Managing access to tape cartridges at a tape archive service provider

Abstract

A computer program product, system, and method for managing access to tape cartridges at a tape archive service provider are provided. A determination is made as to whether a non-volatile memory of the tape cartridge stores a key encryption key, including an encrypted user encryption key associated with a user. In response to a determination that the non-volatile memory of the tape cartridge stores the key encryption key, the key encryption key is decrypted to generate a user encryption key. The user encryption key resulting from the decryption is provided to an encryption engine of a tape drive, and plaintext data read from a tape media within the tape cartridge is encrypted with the user encryption key for return in response to a read request.

Description

[Technical Field]

[0001] The present invention relates to a computer program product, system, and method for managing access to tape cartridges at a tape archive service provider. [Background technology]

[0002] Certain companies offer tape archive services that allow users to offload archival storage of backup tape cartridges to tape archive service providers. Tape archive services provide a secure, mechanically controlled environment for storing archived tape cartridges to minimize physical deterioration over time. Typically, the tape archive service delivers tape cartridges from a storage facility to a user when the user needs to retrieve data from the tape cartridge.

[0003] One drawback of tape archive services is that it is difficult for users to access tape cartridges sent to the archive when needed, because the users typically must wait for the tape cartridge to be physically returned to the users. Also, if the data is stored in plain text on the tape cartridge, there is a concern that someone at the service provider's facility could access the tape cartridge and misuse the sensitive data. If the service provider is not provided with access to the encryption key to access encrypted data stored on the tape drive, the service provider may not be able to transfer user data from older tape cartridges to newer generation tape cartridges, which can typically store significantly more data than previous generation cartridges.

[0004] There is a need in the art for improved techniques for providing tape archival services to users who have a collection of tape cartridges. Summary of the Invention

[0005] A first embodiment provides a computer program product, system, and method for managing access to tape cartridges at a tape archive service provider. A determination is made as to whether a non-volatile memory of a tape cartridge stores a key encryption key, including an encrypted user encryption key associated with a user. In response to determining that the non-volatile memory of the tape cartridge stores a key encryption key, the key encryption key is decrypted to generate a user encryption key. The user encryption key resulting from the decryption is provided to an encryption engine of a tape drive, such that plaintext data read from tape media in the tape cartridge is encrypted with the user encryption key for return in response to a read request.

[0006] A first embodiment provides a security and encryption protocol for preventing unauthorized users from reading plaintext data on a tape cartridge by allowing tape drives in a tape archive service to access a user encryption key within a key encryption key held within the tape cartridge. This enables the tape drive to securely access the user encryption key through a series of encryptions and then use it to encrypt data read from the tape cartridge for providing to a read request and to decrypt encrypted write data provided to the tape drive for writing to the tape cartridge. In this manner, the tape drive ensures that the plaintext data on the tape cartridge remains secure and protected by encrypting any external transfer of data with an encryption key provided by the user who stored the data on the tape cartridge.

[0007] The first embodiment may optionally include the key encrypting key in the non-volatile memory of the tape cartridge being signed with a user private key associated with a user. The non-volatile memory of the tape cartridge includes a user public key. Actions responsive to the non-volatile memory of the tape cartridge storing the key encrypting key and the user public key include authenticating the signed key encrypting key using the user public key to generate a key encrypting key. Decryption of the key encrypting key is performed in response to authenticating the signed key encrypting key.

[0008] According to the above additional optional embodiment, the steps of signing the key encrypting key and authenticating it with the user public key provide assurance to the tape drive that the key encrypting key has been provided by a genuine user. Once the user who wrote the key encrypting key to the tape cartridge has been authenticated, decryption of the key encrypting key can proceed to generate a user encrypting key for which the user has been authenticated.

[0009] The first embodiment may further optionally include the key encryption key having a user encryption key encrypted using a product-specific public key associated with the tape drive, the key encryption key being decrypted using a product-specific private key maintained within the tape drive to generate the user encryption key used to encrypt plaintext data read from the tape media.

[0010] According to the above additional optional embodiment, a user may securely store on a tape cartridge a key encrypting key with the user encryption key encrypted with a product-specific public key that can only be decrypted by the tape drive using a product-specific private key held by the tape drive. In this way, the user is assured that only a legitimate tape drive will be able to decrypt the key encrypting key to obtain the user encryption key, since only authorized tape drives have the product-specific private key.

[0011] The first embodiment may further optionally include receiving a read request for plaintext data on the tape medium, in response to the read request, the encryption engine encrypts the requested plaintext data from the tape medium using a user encryption key and returns the encrypted requested plaintext data to the read request.

[0012] According to the above additional optional embodiment, the tape cartridge stores plaintext data, but the tape drive returns only encrypted data encrypted with user encryption data to a read request, ensuring that only the user who wrote the data to the cartridge can read and access the encrypted read data, since the plaintext data on the tape cartridge can only be decrypted with a user encryption key that is securely held by the user.

