Adding or replacing disks with re-key processing
View Patent ↗In a network of multiple storage devices, a storage device may become faulty and need to be replaced or additional capacity may need to be added through additional storage devices. When the storage devices communicate through a secure communications link using an encryption key for cryptographically splitting data, replacement or new storage devices may be re-keyed using an encryption key from an existing or prior storage device on the secure data network. After the storage device is re-keyed, the new or replacement storage device may continue to function on the secure data network without requiring changes to clients accessing the secure data network.
1. A method, comprising:
receiving a command, at a first storage device, to clone a second storage device, wherein the first storage device and second storage device are storage devices in a multiple storage device network presented as a virtual disk;
copying data from the second storage device to the first storage device, which comprises reconstructing cryptographically split data from the second storage device;
re-keying the first storage device by changing an encryption key of the first storage device to an encryption key matching an encryption key of the second storage device; and
establishing, by the first storage device, secure communications with the encryption key;
wherein the data copied to the first storage device from the second storage device is provided to a client device through the virtual disk.
2. The method of claim 1 , further comprising receiving a request from a client computing device through the secure communications.
3. The method of claim 1 , in which the step of copying the data comprises cloning the second storage device on the first storage device.
4. The method of claim 1 , in which the first storage device is located remote from the second storage device.
5. The method of claim 1 , in which the first storage device is a network attached storage (NAS) device.
6. A computer program product, comprising:
a non-transitory computer readable medium comprising:
code to receive a command, at a first storage device, to clone a second storage device, wherein the first storage device and second storage device are storage devices in a multiple storage device network presented as a virtual disk;
code to copy data from the second storage device to the first storage device, which comprises reconstructing cryptographically split data from the second storage device;
code to re-key the first storage device by changing an encryption key of the first storage device to an encryption key matching an encryption key of the second storage device; and
code to establish, by the first storage device, secure communications with the encryption key,
wherein the data copied to the first storage device from the second storage device is provided to a client device through the virtual disk.
7. The computer program product of claim 6 , in which the medium further comprises code to receive a request from a client computing device through the secure communications.
8. The computer program product of claim 6 , in which the medium further comprises code to clone the second storage device on the first storage device.
9. The computer program product of claim 6 , in which the first storage device is located remote from the second storage device.
10. The computer program product of claim 6 , in which the first storage device is a network attached storage (NAS) device.
11. An apparatus, comprising:
a processor,
a memory connected to the processor;
a secure boot device connected to the processor; and
a network adapter connected to the processor,
in which the processor is configured:
to receive a command, through the network adapter, to clone a second storage device onto a first storage device, wherein the first storage device and second storage device are storage devices in a multiple storage device network presented as a virtual disk;
to copy data from the second storage device to the memory, which comprises reconstructing cryptographically split data from the second storage device;
to re-key the secure boot device by changing an encryption key of the first storage device to an encryption key matching an encryption key of the second storage device; and
to establish, through the network adapter, secure communications with the encryption key,
wherein the data copied to the first storage device from the second storage device is provided to a client device through the virtual disk.
12. The apparatus of claim 11 , in which the processor is further configured to receive a request from a client computing device through the secure communications.
13. The apparatus of claim 11 , in which the processor is further configured to clone the second storage device on the first storage device.
14. The apparatus of claim 11 , further comprising a universal serial bus (USB) connected to the secure boot device and the processor.
15. The apparatus of claim 11 , in which the secure boot device is integrated into the apparatus.
16. The apparatus of claim 11 , in which the apparatus is located remote from the second storage device.
17. The apparatus of claim 11 , in which the apparatus is a network attached storage (NAS) device.