Patent ID: 8170213

Claim:
A method comprising, at a storage processing device: sending a request to a key server to assign a key associated with a key identifier; receiving an assigned key from the key server; subsequently, deleting the assigned key from all locations where it had been stored in memory; and subsequently, sending a confirmation signal to the key server indicating that the assigned key has been deleted; wherein: the key identifier identifies a portion of data storage controlled by the storage processing device; the assigned key is used to encrypt data to be written to the portion of data storage and to decrypt data read from the portion of data storage; receiving the assigned key from the key server includes: receiving an encrypted assigned key from the key server; and storing the encrypted assigned key in memory within an entry of a key table, the entry of the key table being indexed by an object identifier, the object identifier also indexing into a device table, the device table storing an address range of the portion of data storage; the encrypted assigned key is associated with a first storage device interface module (SDIM) coupled to the storage processing device, the encrypted assigned key having been encrypted with a first key encryption key uniquely associated with the first SDIM, the encrypted assigned key being stored within a first sub-entry of the entry, the first sub-entry being indexed by a first SDIM identifier, the first SDIM identifier uniquely identifying the first SDIM; the method further comprises, at the storage processing device: receiving another encrypted assigned key from the key server, the other encrypted assigned key being associated with a second SDIM coupled to the storage processing device, the first SDIM being distinct from the second SDIM, the other encrypted assigned key having been encrypted with a second key encryption key uniquely associated with the second SDIM, the other encrypted assigned key being an encrypted version of the assigned key; and after receiving the other encrypted assigned key from the key server, storing the other encrypted assigned key in memory within a second sub-entry of the entry of the key table, the second sub-entry being indexed by a second SDIM identifier, the second SDIM identifier uniquely identifying the second SDIM; the first SDIM is configured to cryptographically write data received from a host to the portion of data storage using the assigned key; and the second SDIM is configured to cryptographically write data received from a host to the portion of data storage using the assigned key.