[0013] The first embodiment further optionally provides that the tape drive comprises a source tape drive, the tape cartridge comprises a source tape cartridge, and the tape medium comprises a source tape medium. Furthermore, the read request includes an operation for transferring encrypted plaintext data from the source tape medium to a destination tape medium in a destination tape cartridge coupled to the destination tape drive. In such a case, a key encryption key is transferred from the source tape drive to the destination tape drive for storage in the destination tape drive. The destination tape drive decrypts the transferred key encryption key to generate a user encryption key for use in decrypting the plaintext data transferred from the source tape drive, and generates plaintext data for writing to the destination tape medium.

[0014] According to the above additional embodiment, an encryption read mode is used to transfer encrypted plaintext data from one or more source tape drives to a destination tape drive, which must decrypt and store the plaintext data on the tape medium. This may be performed when upgrading a tape cartridge to a higher-capacity destination tape cartridge. Additionally, a key is copied from the source tape cartridge to the destination tape cartridge, so that the destination tape cartridge has the same encryption read mode setting as the source tape cartridge. This allows the destination tape cartridge to be processed in the same way as the source cartridge was processed. Still further, the migration method enables secure reproduction of the contents of the tape medium 208 by encrypting the data before migrating it to a new destination drive.

[0015] A second embodiment provides a computer program product, system, and method for managing access to tape cartridges at a tape archive service provider. Plaintext data is received from a user computer associated with a user and written to the tape media of a tape cartridge. A product-specific public key associated with a tape drive is sent to the user computer. A key encryption key associated with the user and including a user encryption key encrypted with the product-specific public key is then received from the user computer. The product-specific public key and the product-specific private key are maintained within the tape drive and are a key pair in a cryptosystem. The key encryption key is decrypted using the product-specific private key to generate a user encryption key. The user encryption key is used to encrypt plaintext data read from the tape media for return in response to a read request.

[0016] According to the second embodiment above, a user computer may provide a key encryption key encrypted with a tape drive product-specific public key for a tape drive for use therewith with a tape cartridge. By encrypting the user encryption key with the product-specific public key, the user is assured that only legitimate tape drives containing the product-specific private key can access the user encryption key to encrypt plaintext data read from the tape drive.

[0017] The second embodiment may further optionally implement storage of the key encryption key in non-volatile memory of the tape cartridge. Upon detecting that the tape cartridge has been ejected from the tape drive and then reinserted into the tape drive, the key encryption key is accessed from the non-volatile memory of the reinserted tape cartridge. The accessed key encryption key is decrypted using the product-specific private key to generate a user encryption key for use in encrypting plaintext data read from the tape media.

[0018] In accordance with the above optional embodiment, the new key encryption key stored in the non-volatile memory of the tape cartridge when received from the user is now accessed when the tape cartridge is re-inserted into the tape drive, causing the tape drive to access and decrypt the new key encryption key stored on the tape cartridge to generate a user encryption key for use in encrypting data for return to read requests and decrypting data for write in plaintext.

[0019] The second embodiment may further optionally include the received key encryption key comprising a first key encryption key and the user encryption key comprising a first user encryption key. The decryption determines whether the first user encryption key was successfully generated. In response to the decryption determining that the user encryption key was successfully generated, the first key encryption key is stored in the non-volatile memory of the tape cartridge. Storing the first key encryption key overwrites a second key encryption key stored in the non-volatile memory of the tape cartridge, the second key encryption key being associated with the user and encrypted using the product-specific public key. The second key encryption was stored in the non-volatile memory of the tape cartridge before the first key encryption key was received from the user.

[0020] According to the above optional embodiment, the user-provided first key encryption key is used to update and overwrite the previous key encryption key stored on the tape cartridge for use for future read and write operations when the tape cartridge is reinserted into the tape drive, thereby enabling a user to update the user encryption key held within the tape cartridge for use for future read and write operations to the storage cartridge. [Brief explanation of the drawings]

[0021] [Figure 1] 1 illustrates one embodiment of a tape archive environment.

[0022] [Figure 2] 1 illustrates one embodiment of a tape drive for a tape cartridge.

[0023] [Figure 3] 1 illustrates one embodiment of a user computer that performs operations related to tape drives and tape cartridges at a tape archive service provider.

[0024] [Figure 4]1 illustrates one embodiment of the operations performed when a tape cartridge is loaded into a tape drive to access a user encryption key.

[0025] [Figure 5] 1 illustrates one embodiment of operations performed by a tape archive service provider to process a user request to read data from a user tape cartridge sent to the tape archive service provider.

[0026] [Figure 6] 1 illustrates one embodiment of operations performed by a tape archive service provider to process a user request to write data to a user tape cartridge sent to the tape archive service provider.

[0027] [Figure 7] 1 illustrates one embodiment of an arrangement of source tape drives and destination tape drives in a tape library for migrating data from one or more source tapes to destination tapes in the destination tape drives.

