Managing migration of self encrypted drive within a single key management system user group
A disclosed method for managing encryption keys, which may be performed by a key management server, responds to receiving, from a first client, a request to create a new key for a self-encrypting drive (SED) associated with the first client by retrieving unique identifiers of the first client and the SED, generating and storing the new key and a corresponding key identifier (KeyID), and associating the unique identifiers of the SED and first client with the new key. Upon receiving, from a second client, a locate key request that includes the SED identifier, providing the new key, the KeyID, and the first client identifier to the second client. Associating the SED and first client identifiers with the new key may include adding the identifiers as attributes of the KeyID. Embodiments may be implemented in accordance with a key management interoperability protocol (KMIP) standard.
1. A method for managing encryption keys, the method comprising:
responsive to receiving, from a first client, a request to create a new key for encrypting a storage drive associated with the first client:
retrieving an identifier of the first client and an identifier of the storage drive;
generating and storing the new key and a corresponding key identifier (KeyID); and
associating the identifier of the storage drive and the identifier of the first client with the new key; and
responsive to receiving, from a second client, a locate key request, wherein the locate key request is indicative of the identifier of the storage drive, providing, to the second client, information indicative of the new key, the KeyID, and the identifier of the first client, wherein the first client comprises a first key management interoperability protocol (KMIP) client executing on a baseboard management controller (BMC) of a first managed server and the second client comprises a second KMIP client executing on a BMC of a second managed server.
2. The method of claim 1 , further comprising: determining that the storage drive comprises a self-encrypting drive (SED).
3. The method of claim 1 , further comprising: determining that the SED comprises an SED configured not to store KeyIDs internally.
4. The method of claim 1 , wherein associating the identifier of the storage drive and the identifier of the first client with the new key comprises adding the identifier of the storage drive and the identifier of the first client as attributes of the KeyID.
5. The method of claim 1 , further comprising: determining that the first client and the second client communicate with the same key management server.
6. The method of claim 1 , further comprising: caching, by the second client, the new key, the KeyID, and the identifier of the first client.
7. A key management server for managing encryption keys, wherein the key management server is configured to perform key management operations comprising:
responsive to receiving, from a first client, a request to create a new key for encrypting a storage drive associated with the first client:
retrieving an identifier of the first client and an identifier of the storage drive;
generating and storing the new key and a corresponding key identifier (KeyID); and
associating the identifier of the storage drive and the identifier of the first client with the new key; and
responsive to receiving, from a second client, a locate key request, wherein the locate key request is indicative of the identifier of the storage drive, providing, to the second client, information indicative of the new key, the KeyID, and the identifier of the first client, wherein the first client comprises a first key management interoperability protocol (KMIP) client executing on a baseboard management controller (BMC) of a first managed server and the second client comprises a second KMIP client executing on a BMC of a second managed server.
8. The key management server of claim 7 , further comprising: determining that the storage drive comprises a self-encrypting drive (SED).
9. The key management server of claim 7 , further comprising: determining that the SED comprises an SED configured not to store KeyIDs internally.
10. The key management server of claim 7 , wherein associating the identifier of the storage drive and the identifier of the first client with the new key comprises adding the identifier of the storage drive and the identifier of the first client as attributes of the KeyID.
11. The key management server of claim 7 , further comprising: determining that the first client and the second client communicate with the same key management server.
12. The key management server of claim 7 , further comprising: caching, by the second client, the new key, the KeyID, and the identifier of the first client.