MANAGEMENT OF ACCESS TO TAPE CASSETTES AT A TAPE ARCHIVING SERVICE PROVIDER

Abstract

Computer program product stored in a tape drive (2001, 2002, 200 i , 200 n ) is implemented in which a tape cassette (202 i ) including a non-volatile memory (220) and a tape medium (208), wherein the computer program product comprises a computer-readable storage medium containing computer-readable program code that is executable to perform operations, the operations comprising: Determine (402) whether the non-volatile memory of the tape cartridge stores a key encryption key (218) that includes a user-associated user encryption key (302) encrypted with a public key of a private key-public key pair; and In response to the determination that the non-volatile memory of the tape cartridge stores the key encryption key, perform: Decrypting (410) the key encryption key with the private key to generate the user encryption key; and Providing the user encryption key resulting from decryption to an encryption engine (212) of the tape drive to encrypt plaintext data read from the tape medium in the tape cartridge with the user encryption key (412; 508) in order to return the encrypted plaintext data to a read request (510).

Description

BACKGROUND OF THE INVENTION 1. Field of the invention

[0001] The present invention relates to a computer program product, a system and a method for managing access to tape cassettes at a tape archiving service provider. 2. Description of the related technology

[0002] Certain companies provide tape archiving services to allow users to outsource the archive storage of backup tape cartridges to the tape archiving service provider. Tape archiving services provide a secure and climate-controlled environment for storing archived tape cartridges to minimize physical deterioration over time. Typically, the tape archiving service delivers tape cartridges from a storage facility to the user when the user needs to retrieve data from the tape cartridges.

[0003] One disadvantage of tape archiving services is the inconvenience for users accessing the tape cartridges sent to the archive as needed, since users typically have to wait for the cartridges to be physically returned. Furthermore, if data is stored in plaintext on the tape cartridges, someone at the service provider's facility could potentially access them and misuse sensitive data. If the service provider is not provided with access to an encryption key to access encrypted data stored on the tape, they may be unable to transfer user data from older cartridges to the latest generation of tapes, which typically hold significantly more data than previous generation cartridges.

[0004] There is a need in the technology sector for improved techniques to provide tape archiving services to users who own collections of tape cassettes.

[0005] Publication US 2020 / 0152235A1 relates to a medium auxiliary memory (MAM) comprising: a non-volatile, non-transient solid-state storage device; an antenna; a MAM transceiver; a microprocessor; and an encrypted data key uniquely corresponding to a data key that can be obtained exclusively from a server located remote from the MAM, wherein the encrypted data key is stored in the non-volatile, non-transient solid-state storage device and the data key can be obtained only when the encrypted data key is transmitted to and decrypted by the server.

[0006] Publication US 2008 / 0219449A1 concerns a storage medium comprising: a magnetically encoded key identifier for identifying an encryption key, wherein the key identifier comprises: a device identifier that identifies the origin of the key; a timestamp; and a key nonce. SUMMARY

[0007] The invention relates to computer program products, systems, and methods, the features of which are specified in the corresponding patent claims. Embodiments of the invention are specified in the dependent patent claims.

[0008] A first embodiment provides a computer program product, a system, and a method for managing access to tape cartridges at a tape archiving service provider. It determines whether non-volatile memory in the tape cartridge stores a key encryption key that includes an encrypted user encryption key associated with a user. In response to the determination that the tape cartridge's non-volatile memory stores the key encryption key, the key encryption key is decrypted to generate the user encryption key. The user encryption key resulting from the decryption is provided to an encryption engine of the tape drive to encrypt plaintext data read from the tape medium in the tape cartridge using the user encryption key in order to return it to a read request.

[0009] The first embodiment provides security and encryption protocols to prevent unauthorized users from reading plaintext data on the tape cartridge by allowing the tape drive to access the user encryption key contained in a key encryption key stored on the tape cartridge at the tape archiving service. This enables the tape drive to securely access the user encryption key through a series of encryptions, then to encrypt data read from the tape cartridge to serve in a read request, and to decrypt encrypted write data served to the tape drive to write to the tape cartridge.In this way, the tape drive ensures that plaintext data on the tape cartridge remains safe and secure by encrypting all external transmissions of the data with an encryption key provided by a user who stored the data on the tape cartridge.

[0010] The first embodiment may optionally include the key encryption key being signed in the non-volatile memory of the tape cartridge with a private user key associated with the user. The non-volatile memory of the tape cartridge contains a public user key. The operations performed in response to the non-volatile memory of the tape cartridge storing the key encryption key and the public user key include using the public user key to authenticate the signed key encryption key in order to generate the key encryption key. Decryption of the key encryption key is performed in response to the authentication of the signed key encryption key.

[0011] With the aforementioned additional optional embodiment, signing the key encryption key and using the public user key for authentication to the tape drive ensures that the key encryption key is provided by a genuine user. Once the user who wrote the key encryption key to the tape cartridge is authenticated, the decryption of the key encryption key can proceed to generate the user encryption key, with the user authenticated.

[0012] The first embodiment can optionally further include the key encryption key comprising the user encryption key, which is encrypted with a product-specific public key associated with the tape drive. The key encryption key is decrypted with a product-specific private key stored in the tape drive to generate the user encryption key, which is used to encrypt the plaintext data read from the tape medium.

[0013] With the aforementioned additional optional embodiment, the user can securely store the key encryption key in the tape cartridge, which contains the user encryption key encrypted with a product-specific public key. Only the tape drive can decrypt this public key using the product-specific secret key held by the tape drive. This ensures that only the legitimate tape drive is capable of decrypting the key encryption key to obtain the user encryption key, since only an authorized tape drive would possess the product-specific secret key.

[0014] The first embodiment can optionally further include receiving a read request for the plaintext data on the tape medium. In response to the read request, the encryption engine can use the user encryption key to encrypt the requested plaintext data from the tape medium in order to return the encrypted plaintext data to the read request.

[0015] With the aforementioned additional optional embodiment, although the tape cartridge stores plaintext data, the tape drive only returns encrypted data, which is encrypted with the user encryption data, to a read request in order to ensure that only the user who wrote the data to the cartridge can read and access the encrypted data, since the plaintext data on the tape cartridge can only be decrypted by the user encryption key, which is securely maintained by the user.

[0016] The first embodiment can optionally further provide that the tape drive comprises a source tape drive, the tape cartridge comprises a source tape cartridge, and the tape medium comprises a source tape medium. Furthermore, the read request includes an operation to transfer encrypted plaintext data from the source tape medium to a target tape medium in a target tape cartridge coupled to a target tape drive. In such a case, the key encryption key is transferred from the source tape drive to the target tape drive for storage. The target tape drive decrypts the transferred key encryption key to generate the user encryption key, which is to be used to decrypt the plaintext data transferred from the source tape drive to generate the plaintext data for writing to the target tape medium.

[0017] With the foregoing additional embodiment, the encrypted read mode is used to transfer encrypted plaintext data from one or more source tape drives to a target tape drive, where the target tape drive must decrypt the data to store it on the tape medium. This can be done when the tape cartridge is upgraded to a higher-capacity target tape cartridge. Furthermore, the keys are copied from the source tape cartridge to the target tape cartridge so that the target tape cartridge has the same encrypted read mode settings as the source tape cartridge. This allows the target tape cartridge to be processed in the same way as the source cartridge. Additionally, this migration procedure enables secure replay of the contents of the tape medium 208 by encrypting the data before migrating it to a new target drive.