[0028] [Figure 8] 1 illustrates one embodiment of an operation for copying data from a source tape cartridge in a source tape drive to a destination tape cartridge in a destination tape drive.

[0029] [Figure 9] 1 illustrates one embodiment of operations performed by a user computer and a tape archive service provider to update a user encryption key used for a tape cartridge at the tape archive service provider.

[0030] [Figure 10] 1 illustrates a computing environment in which the components of FIGS. 1 and 2 may be implemented. DETAILED DESCRIPTION OF THE INVENTION

[0031] The described embodiments provide improvements to computer techniques for providing access to plaintext data on tape cartridges maintained by a tape archive service. The described embodiments provide a security and encryption protocol for preventing unauthorized users from reading plaintext data on tape cartridges by allowing tape drives at the tape archive service to access a user encryption key within a key encryption key maintained within the tape cartridge. This allows the tape drive to securely access the user encryption key through a series of encryption and signing operations and then use it to encrypt data read from the tape cartridge for providing to a read request and to decrypt encrypted write data provided to the tape drive for writing to the tape cartridge. In this manner, the tape drive ensures that the plaintext data on the tape cartridge remains secure and protected by encrypting any external transfer of the data with an encryption key provided by the user who stored the data on the tape cartridge.

[0032] Furthermore, by having the tape drive unwrap the user encryption key from the source tape cartridge, the source tape drive can migrate plaintext data on the source tape cartridge that was encrypted using the user encryption key provided from the source tape cartridge to the destination tape cartridge, and can copy the key encryption key from the source tape drive for storage on the destination tape cartridge. In this way, the destination tape cartridge can unwrap the same user encryption key from the key encryption key copied to the destination tape cartridge to decrypt the encrypted transferred data for storage on the destination tape cartridge as plaintext. In this way, tape drives at the tape archive service provider do not need to obtain keys from a key manager, but instead can obtain keys from tape cartridges that have data to access or transfer.

[0033] FIG. 1 illustrates one or more tape libraries 102 and tape cartridges 202 provided by a user or client of a tape archive service offered by a service provider. i 2 illustrates an embodiment of a tape archive environment showing a tape archive service provider 100 facility with an inventory of tapes 104 (FIG. 2). The service provider server 106 stores tape cartridges 202 that users have sent to the tape archive service provider 100 for archiving. i The server includes a server request manager 108 that receives requests from user computers 300i over a network 110 to access data in the database.

[0034] The tape library 102 stores tape cartridges 202 i The magazine 112, the tape cartridge in the magazine 112, is grasped and placed in another magazine or storage slot or tape drive 2001, 2002, . . . 200. n an accessor 114 having a robotic picker assembly for moving the tape cartridge 202 to one of the ia bar code reader for reading the bar code on the label of the tape cartridge 202 and receiving a request for data in the tape cartridge and i , and controls the accessor 114 to load user read and write requests from the user computer 300 to the tape drives 2001, 2002, . . . 200 n The library controller 116 directs the different tape drives 2001, 2002, . . . 2003. n Cartridge 202 i , magazines 112, and stored tapes 104. The service provider server 106 and tape library 102 may communicate over a local network 118 of the tape archive service provider 100.

[0035] FIG. 2 shows a tape drive 200 receiving read and write requests. i Tape cartridge 202 loaded into i a tape drive 200 including a controller 204 that controls a tape head system 206 to read and write data from and to a mounted tape storage medium 208 within the tape drive 200; i The controller 204 transfers the read data from the tape medium 208 to the service provider server 106 and the user computer 300. i Buffered in cache 210 before being returned to user computer 300 i The tape drive 200 may buffer data for read and write requests in the cache 210 so that write data from the tape drive 200 is buffered before being written to the tape storage medium 208. i encrypts plaintext data read from the tape medium 208 for return in response to a read request, and decrypts received encrypted write data for use in writing plaintext data to the tape medium 208 to the user computer 300. i The encryption engine 212 is loaded with a user encryption key DK 302 from the .

[0036] The cache 210 may buffer various keys used during the encryption process, including: the tape drive 200; i a product specific secret key (PS-SK) 214, e.g., a private key, and a product specific public key (PS-PK) 216, which are associated with the user computer 300 and are a key pair in a cryptosystem such as a public key infrastructure; i The user computer 300 includes a user secret key 306, e.g., a private key, stored in non-volatile memory 308 of the i User public key 304 received from user computer 300 i User encryption key DK302 provided by user computer 300 i a key encryption key (KEK) 218 ​​containing a user encryption key (DK) 302 encrypted with a product-specific public key 216 in the user computer 300i; and a user private key 304 signed in the user computer 300i and used to encrypt the DK 302 in the tape drive 200. i The tape cartridge 202 is loaded into the cache 210. i The user computer 300 includes a signed KEK (S-KEK) 310, which includes the KEK 218 stored in the non-volatile memory 220 of the user computer 300. The user encryption key DK 302 may include an asymmetric key or a user encryption public key in a cryptosystem for encrypting data, where the user computer 300 i The tape cartridge 202 holds a corresponding user encryption private key for decrypting data encrypted by the user encryption public key. i The non-volatile memory 220 of the user computer 300 i The server further stores a US-PK 304 for use in verifying the signature of an S-KEK 310 signed with a US-SK 306 in the server.

