Encryption/decryption for data storage system with snapshot capability

1. A method for managing access to encrypted data of a data storage system storing snapshot data to a computer-readable storage medium, a snapshot or combination of snapshots providing a previous point-in-time copy of data in a volume of the data storage system, wherein changing encryption keys are used to encrypt data stored to the computer-readable storage medium, the method comprising:

for a given snapshot:

storing in the computer-readable storage medium of the data storage system, encrypted snapshot data for the snapshot and a decryption key identifier for a decryption key corresponding to an encryption key utilized to encrypt data written to a volume to which the snapshot is associated since a previous snapshot associated with the volume was committed to disk, the decryption key identifier being an identifier of the decryption key while not being a decryption key itself; and

associating the decryption key identifier with the snapshot; and

upon request for the encrypted snapshot data by a requesting system operably connected to the data storage system via a network, providing the decryption key identifier associated with the snapshot wherein the requesting system uses a key table stored separate from the computer-readable storage medium and associating decryption key identifiers with corresponding decryption keys to determine the decryption key required for accessing the encrypted snapshot data associated with the snapshot.

2. The method of claim 1 , wherein the decryption key identifier is stored in metadata for the snapshot.

3. The method of claim 2 , wherein the decryption key and corresponding encryption key are symmetric.

4. The method of claim 2 , wherein the decryption key and corresponding encryption key are asymmetric.

5. The method of claim 1 , wherein the snapshot identifies only write data for a volume between the times when it is committed to disk as read-only and when a previous snapshot associated with the volume was committed to disk as read-only.

6. The method of claim 5 , wherein the encryption key is changed each time a snapshot is committed to disk as read-only, such that each snapshot is associated with a corresponding different decryption key identifier.

7. A data storage system comprising:

a computer-readable storage medium storing snapshots and decryption key identifiers, wherein one or more snapshots provide a read-only previous point-in-time copy of data in a volume of the data storage system, and each snapshot comprises encrypted snapshot data and is associated with a decryption key identifier stored on the computer-readable storage medium identifying a decryption key corresponding to an encryption key utilized to encrypt data written to the volume since a previous snapshot was committed to disk, the decryption key identifier not being a decryption key itself; and

a network connection operably connecting the data storage system with a requesting system, such that upon request for the encrypted snapshot data of a given snapshot by the requesting system, the decryption key identifier associated with the given snapshot is provided via the network connection wherein the requesting system uses a key table stored separate from the computer-readable storage medium and associating decryption key identifiers with corresponding decryption keys to determine the decryption key required for accessing the encrypted snapshot data associated with the given snapshot.

8. The system of claim 7 , wherein each snapshot comprises metadata and the decryption key identifier for a snapshot is stored in the metadata for that snapshot.

9. The system of claim 8 , wherein each decryption key and corresponding encryption key are symmetric.

10. The system of claim 8 , wherein each decryption key and corresponding encryption key are asymmetric.

11. The system of claim 7 , wherein each of the one or more snapshots providing a read-only previous point-in-time copy of data in a volume of the data storage system identifies only write data for the volume between the times when that snapshot is committed to disk as read-only and when a previous snapshot associated with the volume was committed to disk as read-only.

12. The system of claim 7 , wherein the encryption key is changed each time a snapshot is committed to disk as read-only, such that each snapshot is associated with a corresponding different decryption key identifier.

13. A method for managing access to encrypted data of a data storage system storing snapshot data to a computer-readable storage medium, in which changing encryption keys are used to encrypt data stored to the computer-readable storage medium, the method comprising:

managing data writes to the data storage system using point-in-time copies (PITCs), an active PITC being a PITC handling all writes to a volume of the data storage system;

for each volume:

managing decryption key identifiers for that volume, each decryption key identifier identifying a decryption key corresponding to an encryption key utilized to encrypt data written to that volume, the decryption key identifier not being a decryption key itself; and

upon committing an active PITC for that volume to disk as read-only and demoting the active PITC from active status, associating, with the demoted PITC, each managed decryption key identifiers corresponding to an encryption key utilized to encrypt data written to that volume while the demoted PITC was active; and

upon request for encrypted data from the demoted PITC by a requesting system operably connected to the data storage system via a network, providing a decryption key identifier associated with the demoted PITC wherein the requesting system uses a key table stored separate from the computer-readable storage medium and associating decryption key identifiers with corresponding decryption keys.

14. The method of claim 13 , wherein decryption key identifiers associated with a demoted PITC are stored in metadata for that PITC.

15. The method of claim 1 , further comprising:

for a given snapshot:

storing in the computer-readable storage medium of the data storage system, encrypted snapshot data for the snapshot and a decryption key identifier for each of a plurality of decryption keys, each corresponding to an encryption key utilized to encrypt data written to a volume to which the snapshot is associated since a previous snapshot associated with the volume was committed to disk, each decryption key identifier being an identifier of a decryption key while not being a decryption key itself; and

associating the decryption key identifiers with the snapshot; and

upon request for the encrypted snapshot data by a requesting system operably connected to the data storage system via a network, providing at least one of the decryption key identifiers associated with the snapshot wherein the requesting system uses the key table to determine at least one decryption key required for accessing the encrypted snapshot data associated with the snapshot.

16. The system of claim 7 , wherein:

at least one snapshot comprises encrypted snapshot data and is associated with a plurality of decryption key identifiers stored on the computer-readable storage medium, each decryption key identifier identifying a decryption key corresponding to an encryption key utilized to encrypt data written to the volume since a previous snapshot was committed to disk, each decryption key identifier not being a decryption key itself; and

the network connection operably connects the data storage system with the requesting system, such that upon request for the encrypted snapshot data of a given snapshot by the requesting system, at least one decryption key identifier associated with the given snapshot is provided via the network connection wherein the requesting system uses the key table to determine at least one decryption keys required for accessing the encrypted snapshot data associated with the given snapshot.