Methods and media for recovering lost encryption keys
An information handing system provides a method for recovering encryption keys. The method includes providing a first recording medium of a plurality of recording media in a first drive of a plurality of drives. A first key is requested from a primary key manager (PKM) associated with the first drive, wherein the first drive provides a first key identifier (ID) to the PKM. If it is determined that the PKM provides the first key corresponding to the first key ID, a first identifying information for the PKM is stored in a memory for the first recording medium.
1. A method for recovering encryption keys for an information handing system (“IHS”) data storage media library having a plurality of drives and managed encryption, by restoring the association of storage media with a key server, the method comprising:
(a) mounting a first recording medium of a plurality of recording media in a first drive of a plurality of drives;
(b) automatically requesting a first key from a primary key manager (PKM) associated with the first drive, wherein the first drive provides a first key identifier (ID) to the PKM;
(c) determining if the PKM associated with the first drive provides the first key corresponding to the first key ID;
(d) mounting the first recording medium of a plurality of recording media in a next drive of the plurality of drives if the PKM does not provide the first key corresponding to the first key ID;
(e) automatically requesting a first key from a primary key manager (PKM) associated with the next drive, wherein the next drive provides the first key identifier (ID) to the PKM associated with the next drive; and
(f) determining if the PKM associated with the next drive then provides the first key corresponding to the first key ID;
(g) repeating steps (d) through (f) for succeeding drives of the plurality of drives if the PKM associated with the next drive does not provide the first key corresponding to the first key ID; and
(h) storing a first identifying information for a PKM associated with a specific drive in a memory for the first recording medium when the PKM associated with the specific drive provides the first key.
2. The method of claim 1 , wherein a PKM manages a plurality of keys utilized to encrypt and decrypt the plurality of recording media, and each of the plurality of keys is associated with each of a plurality of key IDs.
3. The method of claim 1 , wherein the plurality of recording media are selected from a group consisting of magnetic tape cartridges, magnetic disk, optical disk, and memory cards.
4. The method of claim 1 , wherein when a PKM associated with a specific drive provides the first key, the first recording medium is associated with a first partition in an inventory information and the first recording medium is returned to a storage slot associated with the first partition and the PKM associated with the specific drive.
5. The method of claim 1 , wherein steps (a)-(h) are repeated for each of the plurality of recording media in the IHS.
6. The method of claim 1 , further comprising:
(k) requesting the first key from a secondary key manager (SKM) associated with the first drive if the PKM associated with the first drive does not provide the first key, wherein the first drive provides the first key ID to the SKM;
(l) determining if the SKM provides the first key corresponding to the first key ID; and
(m) storing a second identifying information for the SKM to the memory for the first recording medium if the SKM provides the first key.
7. The method of claim 6 further comprising:
(n) moving the first recording medium to a mailslot for removal from the IHS if none of the plurality of PKMs and the plurality of SKMs provide the first key corresponding to the first key ID; and
(o) removing the first recording medium from an inventory information for the IHS.
8. The method of claim 7 , wherein steps (a)-(o) are repeated for each of the plurality of recording media in the IHS, and the steps (a)-(o) are automated by the IHS.
9. A method for recovering encryption keys for managed tape libraries of an information handing system (“IHS”) by restoring the association of storage media with a corresponding key server, the method comprising:
(a) providing a first of a plurality of tape recording media in a first of a plurality of tape drives;
(b) automatically requesting a first key from a primary key manager (PKM) associated with the first tape drive, wherein the first tape drive provides a first key identifier (ID) to the PKM;
(c) determining if the PKM associated with the first tape drive provides the first key corresponding to the first key ID;
(d) mounting the first tape recording medium of a plurality of tape recording media in a next tape drive of the plurality of tape drives if the PKM does not provide the first key corresponding to the first key ID;
(e) automatically requesting a first key from a primary key manager (PKM) associated with the next tape drive, wherein the next tape drive provides the first key identifier (ID) to the PKM associated with the next tape drive; and
(f) determining if the PKM associated with the next tape drive then provides the first key corresponding to the first key ID;
(g) repeating steps (d) through (f) for succeeding tape drives of the plurality of tape drives if the PKM associated with the next tape drive does not provide the first key corresponding to the first key ID; and
(h) storing a first identifying information for a PKM associated with a specific tape drive in a memory for the first tape recording medium when the PKM associated with the specific drive provides the first key.
10. The method of claim 9 , wherein a PKM manages a plurality of keys utilized to encrypt and decrypt the plurality of tape recording media, and each of the plurality of keys is associated with each of a plurality of key IDs.
11. The method of claim 9 , wherein when a PKM associated with a specific tape drive provides the first key, the first tape recording medium is associated with a first partition in an inventory information and the first tape recording medium is returned to a storage slot associated with the first partition and the PKM associated with the specific tape drive.
12. The method of claim 9 , further comprising:
(k) requesting the first key from a secondary key manager (SKM) associated with the first tape drive if the PKM associated with the first tape drive does not provide the first key, wherein the first tape drive provides the first key ID to the SKM;
(l) determining if the SKM provides the first key corresponding to the first key ID; and
(m) storing a second identifying information for the SKM to the memory for the first tape recording medium if the SKM provides the first key.
13. The method of claim 12 further comprising:
(n) repeating steps (k)-(m) for a next SKM associated with the next tape drive if the next PKM associated with the next tape drive does not provide the first key.
14. The method of claim 13 further comprising:
(o) moving the first tape recording medium to a mailslot for removal from the IHS if none of the plurality of PKMs and the plurality of SKMs provide the first key corresponding to the first key ID; and
(p) removing the first tape recording medium from an inventory information for the IHS.
15. The method of claim 14 , wherein steps (a)-(p) are repeated for each of the plurality of tape recording media in the IHS, and the steps (a)-(p) are automated by the IHS.