[0037] Tape Drive 200 i includes a non-volatile memory 222 for persistently storing the PS-SK 214 and PS-PK 216, which are then loaded into the cache 210 for use during operation. The tape drive controller 204 includes a request manager 224 that manages read and write requests from users, and an encryption mode manager 226 that determines whether to set an encrypt read (ER) mode 228, which indicates that data read from the tape medium 208 is encrypted before returning the data to a read request, and that write data is decrypted before writing to the tape medium 208.

[0038] User computer 300 of FIG. i user computer 300 i The tape archive service provider may include service provider client code 311, such as a toolkit provided by the tape archive service provider, for enabling the user to interact with the service provider server 106 and transmit read and write requests to the user tape cartridges 202 held by the tape archive service provider 100. i a read / write interface 312 for transmitting the S-KEK 310 and US-PK 304 to the tape cartridge 202; i 202 for transfer to the tape archive service provider 100, such as by writing to the non-volatile memory 220 of the tape cartridge 202. i and a tape cartridge transfer manager 314 that prepares a user encryption key DK 302 to be used for tape cartridges residing within the tape archive service provider 100. U The tape cartridge transport manager 314 first encrypts the user encryption key 302 with the PS-PK 216 to generate the KEK 218, i.e., KEK={DK} PS-PK , and then create S-KEK 310 by signing KEK 218 with US-SK 306, i.e., S-KEK=[KEK]US-SK .

[0039] In a further embodiment, the user may access the user computer 300 i The tape drive in i User computer 300 for writing to i Using the tape drive tools or backup program provided in i In a further embodiment, a user may communicate a request to read or write data to the service provider server 106 through a website provided by the tape archive service provider.

[0040] In an alternative embodiment, the tape drives may be directly connected to the service provider server or to the user computer. In a further embodiment, the user computer may be directly connected to the local network 118 and communicate directly with the tape library 102, the tape drives directly connected to the local network 118, and / or the service provider server.

[0041] The controller 204 and the encryption engine 212 may be configured with code executed by a processor or implemented in hardware / firmware, for example, a separate Field Programmable Gate Array (FPGA).

[0042] Tape Cartridge 202 i may include, for example, a tape cartridge conforming to the Linear Tape Open (LTO) format. In alternative embodiments, the portable tape cartridge may include other types of portable storage media, such as a disk drive, static memory, flash memory, solid state storage device (SSD), etc.

[0043] The non-volatile memories 222, 220, and 308 may include various types of storage devices, including magnetic hard disk drives, solid-state storage devices (SSDs) made up of solid-state electronics.

[0044] Tape Drive 200 i The cache 210 within may include volatile memory such as EEPROM (electrically erasable programmable read-only memory), flash memory, flash disks, random access memory (RAM) drives, storage-class memory (SCM), phase change memory (PCM), resistive random access memory (RRAM), spin transfer torque memory (STM-RAM), conductive bridging RAM (CBRAM), magnetic hard disk drives, optical disks, tape, etc.

[0045] Local network 118 may include one or more local area networks (LANs), storage area networks (SANs), etc. Network 110 may include a LAN, a SAN, a wide area network (WAN), the Internet, a peer-to-peer network, a wireless network, etc.

[0046] Devices 102, 106, 108, and 200 i , and 300 iThe program components 108, 116, 204, 224, 226, 212, 310, 312, 314, 316 through 318 include program code that is loaded into memory and executed by a processor. Alternatively, some or all of the component functions may be implemented in hardware devices such as an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), or performed by a separate dedicated processor. In one embodiment, the encryption engine 212 is integrated into the tape drive 200 to manage encryption operations. i It can be implemented as an FPGA card in

