Crypto-erasure via internal and/or external action
View Patent ↗Device-implemented methodology for enabling and/or performing crypto-erase via internal action and external action. In one illustrative aspect, a request to read data is received at a device configured to perform data operations on a storage medium, the data being stored on the storage medium in encrypted form. In one approach, a first key stored within the device is accessed. In another approach, a first key stored on and/or with the storage medium is retrieved. A second key is received from an external source. A media encryption key is generated using the first and second keys. The encrypted form of the data is read from the storage medium. The encrypted form of the data is decrypted using the media encryption key. The decrypted data is output. Methodology for writing encrypted data is also presented.
1. A device-implemented method, comprising:
receiving, at a device configured to perform data operations on a nonvolatile storage medium, a request to read data, the data being stored on the storage medium in encrypted form;
accessing a first key stored within the device in a nonvolatile memory;
receiving a second key from an external source;
generating a media encryption key directly from the first and second keys;
reading the encrypted form of the data from the storage medium;
decrypting the encrypted form of the data using the media encryption key;
outputting the decrypted data;
receiving an instruction to crypto-erase the data;
in response to receiving the instruction, attempting to delete, by the device, the first key by overwriting the first key to cause the data to be crypto-erased; and
destroying the second key to ensure crypto-erasure of the data.
2. The device-implemented method of claim 1 , wherein the first key is stored in the device in raw form, wherein the first key is created internal to the device, wherein the device is configured to prohibit transfer of the first key to outside of the device, wherein the first key has a same length as the media encryption key.
3. The device-implemented method of claim 1 , wherein the first key is stored in the device in wrapped form, and comprising receiving information for generating a wrapper key, the wrapper key being for unwrapping the first key.
4. The device-implemented method of claim 1 , wherein the device is configured to prohibit transfer of the first key to outside of the device.
5. The device-implemented method of claim 1 , wherein the media encryption key is stored in the device in wrapped form; and comprising deleting, by the device, the wrapped media encryption key in response to receiving the instruction.
6. The device-implemented method of claim 1 , wherein the nonvolatile memory is a different type of memory than the storage medium.
7. The device-implemented method of claim 1 , wherein the device is a tape drive, wherein the storage medium is a magnetic recording tape.
8. The device-implemented method of claim 1 , comprising receiving second data for storage on the storage medium, receiving a third key from a second external source, generating a second media encryption key using the first and third keys, encrypting the data using the second media encryption key, and writing the encrypted data to the storage medium.
9. A computer program product for enabling crypto-erase, performing crypto-erase, or enabling and performing crypto-erase, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a device configured to perform data operations on a storage medium to cause the device to perform the method of claim 1 .
10. A system, comprising:
a device configured to perform data operations on a storage medium, the device having a processor and logic integrated with the processor, executable by the processor, or integrated with and executable by the processor, the logic being configured to cause the device to perform the method of claim 1 .
11. A device-implemented method, comprising:
receiving, at a device configured to perform data operations on a storage medium, a request to read data, the data being stored on the storage medium in encrypted form;
retrieving a first key stored on the storage medium, with the storage medium, or on and with the storage medium;
receiving a second key from an external source;
generating a media encryption key directly from the first and second keys;
reading the encrypted form of the data from the storage medium;
decrypting the encrypted form of the data using the media encryption key;
outputting the decrypted data;
receiving an instruction to crypto-erase the data;
in response to receiving the instruction, attempting to delete, by the device, the first key; and
destroying the second key to ensure crypto-erasure of the data.
12. The device-implemented method of claim 11 , comprising deleting, by the device, the media encryption key in response to receiving the instruction.
13. The device-implemented method of claim 11 , wherein the first key is stored in the device in wrapped form in nonvolatile memory that is a different type of memory than the storage medium.
14. The device-implemented method of claim 11 , wherein the device is a tape drive, wherein the storage medium is a magnetic recording tape.
15. The device-implemented method of claim 11 , wherein the device is configured to prohibit transfer of the first key to outside of the device.
16. The device-implemented method of claim 11 , wherein the first key is stored on the storage medium, with the storage medium, or on and with the storage medium in raw form.
17. The device-implemented method of claim 11 , comprising generating the first key in the device; and storing, by the device, the first key on the storage medium, with the storage medium, or on and with the storage medium.
18. The device-implemented method of claim 11 , comprising receiving second data for storage on the storage medium, receiving a third key from a second external source, generating a second media encryption key using the first and third keys, encrypting the data using the second media encryption key, and writing the encrypted data to the storage medium.
19. A system, comprising:
a device configured to perform data operations on a storage medium, the device having a processor and logic integrated with the processor, executable by the processor, or integrated with and executable by the processor, the logic being configured to perform the method of claim 11 .
20. A device-implemented method, comprising:
receiving, at a device configured to perform data operations on a storage medium, a request to write data to the storage medium in encrypted form;
accessing a first key stored in a nonvolatile memory within the device apart from the storage medium;
receiving a second key from an external source;
generating a media encryption key directly from the first and second keys;
writing the requested data to the storage medium in encrypted form using the media encryption key;
receiving an instruction to crypto-erase the data;
in response to receiving the instruction, deleting, by the device, the first key; and
destroying the second key to ensure crypto-erasure of the data.
21. The device-implemented method of claim 20 , comprising generating the first key by the device, wherein the device is configured to prohibit transfer of the first key to outside of the device.
22. A system, comprising:
a device configured to perform data operations on a storage medium, the device having a processor and logic integrated with the processor, executable by the processor, or integrated with and executable by the processor, the logic being configured to cause the device to perform the method of claim 20 .
23. A device-implemented method, comprising:
receiving, at a device configured to perform data operations on a storage medium, a request to write data to the storage medium in encrypted form;
retrieving a first key stored on the storage medium, with the storage medium, or on and with the storage medium, the first key having been generated by the device;
receiving a second key from an external source;
generating a media encryption key directly from the first and second keys;
writing the requested data to the storage medium in encrypted form using the media encryption key;
receiving an instruction to crypto-erase the data;
in response to receiving the instruction, attempting to delete, by the device, the first key; and
destroying the second key to ensure crypto-erasure of the data.
24. The device-implemented method of claim 23 , wherein the device is configured to prohibit transfer of the first key to outside of the device.
25. A system, comprising:
a device configured to perform data operations on a storage medium, the device having a processor and logic integrated with the processor, executable by the processor, or integrated with and executable by the processor, the logic being configured to cause the device to perform the method of claim 23 .