[0018] A second embodiment provides a computer program product, a system, and a method for managing access to tape cartridges at a tape archiving service provider. Plaintext data is received by a user computer, assigned to a user, for writing to the tape medium of the tape cartridge. A product-specific public key, assigned to the tape drive, is sent to the user computer. A key encryption key is then received by the user computer, comprising a user-assigned encryption key that is encrypted with the product-specific public key. The product-specific public key and a product-specific private key are stored in the tape drive and form a key pair in a cryptographic system.The key encryption key is decrypted using the product-specific private key to generate the user encryption key. The user encryption key is used to encrypt the plaintext data read from the tape medium in order to return it to a read request.

[0019] With the aforementioned second embodiment, the user computer can provide a key encryption key that is encrypted with the tape drive's product-specific public key, so that the tape drive can now be used with the tape cartridge. Encrypting the user encryption key with the product-specific public key assures the user that only a legitimate tape drive containing the product-specific private key can access the user encryption key to encrypt plaintext data read from the tape drive.

[0020] The second embodiment can optionally store the key encryption key in non-volatile memory within the tape cartridge. When it is detected that the tape cartridge is being reinserted into the tape drive after being ejected, the key encryption key is accessed from the non-volatile memory of the reinserted tape cartridge. The accessed key encryption key is then decrypted using the product-specific private key to generate the user encryption key, which is used to encrypt plaintext data read from the tape medium.

[0021] With the foregoing optional embodiment, the new key encryption key, which was stored in a non-volatile memory of the tape cartridge when received from the user, can now be accessed when the tape cartridge is reinserted into the tape drive to cause the tape drive to access the new key encryption key stored in the tape cartridge in order to decrypt, in order to generate the user encryption key to be used to encrypt data in order to return it to a read operation, and to decrypt data in order to write it to plaintext.

[0022] The second embodiment may optionally further include the received key encryption key comprising a first key encryption key, and the user encryption key comprising a first user encryption key. A determination is made as to whether decryption was successful during the generation of the first user encryption key. In response to the determination that decryption was successful during the generation of the user encryption key, the first key encryption key is stored in non-volatile memory of the tape cartridge. Storing the first key encryption key overwrites a second key encryption key stored in the non-volatile memory of the tape cartridge, which comprises a second user encryption key assigned to the user and encrypted with the product-specific public key.The second key encryption was stored in the non-volatile memory of the tape cartridge before the first key encryption key was received by the user.

[0023] In the aforementioned optional embodiment, the initial user-provided key encryption key is used to update and overwrite a previous key encryption key stored in the tape cartridge for future read and write operations when the tape cartridge is reinserted into the tape drive. This allows the user to update the user encryption keys stored in the tape cartridge for future read and write operations in the memory cartridge. BRIEF DESCRIPTION OF THE DRAWINGS Fig. Figure 1 illustrates an embodiment of a tape archiving environment. Fig. Figure 2 illustrates an embodiment of a tape drive and a tape cassette. Fig. Figure 3 illustrates an embodiment of a user computer for performing operations relating to the tape drive and tape cartridge at a tape archiving service provider. Fig. Figure 4 illustrates one embodiment of operations that are performed when a tape cartridge is inserted into a tape drive to access a user encryption key. Fig. Figure 5 illustrates an embodiment of operations performed by a tape archiving service provider to process a user request to read data from a user tape cartridge sent to the tape archiving service provider. Fig. Figure 6 illustrates an embodiment of operations performed by a tape archiving service provider to process a user request to write data to a user tape cartridge that is sent to the tape archiving service provider. Fig. Figure 7 illustrates an embodiment of an arrangement of a source tape drive and a destination tape drive in a tape library to migrate data from one or more source tapes to a destination tape in the destination tape drive. Fig. Figure 8 illustrates an embodiment of operations for copying data from a source tape cartridge in a source tape drive to a destination tape cartridge in a destination tape drive. Fig. Figure 9 illustrates an embodiment of operations performed by a user computer and the tape archiving service provider to update the user encryption key used for a tape cartridge at the tape archiving service provider. Fig. Figure 10 illustrates a computing environment in which the components of Fig. 1 and Fig. 2 can be implemented. DETAILED DESCRIPTION

[0024] The described embodiments provide improvements in computer technology for enabling access to plaintext data on tape cartridges maintained by a tape archiving service. These embodiments provide security and encryption protocols to prevent unauthorized users from reading plaintext data on the tape cartridge by allowing the tape drive at the tape archiving service to access the user encryption key contained in a key encryption key maintained on the tape cartridge.This allows the tape drive to securely access the user's encryption key through a series of encryption and signature operations. It then encrypts data read from the tape cartridge to serve in a read request and decrypts encrypted write data served to the tape drive to write to the tape cartridge. In this way, the tape drive ensures that plaintext data on the tape cartridge remains safe and secure by encrypting all external transfers of the data with an encryption key provided by the user who stored the data on the tape cartridge.

[0025] Furthermore, by having the tape drive unwrap the user encryption key from the source tape cartridge, a source tape drive can migrate plaintext data on a source tape cartridge, encrypted with the user encryption key received from the source tape cartridge, to a target tape cartridge and copy the key encryption key from the source tape drive to store it in the target tape cartridge. In this way, the target tape cartridge can unwrap the same user encryption key from the key encryption key that was copied to the target tape cartridge in order to decrypt the encrypted transferred data and store it in plaintext in the target tape cartridge.In this way, the tape drive at the tape archiving service provider does not need to obtain the key from a key manager, but can instead obtain the key from the tape cartridge that the data is to be accessed or transferred.

[0026] Fig. Figure 1 illustrates an embodiment of a tape archiving environment, showing a facility of a tape archiving service provider 100, which contains one or more tape libraries 102 and stored tapes 104 from tape cassettes 202. i ( Fig. 2) exhibits, which are provided by users or clients of the tape archiving services offered by the service provider. A service provider server 106 includes a server request manager 108 to handle requests from user computers 300 i to receive via a network 110, in order to access data in tape cassettes 202 ito access the tapes that users have sent to the tape archiving service provider 100 for archiving.

[0027] The band library 102 contains a magazine 112 of tape cassettes 202 i , a gripper 114 having a robot gripper arrangement for grasping a tape cassette in the magazine 112 and moving to another magazine or storage location or to one of the tape drives 2001, 2002...200 n to move, and a barcode reader to read barcodes on the label of the tape cassette 202 i to read; and a library controller 116 to receive requests for data in a tape cassette and to control the accessor 114 to read a tape cassette 202 i to use and user read and write requests from a user computer 300 to the tape drives 2001, 2002...200 n to direct. The library controller 116 has information about cassettes 202. ion the various tape drives 2001, 2002...200 n , magazines 112 and the stored tapes 104. The service provider server 106 and the tape libraries 102 can communicate via a local network 118 of the tape archiving service provider 100.