[0047] FIG. 4 illustrates the operation of the tape cartridge 202 to determine the user encryption key DK302 required for the encryption operation. i 200 tape drives i 2 illustrates one embodiment of operations performed by encryption mode manager 226 when inserted into an opening in tape drive 200. i Tape cartridge 202 loaded in i Upon detecting (at block 400), the encryption mode manager 226 i The tape cartridge is interrogated (at block 402) to determine if it has the S-KEK 310 and US-PK 304 stored in non-volatile memory 220. If so, the S-KEK 310 and US-PK 304 are used by the user computer 300 to communicate with the US-SK 306. iThe KEK 218 is loaded into the cache 210 for use in authenticating (at block 404) the signature of the S-KEK 310 as having been signed in the US-PK 304. The signature is verified using the US-PK 304 because the KEK 218 contains the signed S-KEK 310, which is used to determine whether the hash of the KEK 218 matches the S-KEK 306 decrypted using the US-PK 304. If the signature of the S-KEK 310 cannot be authenticated (at block 404), an error is returned (at block 406). If the signature of the S-KEK 310 can be authenticated (at block 404), the KEK 218 is returned (at block 408) as having been authenticated by the user. The KEK 218 is then decrypted (at block 410) using the PS-SK 214 to obtain the user encryption key DK 302. All used keys 214, 310, 218, 304 are maintained in the cache 210 during operation. The DK 302 is loaded (at block 412) into the encryption engine 212 for use in encrypting plaintext data read from the tape medium 208, decrypting the encrypted plaintext data, and writing the plaintext data to the tape medium 208. After obtaining the user encryption key DK 302 for the encryption engine 212, all keys 214, 216, 310, 218, 304, 302 are cleared from the cache 210 (at block 414), and the ER mode 228 is set to encrypt-read.

[0048] By the operation of FIG. 4, the tape cartridge 202 i If the tape cartridge includes an S-KEK 310 and a US-PK 304, the controller 204 i The user encryption key DK302 used in the encrypted read mode can be automatically extracted while the key is loaded into the memory.

[0049] FIG. 5 shows the specified tape cartridge 202 i The user computer 300 for the data stored in iUser computer 300 to process read requests from i a read / write interface 312 to the service provider's module in the server request manager 108, and a tape drive 200 i 3 illustrates one embodiment of operations performed by the request manager 224 in the user computer 300. i The read / write interface 312 in the tape archive facility reads and writes the specified tape cartridge 202 i 5. Upon receiving the read request (at block 502), the service provider server 106 sends a read request to the service provider server 106 to read data from the specified tape cartridge 202. i a tape library 102 including a tape drive 200 if necessary; i Tape cartridge 202 specified in i and processes read requests, including loading the tape cartridge 202. i 4 if the user computer 300 that initiated the request has not already loaded the requested plaintext data. The tape drive request manager 224 reads the requested plaintext data from the tape storage medium 208 and sends the read data to the encryption engine 212 to encrypt the read-requested plaintext data on the tape storage medium 208 using the user encryption key DK 302 (at block 508). i Upon receiving the encrypted plaintext data, the read / write interface 312 may decrypt the encrypted data using the user encryption key DK302 and provide the plaintext data to the user.

[0050] FIG. 6 shows the tape cartridge 202 i A user computer 300 having data encrypted using a user encryption key DK 302 for writing to a tape medium 208 in iUser computer 300 to process write requests from i a read / write interface to the service provider 312 modules in the server request manager 108 and the tape drive 200; i 4 illustrates one embodiment of operations performed by the request manager 224 in the tape archive service provider 100. The read / write interface sends a write request to write to a specified tape cartridge to the tape archive service provider 100 (at block 600) with plaintext data encrypted using a user encryption key (DK) 302. Upon receiving the write request with the encrypted data (at block 602), the server request manager 108 processes the write request, including loading the specified tape cartridge 202i into the tape drive 200i, if necessary, to the tape library 102 containing the specified tape cartridge 202i, and sends a command to perform the operations of FIG. 4 if the tape cartridge 202i is not already loaded (at block 604). The tape drive encryption engine 212 decrypts the encrypted write data using the user encryption key DK 302 (at block 606) and writes the decrypted plaintext write data to the tape medium 208 (at block 608).

[0051] 5 and 6, the data is stored in plain text on the tape cartridge 202 at the tape archive facility. However, any attempt to read the data will result in the tape drive 200 i For archiving, tape cartridge 202 i The tape drive 200 is configured to return only the requested data encrypted using the user encryption key 302 of the user who provided it to the tape drive 200. This ensures secure transfer of data from the tape medium 208. Furthermore, to ensure that plaintext data is written to the tape medium 208, the tape drive 200 idecrypts the encrypted write data and writes the data as plain text to the tape cartridge 202 i By storing the data as plain text, the user can change the user encryption key 302 without having to decrypt and re-encrypt all the data on the tape medium 208.

[0052] 7 and 8 illustrate one or more source tape cartridges 202 S From destination tape cartridge 202 D 7 illustrates an embodiment in which encryption mode is used for requests to read data as part of the migration of data to a source tape drive 200, which may be in the same or a different tape library 102. S and destination tape drive 200 D 2. In addition to the keys and components shown in FIG. 2, the tape drive 200 S , 200 D ...as shown.

