Using encryption keys to manage data retention
Systems and methods for using encryption keys to manage data retention are described. In one embodiment, the systems and methods may include receiving data such as user data from a host of the storage drive, encrypting the data using an encryption key, writing the encrypted data to the storage drive, and retaining the encrypted data on the storage drive based at least in part on a validity of the encryption key.
1. A storage system comprising:
a storage drive; and
a controller to:
encrypt data using an encryption key;
assign an encryption identifier to the encryption key, the encryption key being programmed in the controller, wherein the controller is a hardware controller;
store the encryption identifier in a mapping table, the mapping table mapping a logical block address (LBA) of the encrypted data with a physical location on the storage drive;
write the encrypted data to the storage drive;
retain the encrypted data on the storage drive based at least in part on a validity of the encryption key;
scan the mapping table for entries containing a link to an expired encryption key;
determine the encryption key is expired based at least in part on the scanning; and
make storage space associated with the encrypted data available for storage of data different from the encrypted data after determining the encryption key is expired.
2. The storage system of claim 1 , comprising the controller to:
receive the data from a host of the storage drive, the data including user data.
3. The storage system of claim 1 , comprising the controller to:
store the encryption identifier of the encryption key in metadata associated with the encrypted data; and
identify an expiration policy of the encryption key.
4. The storage system of claim 1 , comprising the controller to:
receive a command to read the encrypted data from the storage drive.
5. The storage system of claim 4 , comprising the controller to:
acquire the encryption identifier associated with the encrypted data.
6. The storage system of claim 5 , comprising the controller to:
verify a validity of the encryption key based at least in part on acquiring the encryption identifier.
7. The storage system of claim 6 , comprising the controller to:
upon determining the encryption key is valid, decrypt the encrypted data using the encryption key; and
transfer the decrypted data to the host.
8. The storage system of claim 6 , comprising the controller to:
upon determining the encryption key is invalid, remove the LBA of the encrypted data from the mapping table; and
discard the encrypted data from the storage drive.
9. An apparatus comprising:
a controller to:
encrypt data using an encryption key;
assign an encryption identifier to the encryption key, the encryption key being programmed in the controller, wherein the controller is a hardware controller;
store the encryption identifier in a mapping table, the mapping table mapping a logical block address (LBA) of the encrypted data with a physical location on the storage drive;
write the encrypted data to the apparatus;
retain the encrypted data on the apparatus based at least in part on a validity of the encryption key;
scan the mapping table for entries containing a link to an expired encryption key;
determine the encryption key is expired based at least in part on the scanning; and
make storage space associated with the encrypted data available for storage of data different from the encrypted data after determining the encryption key is expired.
10. The apparatus of claim 9 , comprising the controller to:
receive the data from a host of the apparatus, the data including user data.
11. The apparatus of claim 9 , comprising the controller to:
store the encryption identifier of the encryption key in metadata associated with the encrypted data; and
identify an expiration policy of the encryption key.
12. The apparatus of claim 9 , comprising the controller to:
receive a command to read the encrypted data from the storage drive.
13. The apparatus of claim 12 , comprising the controller to:
acquire the encryption identifier associated with the encrypted data.
14. The apparatus of claim 13 , comprising the controller to:
verify a validity of the encryption key based at least in part on acquiring the encryption identifier.
15. A method comprising:
receiving data from a host of a storage drive, the data including user data;
encrypting the data using an encryption key;
assigning an encryption identifier to the encryption key, the encryption key being programmed in a hardware controller of the storage drive;
storing the encryption identifier in a mapping table, the mapping table mapping a logical block address (LBA) of the encrypted data with a physical location on the storage drive;
writing the encrypted data to the storage drive;
retaining the encrypted data on the storage drive based at least in part on a validity of the encryption key;
scanning the mapping table for entries containing a link to an expired encryption key;
determining the encryption key is expired based at least in part on the scanning; and
making storage space associated with the encrypted data available for storage of data different from the encrypted data after determining the encryption key is expired.
16. The method of claim 15 , comprising:
storing the encryption identifier of the encryption key in metadata associated with the encrypted data; and
identifying an expiration policy of the encryption key.