IP Library Granted Patent US 9,032,218
Granted Patent B2
US 9,032,218 · App. 12/697,045 · Granted May 12, 2015

Key rotation for encrypted storage media using a mirrored volume revive operation

View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 9,032,218
App. No.
12/697,045
Granted
May 12, 2015
Kind
B2
Abstract

Encryption key rotation is performed in computing environments having mirrored volumes by initializing a target storage media with a new key, performing a mirror revive operation from a first storage media to the target storage media, and configuring the first storage media and the target storage media to comprise a mirrored volume.

Claims (29)

1. A method of performing key rotation in a computing environment having a host coupled to a first and a second storage media, wherein the first and second storage media are in a mirrored volume configuration and wherein the first storage media is configured as a first mirror storage media and the second storage media is configured as a primary storage media, the method comprising:

utilizing a processor to execute instructions stored on a non-transitory readable media for:

initializing a target storage media with a new key;

coupling the target storage media to the host and configuring the target storage media as a second mirror storage media;

performing a mirror revive operation from the first storage media to the target storage media to perform key rotation, wherein the second storage media provides service requests to the host during the mirror revive, and wherein the mirror revive operation is optimized using one or more of a data block map optimization or a high water mark optimization;

configuring the second storage media as a new primary storage media and configuring the target storage media as a new mirror storage media to comprise the mirrored volume; and

configuring the first storage media as a new spare storage media and uncoupling the first storage media from the host, wherein the new spare storage media includes at least data stored in the first storage media.

2. The method of claim 1 wherein initializing the target storage media with the new key comprises accessing a key manager to obtain the new key.

3. Non-transitory readable media having computer executable program segments stored thereon, the computer executable program segments comprising:

a mirrored volume I/O manager for maintaining a mirrored volume on a plurality of storage media; and

a key rotation initiator module for:

initializing a target storage media of the plurality of storage media with a new key;

coupling the target storage media to a host and configuring the target storage as a second mirror storage media;

performing a mirror revive operation from a first storage media of the plurality of storage media to the target storage media to perform key rotation, wherein the first storage media is in a mirrored volume with a second storage media of the plurality of storage media and wherein the second storage media provides service requests to the host during the mirror revive, and wherein the mirror revive operation is optimized using one or more of a data block map optimization or a high water mark optimization;

configuring the second storage media as a new primary storage media and configuring the target storage media as a new mirror storage media to comprise the mirrored volume; and

configuring the first storage media as a new spare storage media and uncoupling the first storage media from the host, wherein the new spare storage media includes at least data stored in the first storage media.

4. The non-transitory readable media of claim 3 wherein the first and target storage media comprise the mirrored volume before the mirror revive operation.

5. A computing environment comprising:

a plurality storage media that includes a first storage media configured as a first mirror storage media and a second storage media configured as a primary storage media in a mirrored volume;

a storage area network coupled to storage media of the plurality of storage media;

a host coupled to the storage area network, the host including memory which includes:

a mirrored volume I/O manager that maintains a mirrored volume using storage media of the plurality of storage media; and

a key rotation initiator module, wherein the key rotation initiator module initializes a target storage media of the plurality of storage media with a new key, couples the target storage media to the host and configures the target storage media as a second mirror storage media in the mirrored volume, performs a mirror revive operation from the first storage media to the target storage media to perform key rotation while the second storage media provides service requests to the host during the mirror revive, wherein the mirror revive operation is optimized using one or more of a data block map optimization or a high water mark optimization, configures the second storage media as a new primary storage media and configures the target storage media as a new mirror storage media to comprise the mirrored volume and configures the first storage media as a new spare storage media and uncouples the first storage media from the host, wherein the new spare storage media includes at least data stored in the first storage media.

6. The computing environment of claim 5 wherein the first and target storage media comprise the mirrored volume before the mirror revive operation.

7. The computing environment of claim 5 wherein the memory of the host further includes a key policy management module for implementing a key rotation policy.

8. The computing environment of claim 5 and further comprising:

a key manager, the key manager including:

a key manager server module for providing keys used to access the first and target storage media; and

a key table that stores and associates key names with keys.

Assignments (3)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Feb 24, 2021
From: OT PATENT ESCROW, LLC
To: VALTRUS INNOVATIONS LIMITED
Reel/Frame 055403/0001 →
PATENT ASSIGNMENT, SECURITY INTEREST, AND LIEN AGREEMENT Recorded Jan 26, 2021
From: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP; HEWLETT PACKARD ENTERPRISE COMPANY
To: OT PATENT ESCROW, LLC
Reel/Frame 055269/0001 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Nov 9, 2015
From: HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P.
To: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP
Reel/Frame 037079/0001 →