[0053] FIG. 8 illustrates one or more source tape cartridges 202 S All data in the tape media in the destination tape cartridge 202 D 2 illustrates an embodiment of a copying operation to a source tape cartridge 202. S From destination tape cartridge 202 D At the start of the operation of migrating / copying data to the source tape drive 200 (at block 800), S performs the operations in Figure 4 to establish a user encryption key DK 302 in the encryption engine 212 (at block 802). D destination tape drive 200 D (at block 804) into the source tape drive 200 S Source tape cartridge 202 S The S-KEK 310 and the US-PK 304 in the nonvolatile memory 220 are stored in the destination tape drive 200. D(at block 806) to the destination tape cartridge 202 as shown in FIG. D Store in.

[0054] Destination tape drive 200 D uses the US-PK 304 to authenticate the signed S-KEK 310 (at block 808) and decrypts the KEK 218 using the PS-SK 214 to generate a user encryption key DK 302, which is then sent to the destination tape drive 200 as described with respect to FIG. D The DK302 is loaded into the encryption engine 212 in the source tape drive 200. S The encryption engine 212 encrypts (at block 810) the plaintext data from the source tape cartridge using the DK 302 and forwards it to the destination tape drive 200. D Destination tape drive 200 D The encryption engine 212 of the source tape drive 200 S The encrypted plaintext data from the tape cartridge 202 is decrypted using the DK 302 and sent to the destination tape cartridge 202. D Write to.

[0055] 7 and 8 utilize an encrypted read mode to transfer encrypted plaintext data from one or more source tape drives to a destination tape drive, which must decrypt and store the plaintext data on the tape media 208. This is done by the tape cartridge 202- S Higher capacity destination tape cartridge 202 D Furthermore, the keys 304, 310 may be stored in the source tape cartridge 202. S From destination tape cartridge 202 D and therefore the destination tape cartridge 202 D Source tape cartridge 202 S This allows the destination tape cartridge 202 to have the same encryption read mode setting as the destination tape cartridge 202. D But, Source Cartridge 202S was processed in the same manner as it was processed. Furthermore, the migration method allows for secure reproduction of the contents of the tape media 208 by encrypting the data before migrating it to the new destination drive.

[0056] FIG. 9 shows the tape drive 200 i New user encryption key DK302 for use by N and a tape cartridge 202. i S-KEK310 in the new S-KEK310 N user computer 300 for updating i Encryption read mode updater 316 and tape drive 200 i 3 illustrates one embodiment of the operation of the encryption mode manager 226 in N To program the i The encryption read mode updater 316 in i 4. Upon receiving the request to write the plaintext data (at block 902), the service provider server 106 sends the write of the plaintext data to the service provider 300 for writing to the specified tape cartridge 202, including, if necessary, loading the specified tape cartridge in a tape drive and performing the operations of FIG. i In response to receiving this write request of plaintext data to update the encrypted read mode, the tape drive 200 sends a command to the tape library 102 indicating i converts the PS-PK 216 into a new user encryption key 302 N user computer 300 for use in providing i (at block 906).

[0057] User Computer 300 iWhen the PS-PK 216 is received, the encryption read mode updater 316 updates the tape cartridge 202 i New DK 302, which may contain the newly generated DK to replace the existing one in N Encrypt (at block 908) the new DK302 N Encrypt it and create a new KEK218 N Create a new KEK218 N , or the new KEK218 N The hash of is signed (at block 910) using the US-SK 306 to create a new signed S-KEK 310 N is generated. New S-KEK310 N and US-PK304 are designated tape cartridges 202 i 912 to the service provider server 106 for the tape archive service provider, and i The S-KEK 310 in the nonvolatile memory 220 is updated.

[0058] Alternatively, users can use the new S-KEK310 N and US-PK304, and the new S-KEK310 N Re-keying can be initiated through a web interface at the service provider server 106 by indicating the tape cartridge to be updated using

[0059] The service provider server 106 receives the new S-KEK 218 N and a designated tape cartridge 202 for reprogramming the US-PK 304 via the local network 118. i Tape drive 200 having i The tape drive encryption mode manager 226 transfers (at block 914) the US-PK 304 to the tape library 102 containing the signed S-KEK 310. NIf so, the encryption mode manager 226 determines whether the US-PK 304 is authenticated (at block 916). If not, an error is returned (at block 918). If authenticated, the encryption mode manager 226 determines whether the US-PK 304 is authenticated (at block 918). i It is determined (at block 920) whether the tape cartridge 202 is currently stored in non-volatile memory (NVM) 220. If so, then (at block 922) i If the US-PK 304 in the encryption mode manager 226 matches the received US-PK, the encryption mode manager 226 uses the received US-PK 304 (at block 924) to generate a new S-KEK 310. N and authenticate the new KEK218 N If there is no match (at block 922), an error is returned (at block 918). N is decrypted (at block 926) using PS-SK 214 to obtain a new user encryption key DK 302 N If the decryption is successful (at block 928), e.g., if the decryption did not result in a NULL key, the received S-KEK 310 is generated. N and US-PK304, tape cartridge 202 i is ejected and loaded into a tape drive for later use. i The user encryption key DK302 is stored in the nonvolatile memory 220. N Tape cartridge 202 i 200 tape drives i While loaded into the tape cartridge 202, it may be loaded into the encryption engine 212 for use in encryption operations. If the decryption is not successful (at block 928), i.e., a NULL key is provided, the tape cartridge 202 i The S-KEK 310 and US-PK 304 in the non-volatile memory 220 are deleted (at block 932).

