Patent ID: 8719923

Claim:
A computer-implemented method comprising: receiving, by a key management module (KMM) of a storage server, an object identifier of a storage object stored by a storage device of the storage server; receiving, from an encryption engine of the storage server, a key identifier of a key utilized by the storage server to secure data of the storage object; processing the object identifier and the key identifier to result in a mapping between the object identifier of the storage object and the key identifier of the key; storing, by an authenticated storage module (ASM), the mapping in a memory of the ASM separate from the storage server to result in dedicated storage of the mapping, wherein the ASM is implemented by a portable storage device comprising a processor and the memory, wherein the ASM is operable to be physically coupled to the storage server and does not store the key, and wherein the storage device of the storage server stores the key but not the mapping; receiving, by the KMM, a request to perform a security operation upon the storage object; determining, by the KMM, a connected state of the ASM, wherein the connected state indicates whether the ASM is physically connected to the storage server and whether the ASM has authenticated identities of both the storage server and an administrator of the storage server; and invoking, by the KMM, the security operation on the storage object based on determining the connected state of the ASM, wherein said invoking includes, retrieving the mapping from the ASM, determining the key associated with the storage object based on the key identifier in the mapping, and performing the security operation on data of the storage object using the key.