[0028] Fig. Figure 2 illustrates an embodiment of a tape drive 200i which includes a controller 204 to receive read and write requests and to control a tape head system 206 to write data to a mounted tape storage medium 208 in a tape cassette 202. i , which go into the tape drive 200 iThe controller 204 can buffer data for read and write requests in a cache 210, so that read data on the tape medium 208 is buffered in the cache 210 before being transferred to the service provider server 106 to return to the user computer 300i, and write data from a user computer 300i is buffered before being written to the tape storage medium 208. The tape drive 200 i further includes an encryption engine 212, into which a user encryption key DK 302 is loaded from the user computer 300i to encrypt plaintext data read from the tape medium 208 to return to a read request, and to decrypt received encrypted write data to write plaintext data to the tape medium 208.

[0029] Cache 210 can buffer various keys used during the encryption process, including: a product-specific public key (PS-SK) 214, e.g., a private key, and a product-specific public key (PS-PK) 216, which is assigned to tape drive 200 i are assigned and are a key pair in a cryptographic system, such as a public key infrastructure; a public user key 304, which is assigned by the user computer 300 i is received, which is part of a key pair from a cryptographic system, including a secret user key 306, e.g. a private key stored in non-volatile memory 308 of the user computer 300 i is stored; the user encryption key DK 302, which is stored on the user computer 300 iis provided; a key encryption key (KEK) 218, which includes the user encryption key (DK) 302, which is on the user computer 300 i encrypted with the product-specific public key 216; and a signed KEK (S-KEK) 310, which includes the KEK 218, which is encrypted with the private user key 304 on the user computer 300 i signed and in a non-volatile memory 220 of the tape cassette 202 i stored, from where it goes into the cache 210 of the tape drive 200 i is loaded. The user encryption key DK 302 can comprise an asymmetric key or a public user encryption key in a cryptographic system to encrypt data, with the user computer 300 iwould use the pair's private user encryption key to decrypt data encrypted by the public user encryption key. The non-volatile memory 220 of the tape cartridge 202 i It also stores the US-PK 304, which is to be used to verify the signature of the S-KEK 310, which is on the user computer 300. i signed with the US-SK 306.

[0030] The tape drive 200 iThe tape drive controller 204 includes a non-volatile memory 222 to persistently store the PS-SK 214 and the PS-PK 216, which are then loaded into the cache 210 for use during operations. The tape drive controller 204 includes a request manager 224 to manage user read and write requests, and an encryption mode manager 226 to determine whether to set an encryption read mode (ER) 228 to indicate that data read from the tape medium 208 is encrypted before data is returned in response to a read request, and write data is decrypted before being written to the tape medium 208.

[0031] The 300i user computer from Fig. 3 may include a service provider client code 311, such as a toolkit provided by the tape archiving service provider to enable the user computer to access 300 ito enable interaction with the service provider server 106, and includes a read / write interface 312 to transmit read and write requests to a user tape cartridge 202 i to send, which is managed by the tape archiving service provider 100; a tape cassette transfer manager 314, to transfer a tape cassette 202 i to prepare for transfer to the tape archiving service provider 100, such as by writing the S-KEK 310 and the US-PK 304 into the non-volatile memory 220 of the tape cassette 202 i ; and an encryption read mode updater 316 to update the user encryption key DK 302 Uto update the S-KEK used for a tape cartridge located at the tape archiving service provider 100. The tape cartridge transfer manager 314 can generate the S-KEK 310 by first encrypting the user encryption key 302 with the PS-PK 216 to generate the KEK 218, i.e., KEK = {DK}PS-PK, and then signing the KEK 218 with the US-SK 306, i.e., S-KEK = [KEK]US-SK.

[0032] In another embodiment, the user can transfer the US-PK 304 and the S-KEK 310 to the tape cassette 202 on the user computer 300i using native tape drive tools or a backup program. i write so that a tape drive on the user computer 300i to the tape cassette 202 ican write. In another embodiment, the user can communicate requests to read or write data to the service provider server 106 via a website provided by the tape archiving service provider.

[0033] In alternative embodiments, the tape drive(s) can be directly connected to the service provider server or the user computer. In another embodiment, the user computer can be directly connected to the local network 118 and communicate directly with the tape library 102, a tape drive directly connected to the local network 118, and / or the service provider server.

[0034] The controller 204 and the encryption engine 212 can consist of code that is executed by a processor or implemented in hardware / firmware, such as separate field-programmable gate arrays (FPGAs).

[0035] The 202i tape cartridges can include magnetic tape cartridges, such as those conforming to the Linear Tape Open (LTO) format. In alternative embodiments, the portable tape cartridges can include other types of portable storage media, such as disk drives, static storage, flash memory, solid-state storage devices (SSDs), etc.

[0036] Non-volatile memory types 222, 220 and 308 can include various types of storage devices, including magnetic hard disk drives, solid-state storage devices (SSDs) which consist of solid-state electronics,

[0037] The Cache 210 in the Tape Drive 200i can include volatile memory such as EEPROM (Electrically Erasable Programmable Read-Only Memory), Flash memory, Flash disk, Random Access Memory (RAM) drive, Storage-class memory (SCM), Phase change memory (PCM), Resistive random access memory (RRAM), Spin transfer torque memory (STM-RAM), Conductive bridging RAM (CBRAM), Magnetic disk drive, Optical disk, Tape, etc.

[0038] Local area network 118 can include one or more local area networks (LANs), storage area networks (SANs), etc. Network 110 can include a LAN, SAN, wide area network (WAN), the internet, a peer-to-peer network, wireless network, etc.

[0039] The program components 108, 116, 204, 224, 226, 212, 310, 312, 314, 316 in the devices 102, 106, 108, 200 i and 300 i comprise program code that is loaded into memory and executed by a processor. Alternatively, some or all of the component functions can be implemented in hardware devices, such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or executed by separate dedicated processors. In one embodiment, the encryption engine 212 can be implemented as an FPGA card in the tape drive 200 i It must be implemented to manage encryption operations.

[0040] Fig. Figure 4 illustrates an embodiment of operations performed by the encryption mode manager 226 when a tape cassette 202 iinto the tape drive 200 i is inserted to determine the user encryption key DK 302, which is required for encryption operations. Upon detection (at block 400) of a tape cartridge 202 i , which go into the tape drive 200 i When deployed, the encryption mode manager 226 (at block 402) queries the detected tape cassette 202. iThe process then proceeds to determine whether the tape cassette stores an S-KEK 310 and a US-PK 304 in non-volatile memory 220. If so, the S-KEK 310 and the US-PK 304 are loaded into cache 210 to be used (at block 404) to authenticate the signature of the S-KEK 310, confirming that it was signed on the user computer 300i using the US-SK 306. The signature is verified with the US-PK 304, since the KEK 218 would be included in the signed S-KEK 310, to determine whether a hash of the KEK 218 matches the S-KEK 306 decrypted with the US-PK 304. If (at block 404) the signature of the S-KEK 310 cannot be authenticated, an error is returned (at block 406). If (at block 404) the signature of the S-KEK 310 can be authenticated, the KEK 218 is returned (at block 408) as authenticated by the user.The KEK 218 is then decrypted (at block 410) using the PS-SK 214 to obtain the user encryption key DK 302. All used keys 214, 310, 218, and 304 are retained in cache 210 during operations. DK 302 is loaded (at block 412) into encryption engine 212 to encrypt plaintext data read from tape medium 208 and to decrypt encrypted plaintext data in order to write plaintext data to tape medium 208. After receiving the user encryption key DK 302 for the encryption engine 212, all keys 214, 216, 310, 218, 304, 302 (at block 414) are deleted from the cache 210 and the ER mode 228 is set to encryption-read.