[0060] According to the embodiment of FIG. 9, a user can purchase a new S-KEK310 for use in the same or a different tape drive. N Tape drive 200 i The user encryption key used in the tape cartridge 202 is updated. i The signed S-KEK 310 is transmitted to the service provider server 106 to update the S-KEK 310 in the N This allows the user to specify a new user encryption key for the tape cartridge 202. i User encryption keys and S-KEK310 stored in N can be updated for use in future read and write operations to the storage cartridge.

[0061] The present invention may be a system, a method, and / or a computer program product, which may include a computer-readable storage medium (or media) having computer-readable program instructions that cause a processor to perform aspects of the present invention.

[0062] Various aspects of the present disclosure are described through text, flowcharts, block diagrams of computer systems, and / or block diagrams of machine logic included in embodiments of a computer program product (CPP). For any flowchart, depending on the technology involved, operations may be performed in an order different from that shown in a given flowchart. For example, again depending on the technology involved, two operations shown in successive flowchart blocks may be performed in the reverse order, as a single integrated step, simultaneously, or in an at least partially overlapping manner.

[0063] A computer program product embodiment ("CPP embodiment" or "CPP") is a term used in this disclosure to describe any set of one or more storage media (also referred to as "media") collectively included in a set of one or more storage devices that collectively contain machine-readable code corresponding to instructions and / or data for performing the computer operations specified in a given CPP claim. A "storage device" is any tangible device that can hold and store instructions for use by a computer processor. The computer-readable storage medium may be, but is not limited to, an electronic storage medium, a magnetic storage medium, an optical storage medium, an electromagnetic storage medium, a semiconductor storage medium, a mechanical storage medium, or any suitable combination of the foregoing. Some known types of storage devices that include these media include diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanically encoded device (such as pits / lands formed on the major surface of a punch card or disk), or any suitable combination of the foregoing. Computer-readable storage media, as the term is used in this disclosure, is not to be construed as storage in the form of a transitory signal per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide, light pulses passing through fiber optic cables, electrical signals communicated through wires, and / or other transmission media. As will be appreciated by those skilled in the art, data is typically moved at some infrequent time during the normal operation of a storage device, such as during access, defragmentation, or garbage collection, but the above does not qualify a storage device as transitory since data is not transitory while it is stored.

[0064] Computing environment 1000 includes an example of an environment for the execution of at least some of the computer code 1001 involved in implementing the methodology of the present invention, such as server request manager 108 in Figure 2. Service provider server 106 may be implemented in computer 1001 and communicate via WAN 1002.

[0065] In addition to block 1001, computing environment 1000 includes, for example, a computer 1001, a wide area network (WAN) 1002, an end user device (EUD) 1003, a remote server 1004, a public cloud 1005, and a private cloud 1006. In this embodiment, computer 1001 includes a set of processors 1010 (including processing circuitry 1020 and cache 1021), a communications fabric 1011, volatile memory 1012, persistent storage 1013 (including an operating system 1022 and block 1001 shown above), a set of peripheral devices 1014 (including a set of user interface (UI) devices 1023, storage 1024, and a set of Internet of Things (IoT) sensors 1025), and a network module 1015. Remote server 1004 includes a remote database 1030. The public cloud 1005 includes a gateway 1040, a cloud orchestration module 1041, a set of host physical machines 1042, a set of virtual machines 1043, and a set of containers 1044.

[0066] Computer 1001 may take the form of a desktop computer, a laptop computer, a tablet computer, a smartphone, a smartwatch or other wearable computer, a mainframe computer, a quantum computer, or any other form of computer or mobile device now known or later developed that is capable of executing programs, accessing a network, or querying a database, such as remote database 1030. As is well understood in the field of computer technology, and depending on the technology, execution of a computer-implemented method may be distributed among multiple computers and / or among multiple locations. However, in this description of computing environment 1000, for purposes of brevity, the detailed discussion focuses on a single computer, specifically computer 1001. While computer 1001 is not shown in FIG. 10 within the cloud, it may be located within the cloud. However, computer 1001 is not required to reside within the cloud except to any extent that may be expressly indicated.

[0067] The processor set 1010 includes one or more computer processors of any type now known or later developed. The processing circuitry 1020 may be distributed across multiple packages, e.g., multiple tailored integrated circuit chips. The processing circuitry 1020 may implement multiple processor threads and / or multiple processor cores. The cache 1021 is memory located within the processor chip package and is typically used for data or code that should be available for fast access by threads or cores executing on the processor set 1010. Cache memory is typically organized into multiple levels depending on relative proximity to the processing circuitry. Alternatively, some or all of the cache for a processor set may be located “off-chip.” In some computing environments, the processor set 1010 may be designed to operate with qubits and perform quantum computing.

