Encryption key recovery in the event of storage management failure
View Patent ↗A data processing system stores encrypted data. Object identifiers are assigned to storage objects, and data encryption keys are assigned to the storage objects. When performing an operation upon a storage object, data encryption key failure may occur due to a corrupt or incorrect key. In this case, a copy of the data encryption key is fetched from a key server. It is possible for the association of the object identifiers with the data encryption keys to become lost or confused, so that the key server may fail to provide the correct key for a specified object identifier. Therefore, an absolute key identifier that is unique across the key server namespace also is stored in association with the object identifier in the storage system and in the key store of the key server, and the absolute key identifier is used as a failsafe for recovery of encrypted data.
1. A method of encryption key recovery, said method comprising a hardware processor executing computer instructions in memory to perform the steps of:
(a) creating a storage object for containing encrypted data in data storage of a data storage system, assigning an object identifier to the storage object for identifying the storage object in the data storage system, assigning a data encryption key to the storage object, assigning a key identifier to the data encryption key, storing the data encryption key in the data storage system in association with the object identifier, and storing the key identifier in the data storage system in association with the object identifier; and
(b) when performing an operation upon the storage object using the data encryption key in the data storage system, detecting failure of the data encryption key in the data storage system, and in response to detecting failure of the data encryption key in the data storage system, using the object identifier for fetching the stored key identifier associated with the object identifier, and using the fetched key identifier associated with the object identifier for fetching a copy of the data encryption key from a key server computer, and resuming the operation upon the storage object using the copy of the data encryption key fetched from the key server computer.
2. The method as claimed in claim 1 , wherein the data encryption key is stored in the data storage system in association with the object identifier in a first table of global memory of the data storage system, the first table stores object identifiers and respective data encryption keys for a plurality of storage objects for containing encrypted data in the data storage of the data storage system; and wherein the key identifier is stored in the data storage system in association with the object identifier in a second table of global memory of the data storage system, and the second table stores object identifiers and respective key identifiers for the plurality of storage objects.
3. The method as claimed in claim 1 , wherein the object identifier is unique in the data storage system for identifying the storage object among a plurality of storage objects containing encrypted data in the data storage of the data storage system, and wherein the key identifier is unique in the key server computer for identifying the copy of the data encryption key among a multiplicity of copies of data encryption keys provided by the key server computer to a plurality of data storage systems.
4. The method as claimed in claim 1 , which includes the key server computer maintaining in a key store the copy of the data encryption key in association with an identifier of the data storage system, the object identifier, and the key identifier.
5. The method as claimed in claim 1 , which further includes the key server computer providing the data encryption key to the data storage system in response to a request including the object identifier and an identifier of the data storage system.
6. The method as claimed in claim 1 , wherein the fetching of the key identifier associated with the object identifier is performed after the data storage system requests the key server computer to provide a copy of the data encryption key associated with the object identifier in a namespace of the data storage system, and the key server computer fails to provide a correct copy of the data encryption key assigned to the object.
7. The method as claimed in claim 1 , wherein the fetching of the key identifier associated with the object identifier includes finding the key identifier associated with the object identifier in unencrypted metadata stored with the storage object in the data storage of the data storage system, and obtaining the key identifier from the unencrypted metadata.
8. The method as claimed in claim 1 , wherein the fetching of the key identifier associated with the object identifier includes finding the key identifier associated with the object identifier in an archive index, and obtaining the key identifier from the archive index.
9. The method as claimed in claim 1 , wherein the fetching of the key identifier associated with the object identifier includes finding the key identifier associated with the object identifier in another data storage system.
10. A method of encryption key recovery, said method comprising a hardware processor executing computer instructions in memory to perform the steps of:
(a) creating a storage object for containing encrypted data in data storage of a data storage system, assigning an object identifier to the storage object for identifying the storage object in the data storage system, obtaining a key identifier and a data encryption key assigned to the storage object from a key server computer, storing the key identifier and the data encryption key in the data storage system in association with the object identifier, and storing the key identifier and a copy of the data encryption key in association with the object identifier and an identifier of the data storage system in a key store of the key server computer; and
(b) when performing an operation upon the storage object using the data encryption key in the data storage system, detecting failure of the data encryption key in the data storage system, and in response to detecting failure of the data encryption key in the data storage system, requesting the key server computer to provide a copy of the data encryption key assigned to the storage object, and the key server responding by failing to provide a correct copy of the data encryption key assigned to the storage object, and in response to the key server computer failing to provide a correct copy of the data encryption key assigned to the storage object, using the object identifier for fetching the stored key identifier associated with the object identifier, and using the fetched key identifier associated with the object identifier for fetching a copy of the data encryption key from the key server computer, and resuming the operation upon the storage object using the copy of the data encryption key fetched from the key server computer.