[0041] If the tape cassette 202i contains the S-KEK 310 and the US-PK 304, the controller 204 can perform the operations of Fig. 4 automatically extract the user encryption key DK 302 for use in an encryption read mode while the tape cartridge is inserted into the 200i tape drive.

[0042] Fig. Figure 5 illustrates an embodiment of operations performed by the Read / Write Interface Module to Service Provider 312 at the user computer 300i, the Server Request Manager 108, and the Request Manager 224 at the tape drive 200i to process read requests from the user computer 300i for data stored in a specified tape cartridge 202 i The data stored on the user computer 300i is to be processed. The read / write interface 312 sends (at block 500) a read request to the service provider server 106 to retrieve data from a specified tape cartridge 202. ito be read in the tape archiving facility. After receiving (at block 502) the read request, the service provider server 106 (at block 504) sends a command to the tape library 102, which contains the specified tape cassette 202. i This includes processing the read request, which includes the specified tape cassette 202. i to be inserted into a 200i tape drive if required and operations of Fig. 4. If the tape cartridge 202i is not already inserted, the tape drive request manager 224 reads the requested plaintext data from the tape storage medium 208 and sends the read data to the encryption engine 212 to use (at block 508) the user encryption key DK 302 to encrypt the read requested plaintext data on the tape medium 208 in order to send it to the user computer 300. i, who initiated the request. After receiving the encrypted plaintext data, the read / write interface 312 can use the user encryption key DK 302 to decrypt the encrypted data in order to provide the plaintext data to the user.

[0043] Fig. Figure 6 illustrates one embodiment of operations that are performed by the read / write interface module to the service provider 312 at the user computer 300 i , the server request manager 108 and the request manager 224 at the tape drive 200 i to be carried out to process write requests from the user computer 300 i to process data encrypted with the user encryption key DK 302, in order to write it to the tape medium 208 in a specified tape cassette 202 ito write. The read / write interface sends (at block 600) a write request to the tape archiving service provider 100 with plaintext data encrypted with the user encryption key (DK) 302 to write to a specified tape cartridge. Upon receiving (at block 602) the write request with encrypted data, the server request manager 108 sends (at block 604) a command to the tape library 102, which writes to the specified tape cartridge 202. i This includes processing the write request, which involves inserting the specified 202i tape cassette into a 200 tape drive if necessary. i to use and operations of Fig. 4 to be carried out if the tape cassette 202 inot already in use. The tape drive encryption engine 212 uses (at block 606) the user encryption key DK 302 to decrypt the encrypted write data in order to write (at block 608) the decrypted plaintext write data to the tape medium 208.

[0044] With the embodiments of the Fig. 5 and Fig. 6. Data is stored in plaintext in tape cassette 202 at the tape archiving unit. However, if an attempt is made to read the data, then tape drive 200 i configured to return only requested data encrypted with the user encryption key 302 of the user whose data is stored in tape cartridge 202 i is provided for archiving. This ensures secure data transfer from tape medium 208. Furthermore, to ensure that plaintext data is written to tape medium 208, tape drive 200 decryptsi encrypted write data to transfer the data as plaintext to the tape cassette 202 i to write. By saving the data as plaintext, the user can change the user encryption key 302 without having to decrypt and re-encrypt all the data on the tape medium 208.

[0045] Fig. 7 and Fig. 8 are an embodiment in which the encryption mode for requests to read data as part of migrating data from one or more source tape cartridges 202 S to a target tape cassette 202 D is used. Fig. Figure 7 shows an arrangement in a tape library 102 with a source tape drive 200 S and a target tape drive 200 D , which may be located in the same or different volume libraries 102. Other keys and components of Fig. 2 are also in the tape drives 200 S , 200 Dshown.

[0046] Fig. Figure 8 illustrates an embodiment of operations for copying all data in the tape medium into one or more source tape cassettes. S to a target tape cassette 202 D . When initiating (at block 800) an operation to migrate / copy data from a source tape cassette 202 S to a target tape cassette 202 D The source tape drive carries 200 S (at block 802) the operations in Fig. Step 4 to set up the user encryption key DK 302 in the encryption engine 212. A target cartridge 202 D (at block 804) it goes into the target tape drive 200 D used. The source tape drive 200 S copies (at block 806) the S-KEK 310 and the US-PK 304 into the non-volatile memory 220 of the source tape cassette 202 S to the target belt drive 200 D , to place them in the target tape cassette 202 Dto save, as in Fig. 7 shown.

[0047] The target belt drive 200 D uses (at block 808) the US-PK 304 to authenticate the signed S-KEK 310, and uses the PS-SK 214 to decrypt the KEK 218 to generate the user encryption key DK 302, and inserts the DK 302 into the encryption engine 212 in the target tape drive 200 D to load, as in relation to Fig. 4 described. The encryption engine 212 of the source tape drive 200 S The DK 302 encrypts (at block 810) plaintext data from the source tape cassette and sends it to the destination tape drive 200. D The encryption engine 212 of the target tape drive 200 D decrypts the encrypted plaintext data from the source tape drive 200 S with the DK 302 and writes them onto the target tape cassette 202 D .

[0048] The embodiment of the Fig. 7 and Fig. 8 uses the encryption read mode to transfer encrypted plaintext data from one or more source tape drives to a destination tape drive, where the destination tape drive must decrypt the data to store it on the tape medium 208. This can be done if the tape cartridge 202 S to a target tape cassette 202 D It is updated with higher capacity. Furthermore, keys 304 and 310 are transferred from the source tape cartridge 202S to the target tape cartridge 202. D copied, so that the target tape cassette 202 D the same encryption read mode settings as the source tape cassette 202 S This allows the target tape cassette 202 to D is processed in the same way as the source cassette 202 Swas processed. Furthermore, this migration procedure enables secure playback of the contents of tape medium 208 by encrypting the data before migrating it to a new target drive.

[0049] Fig. Figure 9 illustrates an embodiment of operations of the encryption read mode updater 316 of the user computer 300. i and the encryption mode manager 226 in the tape drive 200 i , to create a new user encryption key DK 302 N for the tape drive 200 i to provide the S-KEK 310 in the tape cassette 202 i with the new S-KEK 310 N to use and update. To create a new user encryption key 302 N To program, the encryption read mode updater 316 sends 300 to the user computer. i(at block 900) a write operation of plaintext data to the service provider 300 to access a specified tape cassette 202 i to write. After receiving (at block 902) the write request for plaintext data, the service provider server 106 (at block 904) sends a command to the tape library 102, which writes the specified tape cartridge 202. i specifies how to process the writing of plaintext data, which includes inserting the specified tape cartridge into a tape drive when required and performing operations of Fig. 4. In response to receiving this plaintext write request to update the encryption read mode, the tape drive sends 200 i (at block 906) the PS-PK 216 to user computer 300 i , to use to create a new user encryption key 302 N to provide.

[0050] After the PS-PK 216 was received by the user computer 300 i The encryption read mode updater 316 (at block 908) encrypts the new DK 302 N , which may include a newly generated DK to replace the existing one in tape cassette 202 i to replace, and encrypts the new DK 302 N , to create a new KEK 218 N to generate. The new KEK 218 N or a hash of the new KEK 218 N (at block 910) is signed with US-SK 306 to become the new signed S-KEK 310 N to generate. The new S-KEK 310 N and the new US PK 304 will be (at block 912) sent to service provider server 106 for the specified tape cassette 202 i transferred to the S-KEK 310 in the non-volatile memory 220 of the tape cassette 202 i to update with the tape archiving service provider.

