System and method for enabling encryption
View Patent ↗Embodiments provide systems and methods for the encryption of data to be stored on media in a library. A method of data encryption may comprise intercepting or monitoring commands sent to a library comprising one or more media stored at secure slots. If in response to a command or commands, media is moved from a secure slot to a drive, data stored on the media by the drive is encrypted, either by an encryption device, the drive or other encryption system, thus allowing encryption based on individual slots or media in a library.
1. A system for encrypting data stored on media in a media library, comprising:
one or more hosts coupled to a network and operable to send one or more commands over the network;
a media library coupled to the network and comprising:
a plurality of slots, wherein the plurality of slots include one or more secure slots;
a look-up-table listing identifiers for each of the one or more secure slots;
one or more drives coupled to the network and operable to receive data over the network;
one or more media stored at corresponding slots of the plurality of slots; and
a media changer coupled to the network and operable to receive the one or more commands over the network and move media between the plurality of slots and the one or more drives in accordance with the one or more commands;
transfer logic operable to intercept the one or more commands to the media changer and parse the one or more commands to determine media moved to a drive from a secure slot by the media changer, wherein the determination is made by accessing one or more encryption policies listing the one or more secure slots of the plurality of slots as secure and an identifier for the secure slot; and
encryption logic operable to encrypt data sent to the drive containing media from the secure slot in response to a determination that the media has been moved to the drive from the secure slot.
2. The system of claim 1 , wherein the media are tape cartridges.
3. The system of claim 1 , further comprising an encryption appliance, the encryption appliance containing the transfer logic or the encryption logic.
4. The system of claim 1 , wherein the transfer logic is located at a host of the one or more hosts.
5. The system of claim 1 , wherein the encryption logic is located at a host of the one or more hosts.
6. The system of claim 1 , wherein the encryption logic is located at a drive of the one or more drives.
7. The system of claim 1 , further comprising an encryption policy, wherein the encryption policy specifies the one or more secure slots.
8. The system of claim 1 , further comprising a partition, wherein the partition comprises the one or more secure slots.
9. The system of claim 1 , further comprising a partition, wherein the partition comprises one or more slots, at least one of the one or more slots of the partition being one of the one or more secure slots.
10. A method for encrypting data stored on media in a media library, comprising:
intercepting one or more commands sent over a network to a media library, the media library comprising:
a plurality of slots, wherein the plurality of slots include one or more secure slots;
a look-up-table listing identifiers for each of the one or more secure slots;
one or more drives;
one or more media stored at corresponding slots of the plurality of slots; and
a media changer operable to move media between the plurality of slots and the one or more drives in accordance with the one or more commands;
parsing the one or more commands to determine a first media moved to a drive from a secure slot, wherein the determination is made by accessing one or more encryption policies listing the one or more secure slots of the plurality of slots as secure and an identifier for the secure slot; and
encrypting data to be stored on the first media from the secure slot in response to a determination that the first media has been moved to the drive from the secure slot.
11. The method of claim 10 , wherein the one or more media are tape cartridges.
12. The method of claim 10 , further comprising determining the drive containing the first media.
13. The method of claim 10 , further comprising designating one or more slots of the one or more secure slots in accordance with an encryption policy.
14. The method of claim 13 , wherein the encryption policy comprises a list of the one or more secure slots and the corresponding identifiers.
15. A non-transitory computer readable medium comprising computer instructions, the computer instructions executable by a computer processor to:
intercept one or more commands sent over a network to a media changer of a media library coupled to the network comprising a plurality of slots including one or more secure slots, a look-up-table listing identifiers for each of the one or more secure slots, and one or more drives coupled to the network operable to receive data over the network, one or more media stored at corresponding slots of the plurality of slots, a media changer coupled to the network and operable to move media between the plurality of slots and the one or more drives in accordance with the one or more commands;
parse the one or more commands to determine a media moved to a drive from a secure slot, wherein the determination is made by accessing one or more encryption policies listing the one or more secure slots of the plurality of slots as secure and an identifier for the secure slot; and
encrypt data to be stored on the media from the secure slot in response to a determination that the media has been moved to the drive from the secure slot.
16. The computer readable medium of claim 15 , wherein the media is a tape cartridge.
17. The computer readable medium of claim 15 , further comprising determining the drive containing the media.
18. The computer readable medium of claim 15 , further comprising designating one or more slots of the plurality of slots as the one or more secure slots in accordance with an encryption policy.
19. The computer readable medium of claim 18 , wherein the encryption policy comprises a list of the one or more secure slots and the corresponding identifier.
20. An encryption appliance operable to encrypt data, the encryption appliance comprising:
a processor;
a media library coupled to a network and comprising a plurality of slots including one or more secure slots, a look-up-table listing identifiers for each of the one or more secure slots, and one or more drives coupled to the network operable to receive data over the network one or more media stored at corresponding slots of the plurality of slots, a media changer coupled to the network and operable to move media between the plurality of slots and the one or more drives in accordance with the one or more commands; and
a non-transitory computer readable medium comprising instructions for implementing:
transfer logic operable to intercept the one or more commands to the media changer over the network and parse the one or more commands to determine media moved to a drive from a secure slot by the media changer, wherein the determination is made based on the look-up-table listing an identifier of the secure slot and accessing one or more encryption policies listing the secure slot as secure; and
encryption logic operable to encrypt data sent to the drive containing media from the secure slot in response to a determination that the media has been moved to the drive from the secure slot.
21. The encryption appliance of claim 20 , wherein the media are tape cartridges.
22. The encryption appliance of claim 20 , wherein the encryption appliance further comprises a logical partition having the one or more secure slots.