11. The method as claimed in claim 10 , wherein the data encryption key is stored in the data storage system in association with the object identifier in a first table of global memory of the data storage system, and the first table stores object identifiers and respective data encryption keys for a plurality of storage objects for containing encrypted data in the data storage of the data storage system; and wherein the key identifier is stored in the data storage system in association with the object identifier in a second table of global memory of the data storage system, and the second table stores object identifiers and respective key identifiers for the plurality of storage objects.
12. The method as claimed in claim 10 , wherein the object identifier is unique in the data storage system for identifying the storage object among a plurality of storage objects containing encrypted data in the data storage of the data storage system, and wherein the key identifier is unique in the key server computer for identifying the copy of the data encryption key among a multiplicity of copies of data encryption keys provided by the key server computer to a plurality of data storage systems.
13. The method as claimed in claim 10 , wherein the key server computer is requested to provide a copy of the data encryption key assigned to the storage object in a namespace of the data storage system by sending a first request including the object identifier to the key server computer, and the fetched key identifier associated with the object identifier is used for fetching a copy of the data encryption key from the key server computer by sending a second request including the key identifier to the key server computer.
14. A data storage system comprising:
data storage; and
at least one storage processor computer coupled to the data storage for storing data in the data storage;
wherein said at least one storage processor computer is programmed for creating a storage object for containing encrypted data in the data storage, assigning an object identifier to the storage object for identifying the storage object in the data storage system, obtaining a key identifier and a data encryption key assigned to the storage object from a key server computer, and storing the key identifier and the data encryption key in the data storage system in association with the object identifier; and
wherein said at least one storage processor computer is further programmed for performing an operation upon the storage object using the data encryption key in the data storage system, and when performing the operation upon the storage object using the data encryption key in the data storage system, detecting failure of the data encryption key in the data storage system, and in response to detecting failure of the data encryption key in the data storage system, using the object identifier for fetching the stored key identifier associated with the object identifier, and using the fetched key identifier associated with the object identifier for fetching a copy of the data encryption key from the key server computer, and resuming the operation upon the storage object using the copy of the data encryption key fetched from the key server computer.
15. The data storage system as claimed in claim 14 , wherein the storage processor computer further includes a global memory, wherein the data encryption key is stored in the data storage system in association with the object identifier in a first table in the global memory, the first table stores object identifiers and respective data encryption keys for a plurality of storage objects for containing encrypted data in the data storage, the key identifier is stored in the data storage system in association with the object identifier in a second table in the global memory, and the second table stores object identifiers and respective key identifiers for the plurality of storage objects.
16. The data storage system as claimed in claim 14 , wherein the object identifier is unique in the data storage system for identifying the storage object among a plurality of storage objects containing encrypted data in the data storage, and wherein the key identifier is unique in the key server computer for identifying the copy of the data encryption key among a multiplicity of copies of data encryption keys provided by the key server computer to a plurality of data storage systems.
17. The data storage system as claimed in claim 14 , wherein said at least one storage processor computer is programmed so that fetching of the key identifier associated with the object identifier is performed after the data storage system requests the key server computer to provide a copy of the data encryption key associated with the object identifier in a namespace of the data storage system, and the data storage system determines that the key server computer fails to provide a correct copy of the data encryption key assigned to the object.
18. The data storage system as claimed in claim 14 , wherein said at least one storage processor computer is programmed so that the fetching of the key identifier associated with the object identifier includes finding the key identifier associated with the object identifier in unencrypted metadata stored with the storage object in the data storage of the data storage system, and obtaining the key identifier from the unencrypted metadata.
19. The data storage system as claimed in claim 14 , wherein said at least one storage processor computer is programmed so that the fetching of the key identifier associated with the object identifier includes finding the key identifier associated with the object identifier in an archive index, and obtaining the key identifier from the archive index.
20. The data storage system as claimed in claim 14 , wherein said at least one storage processor computer is programmed so that the fetching of the key identifier associated with the object identifier includes finding the key identifier associated with the object identifier in another data storage system.