[0051] Alternatively, the user can initiate a re-keying via a web interface on the service provider server 106 by entering the new S-KEK 310 N and the US-PK 304 is transferred and it is stated that the tape cassette with the new S-KEK 310 N to be updated.

[0052] The service provider server 106 forwards (at block 914) the received new S-KEK 218 via the local network 118. N and the received new US-PK 304 to tape library 102 with tape drive 200 i , the specified tape cassette 202 i exhibits, in order to reprogram, further. The tape drive encryption mode manager 226 determines (at block 916) whether the US-PK 304 is the signed S-KEK 310 NAuthenticated. If not, an error is returned (at block 918). If authenticated, the encryption mode manager 226 determines (at block 920) whether the US-PK 304 is currently in the non-volatile memory (NVM) 220 of the tape cartridge 202. i is stored. If so, and if (at block 922) the US-PK 304 is in tape cassette 202 i If the received US-PK matches, the encryption mode manager 226 (at block 924) uses the received US-PK 304 to determine the new S-KEK 310. N to authenticate in order to generate the new KEK 218N. If no match is found (at block 922), an error is returned (at block 918). The new KEK 218N is decrypted (at block 926) with the PS-SK 214 to generate the new user encryption key DK 302. N to generate. If (at block 928) the decryption was successful, e.g., the decryption did not result in a NULL key, the received S-KEK 310N and the received US-PK 304 in the non-volatile memory 220 of the tape cassette 202 i stored for subsequent use when the tape cassette 202 i It is ejected and inserted into a tape drive. The user encryption key DK 302 N can be loaded into the encryption engine 212 for use in encryption operations, while the tape cartridge 202i is inserted into the tape drive 200 i is used. If (at block 928) the decryption was unsuccessful, i.e., resulted in the NULL key, the S-KEK 310 and the US-PK 304 are stored in the non-volatile memory 220 of tape cassette 202. i deleted (at block 932).

[0053] With the embodiment of Fig. 9. The user can create a new user encryption key in a signed S-KEK 310. NSpecify the user encryption key to be transmitted to service provider server 106, which is located on tape drive 200. i is used to update and the S-KEK 310 in the tape cassette 202 i to update to include the new S-KEK 310 N to be stored for use in the same or different tape drives. This allows the user to store the user encryption keys and the S-KEK 310. N , which is in the tape cassette 202 i to be performed to update for future read and write operations in the memory cartridge.

[0054] The present invention may be a system, a method, and / or a computer program product. The computer program product may include a computer-readable storage medium (or media) containing computer-readable program instructions to instruct a processor to execute aspects of the present invention.

[0055] Various aspects of the present disclosure are described by narrative text, flowcharts, computer system block diagrams, and / or machine logic block diagrams included in embodiments of the computer program product (CPP). With respect to any flowchart, the operations may be performed in a different order than shown in a particular flowchart, depending on the technology involved. For example, again depending on the technology involved, two operations shown in successive flowchart blocks may be performed in reverse order, as a single integrated step, simultaneously, or in a manner that overlaps at least partially in time.

[0056] A computer program product execution form (“CPP execution form” or “CPP”) is a term used in this disclosure to describe any set of one or more storage media (also called “media”) that are collectively contained in a set of one or more storage devices, collectively containing machine-readable code corresponding to instructions and / or data for performing computer operations specified in a particular CPP claim. A “storage device” is any physical device capable of retaining and storing instructions for use by a computer processor.Without limitation, the computer-readable storage medium can be an electronic storage medium, a magnetic storage medium, an optical storage medium, an electromagnetic storage medium, a semiconductor storage medium, a mechanical storage medium, or any suitable combination of the foregoing.Some well-known types of storage devices that incorporate these media include: floppy disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), compact disc read-only memory (CD-ROM), digital versatile disk (DVD), USB flash drive, floppy disk, mechanically coded device (such as punched cards or pits / lands formed in a primary surface of a disk), or any suitable combination of the foregoing.A computer-readable storage medium, as this term is used in the present disclosure, is not to be understood as a storage medium in the form of transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide, light pulses traveling through a fiber optic cable, electrical signals communicated through a wire, and / or other transmission media. As the person skilled in the art will understand, data is typically moved at some occasional times during the normal operation of a storage device, such as during access, defragmentation, or waste collection, but this does not make the storage device transitory, since the data is not transitory while it is being stored.

[0057] The computing environment 1000 contains an example of an environment for the execution of at least a part of the computer code 1001, which is involved in carrying out the methods according to the invention, such as the server request manager 108 in Fig. 2. The service provider server 106 can be implemented in the computer 1001 and communicate via the WAN 1002.

[0058] In addition to Block 1001, the computing environment 1000 includes, for example, the computer 1001, the wide area network (WAN) 1002, the end-user device (EUD) 1003, the remote server 1004, the public cloud 1005, and the private cloud 1006. In this embodiment, the computer 1001 includes the processor set 1010 (including the processing circuit 1020 and the cache 1021), the communication structure 1011, the volatile memory 1012, the persistent memory 1013 (including the operating system 1022 and Block 1001, as identified above), the peripheral device set 1014 (including the user interface (UL) device set 1023, the memory 1024, and the Internet of Things (IoT) sensor set 1025), and the Network module 1015. The remote server 1004 contains the remote database 1030.The public cloud 1005 contains the gateway 1040, the cloud orchestration module 1041, the physical host machine set 1042, the virtual machine set 1043 and the container set 1044.

[0059] Computer 1001 can take the form of a desktop computer, a laptop computer, a tablet computer, a smartphone, a smartwatch or other portable computer, a mainframe computer, a quantum computer, or any other form of computer or mobile device now known or to be developed in the future, capable of executing a program, accessing a network, or querying a database, such as the remote database 1030. As is well understood in the field of computer technology, the power of a computer-implemented procedure can be distributed across multiple computers and / or locations, depending on the technology. On the other hand, the detailed discussion in this description of Computing Environment 1000 focuses on a single computer, specifically Computer 1001, to keep the presentation as simple as possible.Computer 1001 can be located in a cloud, even if it is in . Fig. 10 is not shown in a cloud. On the other hand, it is not necessary for computer 1001 to be located in a cloud, except to any extent that can be affirmed.

[0060] The 1010 processor set comprises one or more computer processors of any type now known or to be developed in the future. The 1020 processing circuitry may be distributed across multiple packages, for example, multiple coordinate integrated circuit chips. The 1020 processing circuitry may implement multiple processor threads and / or multiple processor cores. The 1021 cache is a memory located within the processor chip package(s) and is typically used for data or code that should be readily available for fast access by the threads or cores running on the 1010 processor set. Cache memories are typically organized into multiple levels, depending on their relative proximity to the processing circuitry. In some computing environments, the 1010 processor set may be designed to work with qubits and perform quantum computing.

