention; 
           [0022]      FIG. 2  illustrates a key map data structure used in the system of  FIG. 1 ; 
           [0023]      FIG. 3  illustrates the flow of the present invention with the system of  FIG. 1 ; 
           [0024]      FIG. 4  is a flowchart of the functions performed by a storage management system of the system of  FIG. 1 ; and 
           [0025]      FIG. 5  is a flowchart of the functions performed by a key manager of the system of  FIG. 1 . 
       
    
    
       [0026]    The detailed description explains the preferred embodiments of the invention, together with advantages and features, by way of example with reference to the drawings. 
       DETAILED DESCRIPTION OF THE INVENTION 
       [0027]      FIG. 1  depicts a data processing system having a host A  110  having a key manager  105  which stores the ranges of volume serial numbers and whether they are encrypted or not encrypted and which identifies the owning entity and defines access rights. A control unit  120  is connected by an IP connection  115  to the key manager  105 . The control unit  120  controls a data storage unit  125 , either a tape drive or a disk drive unit, which reads from and writes to storage medium  126 , either a data tape or a disk. The data storage unit  125  includes an encryption facility for encrypting and decrypting the data on storage medium  126 . 
         [0028]      FIG. 2  illustrates a key map data structure stored and used by the key manager  105 . The key map data structure includes a plurality of data records, one of which is shown in  FIG. 2  as  200 . Each data record  200  includes a serial number of the storage medium (VOLSER)  201 , a Start field  202  which identifies the block to start read or write, a Length field  203  which identifies how long the user can read or write, Key(s) field  204  which identifies the key(s) to be used for encrypting/decrypting this section of the volume, Owning Entity(s) field  205  which identifies the owner of this section of the volume, and Access Rights field  206  which identifies the tape manager&#39;s access rights (read/write) to this section of the volume. Access rights are assigned by the Owning Entity(s). Each record  200  also includes a Multi-Key Capable field  207  which identifies if this volume is multi-key capable or not. The Multi-Key Capable field  207  provides for determining if multi-key operations and methods need to be performed. The keys are used as input to the encryption and decryption function in the drive. Each key is responsible for a portion of the data structure combination, as is well known in the art and will not be described further. 
         [0029]      FIG. 3  illustrates the flow of the present invention with the system of  FIG. 1  with only part of the system shown. The authentication provider  302  provides authentication credentials at  305  for a user  301  needing access to the storage medium  126 . The authentication mechanism  302  may be, for instance, Kerberos software, which is well understood in the art and will not be discussed further. A storage management system  304 , acting on the user&#39;s behalf, sends requests for storage medium  126  and key map at  306  to the key manager  105 . The storage management system  304  may be, for instance, the Tivoli Storage Manger (TSM) available from International Business Machines. The key manager  105  verifies the credentials sent by the user  301  with the authentication mechanism  302  at  307 . The key manager  105  then creates a subset of medium&#39;s Key Map (see  FIG. 2 ), including the keys associated with the section that belongs to the user, and sends it to the control unit  120  at  308 . The key manager  105  then takes the same subset of  308  not including any keys, and, at  310 , sends it to the storage management system  304  for the user  301  who requested the storage medium. The user  301 , using the storage management system  304 , retrieves at  311 , the information from the storage medium  126  at  312  through the control unit  120 . It will be understood that each key used to encrypt different parts of the volume may be totally unique for each other. However, keys for different parts of the volume owed by the same user may be the same. Further, encrypting and decrypting of data is based on the physical location of the data in a volume with a plurality of keys stored and mapped in the key manager  105 . It will be understood that the storage medium  126  may be either tape or disk, or any other storage medium. 
         [0030]      FIG. 4  is a flowchart of the functions performed by the storage management system  304 . At  401 , the storage management system gets authentication credentials from the authentication provider  302  for the user  301 . At  402 , a request is sent to the key manager  105  requesting the storage medium and key map. At  403 , a subset of medium&#39;s key map is received without keys. At  404 , the user retrieves information for the medium  126  through the control unit  120 . 
         [0031]      FIG. 5  is a flowchart of the functions performed by the key manager  105 . At  501 , the key manager  105  receives a request from the storage management system sent at step  402  of  FIG. 4 , the request requesting the storage medium and key map for user  301 . At  502 , the credentials are verified with the authentication mechanism. At  503 , the key manager  105  creates a subset of the key map including keys associated with the section that belongs to the user  301  and sends it to the control unit  120 . At  504 , the key manager  104  sends the subset without the keys to the storage management system to be used to retrieve information at step  404  of  FIG. 4 . 
         [0032]    The capabilities of the present invention can be implemented in software, firmware, hardware or some combination thereof. 
         [0033]    As one example, one or more aspects of the present invention can be included in an article of manufacture (e.g., one or more computer program products) having, for instance, computer usable media. The media has embodied therein, for instance, computer readable program code means for providing and facilitating the capabilities of the present invention. The article of manufacture can be included as a part of a computer system or sold separately. 
         [0034]    Additionally, at least one program storage device readable by a machine, tangibly embodying at least one program of instructions executable by the machine to perform the capabilities of the present invention can be provided. 
         [0035]    The flow diagrams depicted herein are just examples. There may be many variations to these diagrams or the steps (or operations) described therein without departing from the spirit of the invention. For instance, the steps may be performed in a differing order, or steps may be added, deleted or modified. All of these variations are considered a part of the claimed invention. 
         [0036]    While the preferred embodiment to the invention has been described, it will be understood that those skilled in the art, both now and in the future, may make various improvements and enhancements which fall within the scope of the claims which follow. These claims should be construed to maintain the proper protection for the invention first described.