Dynamically migrating drive locking keys across key management servers
An information handling system includes a BMC configurable in a first mode to provide external encryption keys for transactions with a storage device from external key management services, and in a second mode to generate local encryption keys for the transactions. At a first time, the BMC is configured in the first mode to provide external encryption keys for the transactions from a first external key management service. At a second time subsequent to the first time, the BMC is configured in the second mode to generate local encryption keys for the transactions. At a third time subsequent to the second time, the BMC is configured in the first mode to provide second external encryption keys for the transactions from a second external key management service. After the third time, no user data is lost on the first storage device as compared with a time prior to the first time.
1 . An information handling system, comprising:
a first storage device; and
a baseboard management controller configured in a first mode to provide external encryption keys for first transactions with the first storage device from external key management services, and in a second mode to generate local encryption keys for the first transactions with the first storage device, wherein:
at a first time, the baseboard management controller is configured in the first mode to provide first external encryption keys for the first transactions from a first external key management service;
at a second time subsequent to the first time, the baseboard management controller is configured in the second mode to generate first local encryption keys for the first transactions; and
at a third time subsequent to the second time, the baseboard management controller is configured in the first mode to provide second external encryption keys for the first transactions from a second external key management service, wherein after the third time, no user data is lost on the first storage device compared with a time prior to the first time.
2 . The information handling system of claim 1 , wherein the baseboard management controller includes a first key generator.
3 . The information handling system of claim 2 , wherein, when the baseboard management controller is configured in the second mode, the first key generator generates the local encryption keys.
4 . The information handling system of claim 1 , further comprising:
a second storage device; and
a storage device controller configured in the first mode to provide external encryption keys for second transactions with the second storage device from the external key management services, and in the second mode to generate the local encryption keys for the second transactions with the second storage device.
5 . The information handling system of claim 4 , wherein:
at the first time, the storage device controller is configured in the first mode to provide third external encryption keys for the second transactions from the first external key management service via the baseboard management controller;
at the second time, the storage device controller is configured in the first mode to provide second local encryption keys from the baseboard management controller for the second transactions; and
at the third time, the storage device controller is configured in the first mode to provide fourth external encryption keys for the first transactions from the second external key management service via the baseboard management controller, wherein, after the third time, no user data is lost on the second storage device as compared with a time prior to the first time.
6 . The information handling system of claim 5 , wherein the storage device controller includes a second key generator.
7 . The information handling system of claim 6 , wherein, when the storage device controller is configured in the second mode, the second key generator generates the local encryption keys.
8 . The information handling system of claim 1 , wherein the first storage device includes a self-encrypting storage device that operates to encrypt the user data on the first storage device.
9 . The information handling system of claim 1 , wherein the first storage device includes one of a direct attached data storage device and an object service storage device.
10 . The information handling system of claim 1 , wherein the external encryption keys are secure external key management encryption keys.
11 . A method, comprising:
providing, in an information handling system, a first storage device;
providing, in the information handling system, a baseboard management controller configured in a first mode to provide external encryption keys for first transactions with the first storage device from external key management services, and in a second mode to generate local encryption keys for the first transactions with the first storage device;
configuring, at a first time, the baseboard management controller in the first mode to provide first external encryption keys for the first transactions from a first external key management service;
configuring, at a second time subsequent to the first time, the baseboard management controller in the second mode to generate first local encryption keys for the first transactions; and
configuring, at a third time subsequent to the second time, the baseboard management controller in the first mode to provide second external encryption keys for the first transactions from a second external key management service, wherein after the third time, no user data is lost on the first storage device compared with a time prior to the first time.
12 . The method of claim 11 , wherein the baseboard management controller includes a first key generator.
13 . The method of claim 12 , further comprising generating, when the baseboard management controller is configured in the second mode, the local encryption keys by the first key generator.
14 . The method of claim 11 , further comprising:
providing, in the information handling system, a second storage device; and
providing, in the information handling system, a storage device controller configured in the first mode to provide external encryption keys for second transactions with the second storage device from the external key management services, and in the second mode to generate the local encryption keys for the second transactions with the second storage device.
15 . The method of claim 14 , further comprising:
configuring, at the first time, the storage device controller in the first mode to provide third external encryption keys for the second transactions from the first external key management service via the baseboard management controller;
configuring, at the second time, the storage device controller in the first mode to provide second local encryption keys from the baseboard management controller for the second transactions; and
configuring, at the third time, the storage device controller in the first mode to provide fourth external encryption keys for the first transactions from the second external key management service via the baseboard management controller, wherein, after the third time, no user data is lost on the second storage device as compared with a time prior to the first time.
16 . The method of claim 15 , wherein the storage device controller includes a second key generator.
17 . The method of claim 16 , further comprising generating, when the storage device controller is configured in the second mode, the local encryption keys by the second key generator.
18 . The method of claim 11 , wherein the first storage device includes a self-encrypting storage device that operates to encrypt the user data on the first storage device.
19 . The method of claim 11 , wherein the first storage device includes one of a direct attached data storage device and an object service storage device.
20 . An information handling system, comprising:
a first external key management service;
a second external key management service;
a storage device; and
a baseboard management controller configured in a first mode to provide external encryption keys for transactions with the first storage device from one of the first and second external key management services, and in a second mode to generate local encryption keys for the transactions with the storage device, wherein:
at a first time, the baseboard management controller is configured in the first mode to provide first external encryption keys for the transactions from the first external key management service;
at a second time subsequent to the first time, the baseboard management controller is configured in the second mode to generate local encryption keys for the transactions; and
at a third time subsequent to the second time, the baseboard management controller is configured in the first mode to provide second external encryption keys for the transactions from the second external key management service, wherein, after the third time, no user data is lost on the first storage device as compared with a time prior to the first time.