[0061] Computer-readable program instructions are typically loaded onto the computer 1001 to cause a series of operational steps to be performed by the processor set 1010 of the computer 1001, thereby effecting a computer-implemented method such that the instructions thus executed instantiate the methods specified in flowcharts and / or narrative descriptions of computer-implemented methods included in this document (collectively referred to as "the methods according to the invention"). These computer-readable program instructions are stored in various types of computer-readable storage media, such as the cache 1021 and the other storage media discussed below. The processor set 1010 accesses the program instructions and the associated data to control and direct the performance of the methods according to the invention.In the computing environment 1000, at least some of the instructions for carrying out the methods according to the invention can be stored in the persistent memory 1013.

[0062] The COMMUNICATION FABRIC 1011 is the signal path that allows the various components of the computer 1001 to communicate with each other. Typically, this structure consists of switches and electrically conductive paths, such as those forming buses, bridges, physical input / output connectors, and the like. Other types of signal communication paths may be used, such as fiber optic communication paths and / or wireless communication paths.

[0063] The volatile memory 1012 is any type of volatile memory now known or that may be developed in the future. Examples include dynamic random-access memory (RAM) or static RAM. Typically, the volatile memory 1012 is characterized by random access, but this is not required unless explicitly stated. In the computer 1001, the volatile memory 1012 is contained in a single enclosure and is located internally within the computer 1001, but alternatively or additionally, the volatile memory may be distributed across multiple enclosures and / or be located externally with respect to the computer 1001.

[0064] Persistent memory 1013 is any form of non-volatile memory for computers that is now known or will be developed in the future. The non-volatile nature of this memory means that the stored data is maintained regardless of whether power is supplied to the computer 1001 and / or directly to the persistent memory 1013. The persistent memory 1013 can be read-only memory (ROM), but typically at least a portion of the persistent memory allows data to be written, erased, and rewritten. Some known forms of persistent memory include magnetic disks and solid-state storage devices. The operating system 1022 can take several forms, such as various well-known proprietary operating systems or operating systems of the open-source Portable Operating System Interface type that use a kernel.The code contained in block 1001 typically includes at least a part of the computer code involved in carrying out the methods according to the invention, such as the server request manager 108. Fig. 1.

[0065] The PERIPHERAL DEVICE SET 1014 includes the set of peripheral devices for the computer 1001. Data communication links between the peripheral devices and the other components of the computer 1001 can be implemented in various ways, such as Bluetooth connections, near-field communication (NFC) connections, connections made via cables (such as Universal Serial Bus (USB) type cables), plug-in type connections (for example, secure digital (SD) card), connections made via local area communication networks, and even connections made via wide area networks such as the Internet.In various embodiments, the UI device set 1023 can include components such as a display screen, a speaker, a microphone, wearable devices (such as glasses and smartwatches), a keyboard, a mouse, a printer, a touchpad, game controllers, and haptic devices. The memory 1024 is external storage, such as an external hard drive, or insertable storage, such as an SD card. The memory 1024 can be persistent and / or volatile. In some embodiments, the memory 1024 can take the form of a quantum computing storage device for storing data in the form of qubits.In embodiments where computer 1001 requires a large amount of memory (for example, when computer 1001 stores and manages a large database locally), this memory can be provided by peripheral storage devices designed to store very large amounts of data, such as a storage area network (SAN) shared by multiple geographically distributed computers. The IoT sensor set 1025 consists of sensors that can be used in Internet of Things (IoT) applications. For example, one sensor could be a thermometer, and another could be a motion detector.

[0066] The NETWORK MODULE 1015 is the collection of computer software, hardware, and firmware that enables the computer 1001 to communicate with other computers over the WAN 1002. The Network Module 1015 may include hardware such as modems or Wi-Fi signal transceivers, software for packetizing and / or depackaging data for communication network transmission, and / or web browser software for communicating data over the Internet. In some embodiments, the network control and network forwarding functions of the Network Module 1015 are performed on the same physical hardware device.In other embodiments (for example, embodiments using software-defined networking (SDN)), the control functions and the forwarding functions of the network module 1015 are executed on physically separate devices, so that the control functions manage several different network hardware devices. Computer-readable program instructions for carrying out the methods according to the invention can typically be downloaded from an external computer or an external storage device to the computer 1001 via a network adapter card or network interface included in the network module 1015.

[0067] The WAN 1002 is any wide area network (for example, the Internet) capable of communicating computer data over non-local distances using any computer data communication technology now known or to be developed in the future. In some embodiments, the WAN 1002 can be replaced and / or supplemented by local area networks (LANs) designed to communicate data between devices located within a local area, such as a Wi-Fi network. The WAN and / or LANs typically include computer hardware such as copper transmission cables, optical transmission fibers, wireless transmission equipment, routers, firewalls, switches, gateway computers, and edge servers.

[0068] The USER COMPUTER 300 iis any computer system used and controlled by an end user (for example, a customer of a company that operates computer 1001) and can take any of the forms discussed above in connection with computer 1001, but with the service provider client code 311. The user computer 300 i It typically sends read and write requests to the service provider server 106 and other related commands to computer 1001, thereby implementing the service provider server 106. For example, in a hypothetical case where computer 1001 is configured to read data from a tape cartridge to user computer 300, i to return this read data, typically from the network module 1015 of computer 1001 via the WAN 1002 to the user computer 300 i communication can take place. In this way, the user's computer can be 300 irequested data from an archived tape cassette 202 i received. In some embodiments, the user computer can receive 300 i a client device, such as a thin client, a heavy client, a mainframe, a desktop computer, and so on.

[0069] Remote Server 1004 is any computer system that provides at least some data and / or functionality to Computer 1001. Remote Server 1004 can be controlled and used by the same entity that operates Computer 1001. Remote Server 1004 represents the machine(s) that collect and store helpful and useful data for use by other computers, such as Computer 1001. For example, in a hypothetical case where Computer 1001 is designed and programmed to provide a recommendation based on historical data, this historical data can be provided to Computer 1001 from Remote Server 1004's remote database 1030.

[0070] The PUBLIC CLOUD 1005 is any computer system available for use by multiple entities, providing on-demand availability of computer system resources and / or other computing capabilities, particularly data storage (cloud storage) and computing power, without direct active management by the user. Cloud computing typically utilizes the sharing of resources to achieve coherence and economies of scale. The direct and active management of the computing resources of the Public Cloud 1005 is performed by the computer hardware and / or software of the Cloud Orchestration Module 1041.The computing resources provided by the public cloud 1005 are typically implemented through virtual computing environments running on various computers that comprise the physical host machine set 1042, which is the universe of physical computers in and / or available to the public cloud 1005. The virtual computing environments (VCEs) typically take the form of virtual machines from the virtual machine set 1043 and / or containers from the container set 1044. It is understood that these VCEs can be stored as images and transferred between the various physical machine hosts, either as images or after VCE instantiation. The cloud orchestration module 1041 manages the transfer and storage of images, deploys new VCE instantiations, and manages active VCE deployment instantiations.The Gateway 1040 is the collection of computer software, hardware and firmware that enables the public cloud 1005 to communicate over the WAN 1002.

[0071] Another explanation of virtualized computing environments (VCEs) is now provided. VCEs can be saved as "images." A new active instance of the VCE can be instantiated from the image. Two well-known types of VCEs are virtual machines and containers. A container is a VCE that uses operating system-level virtualization. This refers to an operating system feature where the kernel allows the existence of multiple isolated user-space instances, called containers. These isolated user-space instances typically behave like real computers from the perspective of programs running within them. A computer program running on a conventional operating system can use all of that computer's resources, such as connected devices, files and folders, shared network resources, CPU power, and quantifiable hardware capabilities.However, programs running in a container can only use the contents of the container and devices assigned to the container, a feature known as containerization.

