Re-keying the contents of a storage device
Periodically re-encrypting user data stored on a storage device, including: determining that data stored in a first location of a storage device is encrypted with a data encryption key that has been decommissioned; re-encrypting the data utilizing a current data encryption key; and writing the data that is encrypted utilizing the current data encryption key to a second location of the storage device.
1. A method comprising:
determining that data stored in a first location of a storage device is encrypted with a data encryption key that has been decommissioned, wherein the data is associated with a user-visible identifier; and
storing the data re-encrypted with the current data encryption key to a second location of the storage device that is different from the first location, wherein the data is associated with the user-visible identifier when stored at the second location.
2. The method of claim 1 further comprising reporting the first location of the storage device to a garbage collection process.
3. The method of claim 2 further comprising performing garbage collection operations on the first location of the storage device.
4. The method of claim 1 further comprising decrypting the data that is encrypted with the data encryption key that has been decommissioned.
5. The method of claim 1 further comprising detecting that the data encryption key should be decommissioned, including detecting that the data encryption key has been utilized for a predetermined period of time.
6. The method of claim 1 further comprising detecting that the data encryption key should be decommissioned, including detecting that the data encryption key has been utilized to encrypt a predetermined amount of data.
7. The method of claim 1 wherein each data encryption key is encrypted with a key encryption key.
8. The method of claim 7 further comprising:
detecting that the key encryption key should be decommissioned; and
re-encrypting one or more data encryption keys with a new key encryption key.
9. A storage device that includes a computer processor and a computer memory, the computer memory including computer program instructions that, when executed by the computer processor, cause the storage device to carry out the steps of:
determining that data stored in a first location of a storage device is encrypted with a data encryption key that has been decommissioned, wherein the data is associated with a user-visible identifier; and
storing the data re-encrypted with the current data encryption key to a second location of the storage device that is different from the first location, wherein the data is associated with the user-visible identifier when stored at the second location.
10. The storage device of claim 9 further comprising computer program instructions that, when executed by the computer processor, cause the storage device to carry out the step of reporting the first location of the storage device to a garbage collection process.
11. The storage device of claim 10 further comprising computer program instructions that, when executed by the computer processor, cause the storage device to carry out the step of performing garbage collection operations on the first location of the storage device.
12. The storage device of claim 9 further comprising computer program instructions that, when executed by the computer processor, cause the storage device to carry out the step of decrypting the data that is encrypted with the data encryption key that has been decommissioned.
13. The storage device of claim 9 further comprising computer program instructions that, when executed by the computer processor, cause the storage device to carry out the step of detecting that the data encryption key should be decommissioned, including detecting that the data encryption key has been utilized for a predetermined period of time.
14. The storage device of claim 9 further comprising computer program instructions that, when executed by the computer processor, cause the storage device to carry out the step of detecting that the data encryption key should be decommissioned, including detecting that the data encryption key has been utilized to encrypt a predetermined amount of data.
15. The storage device of claim 9 wherein each data encryption key is encrypted with a key encryption key.
16. The storage device of claim 15 further comprising computer program instructions that, when executed by the computer processor, cause the storage device to carry out the steps of:
detecting that the key encryption key should be decommissioned; and
re-encrypting one or more data encryption keys with a new key encryption key.
17. A storage system that includes a plurality of storage devices, the storage system including a computer processor and a computer memory, the computer memory including computer program instructions that, when executed by the computer processor, cause the computer processor to carry out the steps of:
determining that data stored in a first location of a storage device is encrypted with a data encryption key that has been decommissioned, wherein the data is associated with a user-visible identifier; and
storing the data re-encrypted with the current data encryption key to a second location of the storage device that is different from the first location, wherein the data is associated with the user-visible identifier when stored at the second location.