Remote replication with host encryption
Decrypting data at a first storage system that has been encrypted at a second, separate, storage system includes the first storage system requesting a key that decrypts the data from the second storage system, the second storage system determining if the first storage system is authorized for the key, the second storage system providing the key to the first storage system in response to the first storage system being authorized, a host that is coupled to the first storage system obtaining the key from the first storage system, and the host using the key to decrypt and access the data at the first storage system. The host and the first storage system may provide failover functionality for a system that includes the second storage system. The host may obtain the key from the first storage system in response to a failure of the system that includes the second storage system.
1. A method of failing over from a first storage system having data thereon that has been encrypted with a first encryption key to a second, separate, storage system having data thereon that has been encrypted with a second encryption key that is unrelated to the first encryption key, comprising:
replicating data that is encrypted using the first encryption key from the first storage system to the second storage system prior to failover from the first storage system, wherein the data is inaccessible at the second storage system using the second encryption key and wherein the first encryption key is securely stored on the first storage system in a table that is encrypted with a third encryption key that is unrelated to at least the first encryption key;
storing at the second storage system the data that is encrypted using the first encryption key;
the second storage system requesting the first encryption key from the first storage system prior to failover from the first storage system;
the first storage system determining if the second storage system is authorized for the first encryption key;
the first storage system applying the third encryption key to the table at the first storage system to access the first encryption key and providing the first encryption key to the second storage system prior to failover from the first storage system in response to the second storage system being authorized;
a host that is coupled to the second storage system requesting the first encryption key from the second storage system in response to receiving an indication that a failover has occurred; and
the host accessing the data encrypted with the first encryption key at the second storage system only if the host is provided with the first encryption key by the second storage system.
2. A method, according to claim 1 , wherein authorization is determined according to a manual configuration at a time of installation.
3. A method, according to claim 1 , wherein authorization is determined according to heuristic rules.
4. A method, according to claim 3 , wherein the heuristic rules include providing authorization storage systems that contain a replica of encrypted data from another storage system.
5. A method, according to claim 1 , wherein the first and the second storage systems share registration tables.
6. Non-transitory computer readable media containing software that handled failing over from a first storage system having data thereon that has been encrypted with a first encryption key to a second, separate, storage system having data thereon that has been encrypted with a second encryption key that is unrelated to the first encryption key, the software comprising:
executable code that replicates data that is encrypted using the first encryption key from the first storage system to the second storage system prior to failover from the first storage system, wherein the data is inaccessible at the second storage system using the second encryption key and wherein the first encryption key is securely stored on the first storage system in a table that is encrypted with a third encryption key that is unrelated to at least the first encryption key;
executable code that stores at the second storage system the data that is encrypted using the first encryption key;
executable code at second first storage system that requests the first encryption key from the first storage system prior to failover from the first storage system;
executable code at the first storage system that determines if the second storage system is authorized for the first encryption key;
executable code at the first storage system that applies the third encryption key to the table at the first storage system to access the first encryption key and provides the first encryption key to the second storage system prior to failover from the first storage system in response to the second storage system being authorized;
executable code at a host that is coupled to the second storage system and that requests the first encryption key from the second storage system in response to receiving an indication that a failover has occurred; and
executable code at the host that accesses the data encrypted with the first encryption key at the second storage system only if the host is provided with the first encryption key by the second storage system.
7. Non-transitory computer readable media, according to claim 6 , wherein authorization is determined according to a manual configuration at a time of installation.
8. Non-transitory computer readable media, according to claim 6 , wherein authorization is determined according to heuristic rules.
9. Non-transitory computer readable media, according to claim 8 , wherein the heuristic rules include providing authorization storage systems that contain a replica of encrypted data from another storage system.
10. Non-transitory computer readable media, according to claim 6 , wherein the first and the second storage systems share registration tables.
11. A system that provides failover capability, comprising:
a first storage system having one or more physical storage units that store data that is encrypted using a first encryption key, wherein the first encryption key is securely stored in a table on the first storage system, the table being encrypted with a third encryption key that is unrelated to at least the first encryption key;
a second storage system coupled to the first storage system and having one or more physical data units that store data that is encrypted using a second encryption key that is unrelated to the first encryption key;
a first host coupled to the first storage system to exchange data therewith that is encrypted at the first storage system using the first encryption key, the data being decryptable using the first encryption key; and
a second host coupled to the second storage system, the second storage system receiving the encrypted data from the first storage system and storing the data that is encrypted using the first encryption key, wherein the data from the first storage system is inaccessible at the second storage system using the second encryption key, the second storage system and second host providing failover support for the first storage system and first host, wherein the second storage system requests the first encryption key, the first storage system applies the third encryption key to the table at the first storage system to access and provide the first encryption key and the second storage system receives the first encryption key from the first storage system prior to a failover from the first storage system in response to the first storage system determining that the second storage system is authorized for the first encryption key, and then the second host requests the first encryption key from the second storage system in response to receiving an indication that a failover has occurred and the second host accesses the data encrypted with the first encryption key at the second storage system only if the second host is provided with the first encryption key by the second storage system.
12. A system, according to claim 11 , wherein authorization is determined according to a manual configuration at a time of installation.
13. A system, according to claim 11 , wherein authorization is determined according to heuristic rules.
14. A system, according to claim 13 , wherein the heuristic rules include providing authorization storage systems that contain a replica of encrypted data from another storage system.
15. A system, according to claim 11 , wherein the first and the second storage systems share registration tables.
16. A method, according to claim 1 , wherein at least one of the first encryption key and the second encryption key is a symmetric encryption key.
17. A method, according to claim 1 , wherein at least one of the first encryption key and the second encryption key corresponds to a public/private asymmetric key pair.
18. Non-transitory computer readable media, according to claim 6 , wherein at least one of the first encryption key and the second encryption key is a symmetric encryption key.
19. Non-transitory computer readable media, according to claim 6 , wherein at least one of the first encryption key and the second encryption key corresponds to a public/private asymmetric key pair.
20. A system, according to claim 11 , wherein at least one of the first encryption key and the second encryption key is a symmetric encryption key.