Patent ID: 7903812

Claim:
A method, comprising: maintaining, at a decryption unit implemented in a tape drive, an expected key identifier, an expected initialization vector, a mask register, and an accept line, wherein the number of bits of the mask register equals a sum of the number of bits in the expected key identifier and the number of bits in the expected initialization vector; receiving, at the decryption unit, a key identifier and an initialization vector, wherein a plurality of encrypted data records stored in a tape that is within a tape library having a library controller and an autochanger mechanism configured to transfer the tape to the tape drive are preceded by the key identifier and the initialization vector in a data stream, wherein the plurality of encrypted data records are succeeded by a message authentication code in the data stream, and wherein the plurality of encrypted data records have been encrypted with a cryptographic key that is recoverable by the decryption unit from the key identifier; turning off the accept line at the decryption unit, wherein turning off the accept line prevents the plurality of encrypted data records of the data stream from being received by the decryption unit; in response to turning off the accept line at the decryption unit, and in response to determining that the received key identifier matches the expected key identifier at least at a first plurality of bits indicated in the mask register and that the received initialization vector matches the expected initialization vector at least at a second plurality of bits indicated in the mask register, turning on the accept line at the decryption unit, wherein turning on the accept line allows the plurality of encrypted data records of the data stream to be received by the decryption unit to be read by the decryption unit; and in response to turning off the accept line at the decryption unit, and in response to determining that the received key identifier does not match the expected key identifier at least at the first plurality of bits indicated in the mask register or that the received initialization vector does not match the expected initialization vector at least at the second plurality of bits indicated in the mask register, setting an error bit at the decryption unit and maintaining the accept line as turned off.