[0072] The PRIVATE CLOUD 1006 is similar to the public cloud 1005, except that the computing resources are available for use by a single organization. While the private cloud 1006 is depicted as communicating with the WAN 1002, in other implementations a private cloud may be completely isolated from the internet and accessible only via a local / private network. A hybrid cloud is a composition of multiple clouds of different types (for example, private, shared, or public), often implemented by different vendors. Each of the multiple clouds remains a separate and discrete entity, but the larger hybrid cloud architecture is bound together by standardized or proprietary technology that enables orchestration, management, and / or data / application portability between the multiple constituent clouds.In this embodiment, the public cloud 1005 and the private cloud 1006 are both part of a larger hybrid cloud.

Claims

[1] Computer program product stored on a tape drive (2001, 2002, 200 i , 200 n ) is implemented in which a tape cassette (202 i ) including a non-volatile memory (220) and a tape medium (208), wherein the computer program product comprises a computer-readable storage medium containing computer-readable program code that is executable to perform operations, the operations comprising: Determine (402) whether the non-volatile memory of the tape cartridge stores a key encryption key (218) that includes a user-associated user encryption key (302) encrypted with a public key of a private key-public key pair; and In response to the determination that the non-volatile memory of the tape cartridge stores the key encryption key, perform: Decrypting (410) the key encryption key with the private key to generate the user encryption key; and Providing the user encryption key resulting from decryption to an encryption engine (212) of the tape drive to encrypt plaintext data read from the tape medium in the tape cartridge with the user encryption key (412; 508) in order to return the encrypted plaintext data to a read request (510). [2] Computer program product according to claim 1, wherein the key encryption key in the non-volatile memory (220) of the tape cartridge is signed with a private user key (306) assigned to the user, wherein the non-volatile memory of the tape cartridge includes a public user key (304), wherein the operations in response to the non-volatile memory of the tape cartridge storing the key encryption key and the public user key comprise: Using the public user key to authenticate the signed key encryption key (310) (404) to generate the key encryption key (408), with decryption of the key encryption key being performed in response to the authentication of the signed key encryption key. [3] Computer program product according to claim 1, wherein the public key that encrypts the user encryption key to generate key encryption keys comprises a product-specific public key (216) that is associated with the tape drive, wherein the private key that decrypts the key encryption key comprises a product-specific private key (214) that is maintained in the tape drive to generate the user encryption key that is used to encrypt the plaintext data read from the tape medium. [4] Computer program product according to claim 1, wherein the operations further comprise: Receiving (502) a read request for the plaintext data in the tape medium; and In response to the read request, the encryption engine uses the user encryption key to encrypt the requested plaintext data from the tape medium (508) in order to return the encrypted requested plaintext data to the read request (510). [5] Computer program product according to claim 1, wherein the operations further comprise: Receiving (602) a write request containing encrypted write plaintext data encrypted with the user encryption key to write to the tape medium; In response to the write request, the encryption engine uses (606) the user encryption key to decrypt the encrypted write plaintext data in order to produce the write plaintext data; and Writing (608) the write plaintext data to the tape medium. [6] Computer program product according to claim 1, wherein the operations further comprise: In response to the fact that decrypting (410) the key encryption key produces a valid encryption key, specifying (414) an encryption read mode for the tape cartridge, wherein the encryption engine uses the user encryption key to encrypt plaintext data read from the tape medium in the tape cartridge to return to a read request when the encryption read mode is set. [7] Computer program product according to claim 1, wherein the read request originates from the user, wherein a user computer (300) assigned to the user uses the user encryption key to decrypt the encrypted plaintext data returned to the read request. [8] Computer program product according to claim 1, wherein the tape drive is a source tape drive (200 S ) includes the tape cassette, a source tape cassette (202 S ) comprises and the tape medium comprises a source tape medium and wherein the read request comprises an operation to transfer encrypted plaintext data from the source tape medium to a target tape medium in a target tape cassette (202 D ) to transfer, which with a target tape drive (200 S ) is coupled, the operations further including: Transfer (806) the key encryption key from the source tape drive to the destination tape drive for storage in the destination tape drive, wherein the destination tape drive decrypts the transferred key encryption key (808) to generate the user encryption key to be used to decrypt the plaintext data transferred from the source tape drive to generate the plaintext data for writing to the destination tape medium. [9] Computer program product stored on a tape drive (2001, 2002, 200 i , 200 n ) is implemented in which a tape cassette (202 i ) including a tape medium (208), wherein the computer program product comprises a computer-readable storage medium containing computer-readable program code that is executable to perform operations, the operations comprising: Receiving (902) plaintext data from a user computer (300) assigned to a user for writing to the tape medium; Sending (906) a product-specific public key (216) associated with the tape drive to the user computer; Received (914) from the user computer, a key encryption key (218) comprising a user-associated user encryption key (302) encrypted with the product-specific public key, wherein the product-specific public key and a product-specific private key (214) maintained in the tape drive constitute a key pair in a cryptographic system; Decrypting (926) the key encryption key with the product-specific private key to generate the user encryption key; and Using the user encryption key to encrypt the plaintext data read from the tape medium (508) in order to return the encrypted plaintext data to a read request (510). [10] Computer program product according to claim 9, wherein the operations further comprise: Storing (930) the key encryption key in a non-volatile memory (220) of the tape cassette; Detect that the tape cassette is being reinserted into the tape drive after it has been ejected from the tape drive; Accessing the key encryption key from the non-volatile memory of the reinserted tape cartridge; and Decrypting the accessed key encryption key with the product-specific private key to generate the user encryption key to be used to encrypt plaintext data read from the tape medium. [11] Computer program product according to claim 9, wherein the received key encryption key comprises a first key encryption key and wherein the user encryption key comprises a first user encryption key, wherein the operations further comprise: Determine (928) whether decryption was successful in generating the first user encryption key; and Storing (930) the first key encryption key in a non-volatile memory (220) of the tape cartridge in response to determining that decryption was successful in generating the user encryption key, wherein storing the first key encryption key overwrites a second key encryption key stored in the non-volatile memory of the tape cartridge, which includes a second user encryption key assigned to the user and encrypted with the product-specific public key, wherein the second key encryption key was stored in the non-volatile memory of the tape cartridge before the first key encryption key was received from the user computer. [12] Computer program product according to claim 11, wherein the operations further comprise: in response to the determination that decryption was unsuccessful in generating the first user encryption key (928), deletion (932) of the second key encryption key stored in the non-volatile memory of the tape cassette. [13] Computer program product according to claim 9, wherein the operations further comprise: Receiving a product-specific public key from the user computer as part of receiving the key encryption key from the user computer; and Determine whether the product-specific public key received from the user computer matches the product-specific public key stored in a non-volatile memory (220) of the tape cartridge, wherein decrypting the key encryption key and using the user encryption key decrypted from the key encryption key are performed in response to determining that the product-specific public key received from the user computer matches the product-specific public key stored in the non-volatile memory of the tape cartridge. [14] System that includes a tape drive (2001, 2002, 200 i , 200 n ) includes a tape cassette (202 i ) is coupled, comprehensively: