Generating unique aliases for keys used with tape libraries
View Patent ↗Unique key aliases are generated for tape libraries. According to one embodiment, a first library identifier associated with a first tape library, which does not conflict with a second library identifier associated with a second tape library, is generated. One library identifier is associated with each of the tape libraries. A unique key alias, which does not conflict with any key aliases associated with the first tape library and does not conflict with any key aliases associated with the second tape library, is generated based on the first library identifier. Tape data is encrypted based on a data key that is identified with the unique key alias as a part of writing the tape data to the first tape library.
1. A method of generating unique aliases for keys used with tape libraries, the method comprising:
accessing a first library identifier associated with a first tape library that does not conflict with a second library identifier associated with a second tape library;
generating a unique key alias that does not conflict with key aliases associated with the first tape library and does not conflict with key aliases associated with the second tape library based, at least in part, on the first library identifier; and
encrypting tape data based on a data key that is identified with the unique key alias,
where generating the unique key alias comprises:
creating a unique identifier prefix by appending a first portion of the first library identifier onto a second portion of the first library identifier, and
concatenating the unique identifier prefix with a range value,
where the first library identifier is a World Wide Name (WWN) identifier,
where the unique identifier prefix is shorter in length than the WWN identifier,
where the first portion is a manufacturing assigned portion of the VVWN identifier, and
where the second portion is an Organizational Unique Identifier (OUI) of the WWN identifier.
2. The method of claim 1 , further comprising:
receiving a certificate alias generated based on the second library identifier, from the second tape library; and
encrypting the unique key alias based, at least in part, on the received certificate alias.
3. The method of claim 2 , further comprising:
communicating the encrypted tape data and the encrypted unique key alias to a key manager associated with the second tape library; and
unwrapping, at the second tape library, the encrypted unique key alias based on the certificate alias that resides at the key manager associated with the second tape library.
4. The method of claim 3 , further comprising:
receiving a request at the second tape library to access the encrypted tape data; and
using the unwrapped unique key alias as a part of decrypting the encrypted tape data.
5. An apparatus for generating unique aliases for keys used with tape libraries, the apparatus comprising:
a processor;
a memory; and
an interface to connect the processor and the memory,
the processor being configured to perform as:
an accessor configured for accessing a first library identifier associated with a first tape library that does not conflict with a second library identifier associated with a second tape library;
a generator configured for generating a unique key alias based, at least in part, on the first library identifier, where the unique key alias is associated with the first tape library and is not associated with the second tape library; and
a communicator configured for communicating the unique key alias to an encryptor that encrypts tape data with a data key identified by the unique key alias,
where the generator is configured for generating the unique key alias by creating a unique identifier prefix by appending a first portion of the first library identifier onto a second portion of the first library identifier; and
concatenating the unique identifier prefix with a range value,
where the first library identifier is a World Wide Name (WWN) identifier and the unique identifier prefix is shorter in length than the VVWN identifier, where the first portion is a manufacturing assigned portion of the WWN identifier, and where the second portion is an Organizational Unique Identifier (QUI) of the WVVN identifier.
6. The apparatus of claim 5 , where the encryptor encrypts the tape data based on the data key identified by the unique key alias.
7. The apparatus of claim 6 , further comprising:
an associator configured for receiving a certificate alias generated based on the second library identifier from the second tape library; and
where the communicator is configured for communicating the certificate alias to the encryptor that encrypts the unique key alias based, at least in part, on a public key associated with the certificate alias.
8. The apparatus of claim 7 , where:
the first tape library communicates the encrypted tape data and the encrypted unique key alias to a key manager associated with the second tape library; and
the second tape library unwraps the encrypted unique key alias based on the certificate alias at the key manager associated with the second tape library.
9. The apparatus of claim 8 , where:
the second tape library receives a request to access the encrypted tape data; and
a decryptor associated with the second tape library decrypts the encrypted tape data using an unwrapped data key associated with the unique key alias.
10. The apparatus of claim 5 , where the unique key alias is based on one or more portions of a World Wide Name (WWN) associated with the first tape library, where a first portion of the WWN ensures that the first library identifier does not conflict with any other library identifiers associated with an organization, where a second portion of the WWN in combination with the first portion of the WWN ensures that the first library identifier does not conflict with any other libraries that have been assigned Organizationally Unique Identifiers (OUIs).
11. The apparatus of claim 10 , where a portion of the WWN ensures that the first library identifier does not conflict with any other library identifiers associated with tape libraries manufactured by a particular manufacturer.
12. A non-transitory computer-readable medium having computer-executable instructions for performing a method of generating unique aliases for keys used with tape libraries the method comprising:
accessing a unique alias that does not conflict with aliases associated with a first tape library and does not conflict with aliases associated with a second tape library where the unique alias was generated based, at least in part, on a first library identifier, associated with the first tape library, that does not conflict with a second library identifier associated with the second tape library, where a library identifier is only associated with one tape library; and
encrypting tape data based, at least in part, on a key associated with the unique alias,
where the unique alias includes
a unique identifier prefix created by appending a first portion of the first library identifier onto a second portion of the first library identifier; and
a range value concatenated with the unique identifier prefix,
where the first library identifier is a World Wide Name (WWN) identifier and the unique identifier prefix is shorter in length than the WWN identifier,
where the first portion is a manufacturing assigned portion of the WWN identifier, and
where the second portion is an Organizational Unique Identifier (OUI) of the WWN identifier.
13. The non-transitory computer-readable medium of claim 12 , further comprising computer executable instructions for:
accessing the unique alias that is a certificate alias; and
encrypting a unique key alias based on a public key associated with the certificate alias.
14. The non-transitory computer-readable medium of claim 12 , further comprising computer-executable instructions for:
accessing the unique alias that is a unique key alias; and
encrypting a stream of data that is being written to the tape based on a data key associated with the unique key alias.
15. The non-transitory computer-readable medium of claim 12 , further comprising computer-executable instructions for:
accessing the first library identifier, where the first library identifier was generated based on a serial number associated with the first tape library.