Protecting data in a storage system
A system, method, and computer-readable storage medium for protecting a set of storage devices using a secret sharing scheme in combination with an external secret. An initial master secret is generated and then transformed into a final master secret using an external secret. A plurality of shares are generated from the initial master secret and distributed to the storage devices. The data of each storage device is encrypted with a device-specific key, and this key is encrypted using the final master secret. In order to read the data on a given storage device, the initial master secret reconstructed from a threshold number of shares and the external secret is retrieved. Next, the initial master secret is transformed into the final master secret using the external secret, and then the final master secret is used to decrypt the encrypted key of a given storage device.
1. A method comprising:
creating a final master secret using an initial master secret and one or more external secrets;
for each storage device of a plurality of storage devices:
encrypting, by the storage device, data on the storage device with a unique device key, wherein the unique device key is stored on the storage device and is unique to that storage device;
encrypting the unique device key using the final master secret and information unique to the storage device; wherein the final master secret is not persisted;
receiving the one or more external secrets; and
recreating the final master secret using the initial master secret and the received one or more external secrets.
2. The method of claim 1 further comprising dividing the initial master secret into a plurality of shares.
3. The method of claim 2 further comprising for each storage device: conveying to the storage device, the encrypted unique device key and a particular share of the initial master secret.
4. The method of claim 2 further comprising for each storage device: storing the encrypted unique device key and the particular share on the storage device.
5. The method of claim 1 wherein the unique device key is based on hardware specific to the storage device.
6. The method of claim 1 further comprising conveying to each storage device, external secret access information for accessing the external secret.
7. A storage system, the storage system including a computer memory and a computer processor, the computer processor including computer program instructions that, when executed by the computer processor, cause the storage system to carry out the steps of:
creating a final master secret using an initial master secret and one or more external secrets;
for each storage device of a plurality of storage devices:
encrypting, by the storage device, data on the storage device with a unique device key, wherein the unique device key is stored on the storage device and is unique to that storage device;
encrypting the unique device key using the final master secret and information unique to the storage device; wherein the final master secret is not persisted;
receiving the one or more external secrets; and
recreating the final master secret using the initial master secret and the received one or more external secrets.
8. The storage system of claim 7 further comprising computer program instructions that, when executed by the computer processor, cause the storage system to carry out the steps of: dividing the initial master secret into a plurality of shares.
9. The storage system of claim 8 further comprising computer program instructions that, when executed by the computer processor, cause the storage system to carry out the steps of: for each storage device: conveying to the storage device, the encrypted unique device key and a particular share of the initial master secret.
10. The storage system of claim 8 further comprising computer program instructions that, when executed by the computer processor, cause the storage system to carry out the steps of: for each storage device: storing the encrypted unique device key and the particular share on the storage device.
11. The storage system of claim 7 wherein the unique device key is based on hardware specific to the storage device.
12. The storage system of claim 7 further comprising computer program instructions that, when executed by the computer processor, cause the storage system to carry out the steps of: conveying to each storage device, external secret access information for accessing the external secret.
13. A non-transitory computer readable storage medium comprising computer program instructions, wherein the computer program instructions are executable to:
creating a final master secret using an initial master secret and one or more external secrets;
for each storage device of a plurality of storage devices:
encrypting, by the storage device, data on the storage device with a unique device key, wherein the unique device key is stored on the storage device and is unique to that storage device;
encrypting the unique device key using the final master secret and information unique to the storage device; wherein the final master secret is not persisted;
receiving the one or more external secrets; and
recreating the final master secret using the initial master secret and the received one or more external secrets.
14. The non-transitory computer readable storage medium of claim 13 , wherein the computer program instructions that are further executable to: divide the initial master secret into a plurality of shares.
15. The non-transitory computer readable storage medium of claim 13 , wherein the computer program instructions that are further executable to: for each storage device: convey to the storage device, the encrypted unique device key and a particular share of the initial master secret.
16. The non-transitory computer readable storage medium of claim 13 , wherein the computer program instructions that are further executable to: for each storage device: store the encrypted unique device key and the particular share on the storage device.
17. The non-transitory computer readable storage medium of claim 13 , wherein the unique device key is based on hardware specific to the storage device.
18. The non-transitory computer readable storage medium of claim 13 , wherein the computer program instructions that are further executable to: convey to each storage device, external secret access information for accessing the external secret.