a non-volatile memory (220); a tape medium (208); a computer-readable storage medium containing computer-readable program code that is executed to perform operations, the operations comprising: Determine (402) whether the non-volatile memory of the tape cartridge stores a key encryption key (218) that includes a user-associated user encryption key (302) encrypted with a public key of a private key-public key pair; and In response to the determination that the non-volatile memory of the tape cartridge stores the key encryption key, perform: Decrypting (410) the key encryption key with the private key to generate the user encryption key; and Providing the user encryption key resulting from decryption to an encryption engine (212) of the tape drive to encrypt plaintext data read from the tape medium in the tape cartridge with the user encryption key (412; 508) in order to return the encrypted plaintext data to a read request (510). [15] System according to claim 14, wherein the key encryption key in the non-volatile memory of the tape cartridge is signed with a private user key (306) assigned to the user, wherein the non-volatile memory of the tape cartridge includes a public user key (304), wherein the operations in response to the non-volatile memory of the tape cartridge storing the key encryption key and the public user key include: Using the public user key to authenticate the signed key encryption key (310) (404) to generate the key encryption key (408), with decryption of the key encryption key being performed in response to the authentication of the signed key encryption key. [16] System according to claim 14, wherein the operations further comprise: Receiving (502) a read request for the plaintext data in the tape medium; and In response to the read request, the encryption engine uses the user encryption key to encrypt the requested plaintext data from the tape medium (508) in order to return the encrypted requested plaintext data to the read request (510). [17] System according to claim 14, wherein the tape drive is a source tape drive (200 S) includes the tape cassette, a source tape cassette (202 S ) comprises and the tape medium comprises a source tape medium and wherein the read request comprises an operation to transfer encrypted plaintext data from the source tape medium to a target tape medium in a target tape cassette (202 D ) to transfer, which with a target tape drive (200 S ) is coupled, the operations further including: Transfer (806) the key encryption key from the source tape drive to the destination tape drive for storage in the destination tape drive, wherein the destination tape drive decrypts the transferred key encryption key (808) to generate the user encryption key to be used to decrypt the plaintext data transferred from the source tape drive to generate the plaintext data for writing to the destination tape medium. [18] System that includes a tape drive (2001, 2002, 200 i , 200n ) includes a tape cassette (202 i ) is coupled, comprehensively: a tape medium (208); a computer-readable storage medium containing computer-readable program code that is executed to perform operations, the operations comprising: Receiving (902) plaintext data from a user computer (300) assigned to a user for writing to the tape medium; and Sending (902) a product-specific public key (216) associated with the tape drive to the user computer; Received (914) from the user computer, a key encryption key (218) comprising a user-associated user encryption key (302) encrypted with the product-specific public key, wherein the product-specific public key and a product-specific private key (214) maintained in the tape drive constitute a key pair in a cryptographic system; Decrypting (926) the key encryption key with the product-specific private key to generate the user encryption key; and Using the user encryption key to encrypt the plaintext data read from the tape medium (508) in order to return the encrypted plaintext data to a read request (510). [19] System according to claim 18, wherein the operations further comprise: Storing (930) the key encryption key in a non-volatile memory (220) of the tape cassette; Detect that the tape cassette is being reinserted into the tape drive after it has been ejected from the tape drive; Accessing the key encryption key from the non-volatile memory of the reinserted tape cartridge; and Decrypting the accessed key encryption key with the product-specific private key to generate the user encryption key to be used to encrypt plaintext data read from the tape medium. [20] System according to claim 18, wherein the received key encryption key comprises a first key encryption key and wherein the user encryption key comprises a first user encryption key, wherein the operations further comprise: Determine (928) whether decryption was successful in generating the first user encryption key; and Storing (930) the first key encryption key in a non-volatile memory (220) of the tape cartridge in response to determining that decryption was successful in generating the user encryption key, wherein storing the first key encryption key overwrites a second key encryption key stored in the non-volatile memory of the tape cartridge, which includes a second user encryption key assigned to the user and encrypted with the product-specific public key, wherein the second key encryption key was stored in the non-volatile memory of the tape cartridge before the first key encryption key was received from the user computer. [21] System according to claim 18, wherein the operations further comprise: in response to the determination that decryption was unsuccessful in generating the first user encryption key (928), deletion (932) of the second key encryption key stored in the non-volatile memory (220) of the tape cassette. [22] Method that in a tape drive (2001, 2002, 200 i , 200 n ) is implemented in which a tape cassette (202 i ) is coupled, comprehensively: Determine whether a non-volatile memory (220) of the tape cartridge stores a key encryption key (218) that includes a user-associated user encryption key (302) encrypted with a public key (216) of a private key (214) and public key (216) pair; and In response to the determination (402) that the non-volatile memory of the tape cassette stores the key encryption key, perform: Decrypting (410) the key encryption key with the private key (214) to generate the user encryption key (302); and Providing the user encryption key resulting from decryption to an encryption engine (212) of the tape drive to encrypt plaintext data read from a tape medium in the tape cartridge with the user encryption key (412; 508) in order to return the encrypted plaintext data to a read request (510). [23] Method according to claim 22, wherein the key encryption key in the non-volatile memory of the tape cassette is signed with a private user key (306) assigned to the user, wherein the non-volatile memory of the tape cassette includes a public user key (304), comprising: In response to the fact that the non-volatile memory of the tape cartridge stores the key encryption key and the public user key, using the public user key to authenticate the signed key encryption key (310) (404) to generate the key encryption key (408), with the decryption of the key encryption key being performed in response to the authentication of the signed key encryption key. [24] The method of claim 22, further comprising: Receiving (502) a read request for the plaintext data in the tape medium; and In response to the read request, the encryption engine uses the user encryption key to encrypt the requested plaintext data from the tape medium (508) in order to return the encrypted requested plaintext data to the read request (510). [25] Method according to claim 22, wherein the tape drive comprises a source tape drive, the tape cassette a source tape cassette (202 S ) includes, the tape medium includes a source tape medium and the read request includes an operation to transfer encrypted plaintext data from the source tape medium to a target tape medium in a target tape cassette (202 D ) to transfer, which is coupled to a target tape drive, further comprising: Transfer (806) the key encryption key from the source tape drive to the destination tape drive for storage in the destination tape drive, wherein the destination tape drive decrypts the transferred key encryption key (808) to generate the user encryption key to be used to decrypt the plaintext data transferred from the source tape drive to generate the plaintext data for writing to the destination tape medium. [26] Method that in a tape drive (2001, 2002, 200 i , 200 n ) is implemented in which a tape cassette (202 i ) including a tape medium (208), the method comprising: Receiving (902) plaintext data from a user computer (300) assigned to a user for writing to the tape medium; Sending (906) a product-specific public key (216) associated with the tape drive to the user computer; Received (914) from the user computer, a key encryption key (218) comprising a user-associated user encryption key (302) encrypted with the product-specific public key, wherein the product-specific public key and a product-specific private key (214) maintained in the tape drive constitute a key pair in a cryptographic system; Decrypting (926) the key encryption key with the product-specific private key to generate the user encryption key; and Using the user encryption key to encrypt the plaintext data read from the tape medium (412) in order to return the encrypted plaintext data to a read request.

Images