[0068] Computer-readable program instructions are typically loaded onto the computer 1001 and cause the processor set 1010 of the computer 1001 to perform a series of operational steps, thereby realizing a computer-implemented method. As a result, the instructions so executed instantiate the method specified in the flowcharts and / or descriptions of the computer-implemented method (collectively, the "methods of the present invention") contained herein. These computer-readable program instructions are stored in various types of computer-readable storage media, such as cache 1021 and other storage media discussed below. The program instructions and associated data are accessed by the processor set 1010 to control and direct the execution of the methods of the present invention. In the computing environment 1000, at least some of the instructions for implementing the methods of the present invention may be stored in persistent storage 1013.

[0069] Communications fabric 1011 is the signal-conducting pathway that allows various components of computer 1001 to communicate with one another. Typically, this fabric is made up of switches and conductive pathways, such as switches and conductive pathways that make up buses, bridges, physical input / output ports, etc. Other types of signal communication pathways may be used, such as fiber optic and / or wireless communication pathways.

[0070] Volatile memory 1012 may be any type of volatile memory now known or later developed. Examples include dynamic random access memory (RAM) or static RAM. Typically, volatile memory 1012 is characterized by random access, although this is not required unless expressly stated. In computer 1001, volatile memory 1012 is located in a single package and is internal to computer 1001; however, alternatively or additionally, volatile memory may be distributed across multiple packages and / or located external to computer 1001.

[0071] Persistent storage 1013 is any form of non-volatile storage for a computer, now known or later developed. The non-volatility of this storage means that stored data remains regardless of whether power is supplied to computer 1001 and / or directly to persistent storage 1013. While persistent storage 1013 can be read-only memory (ROM), typically at least a portion of persistent storage allows data to be written, data to be deleted, and data to be rewritten. Some well-known forms of persistent storage include magnetic disks and solid-state storage devices. Operating system 1022 may take several forms, such as various known proprietary operating systems employing a kernel or open-source Portable Operating System Interface-type operating systems. The code contained in block 1001 typically includes at least some of the computer code involved in implementing the methods of the present invention, such as server request manager 108 of FIG. 1 .

[0072] Peripheral device set 1014 includes a set of peripheral devices of computer 1001. Data communication connections between peripheral devices and other components of computer 1001 may be implemented in various ways, such as Bluetooth® connections, near field communication (NFC) connections, connections made by cables (such as Universal Serial Bus (USB)-type cables), insertion-type connections (e.g., Secure Digital (SD) cards), connections made through local area communication networks, and even connections made through wide area networks such as the Internet. In various embodiments, UI device set 1023 may include components such as display screens, speakers, microphones, wearable devices (such as goggles and smartwatches), keyboards, mice, printers, touchpads, game controllers, and haptic devices. Storage 1024 may be external storage, such as an external hard drive, or insertable storage, such as an SD card. Storage 1024 may be persistent and / or volatile. In some embodiments, storage 1024 may take the form of a quantum computing storage device for storing data in the form of qubits. In embodiments where computer 1001 is required to have a large amount of storage (e.g., where computer 1001 stores and manages large databases locally), this storage may be provided by a peripheral storage device designed to store very large amounts of data, such as a storage area network (SAN) shared by multiple, geographically distributed computers. IoT sensor set 1025 consists of sensors that can be used in Internet of Things applications. For example, one sensor may be a thermometer and another sensor may be a motion detector.

[0073] The network module 1015 is a collection of computer software, hardware, and firmware that enables the computer 1001 to interact with other computers over the WAN 1002. The network module 1015 may include hardware such as a modem or Wi-Fi® signal transceiver, software for packetizing and / or depacketizing data for communication network transmission, and / or web browser software for communicating data over the Internet. In some embodiments, the network control and network forwarding functions of the network module 1015 are implemented on the same physical hardware device. In other embodiments (e.g., embodiments utilizing Software-Defined Networking (SDN)), the control and forwarding functions of the network module 1015 are implemented on physically separate devices, such that the control function manages several different network hardware devices. Computer-readable program instructions for implementing the methods of the present invention may be downloaded to the computer 1001 from an external computer or external storage device, typically through a network adapter card or network interface included in the network module 1015.

[0074] WAN 1002 is any now known or later developed wide area network (e.g., the Internet) capable of communicating computer data between remote locations using any technology for communicating computer data. In some embodiments, WAN 1002 may be replaced and / or supplemented by a local area network (LAN) designed to communicate data between devices located in a local area, such as a Wi-Fi network. WANs and / or LANs typically include copper transmission cables, optical fiber transmissions, wireless transmissions, and computer hardware such as routers, firewalls, switches, gateway computers, and edge servers.

[0075] User Computer 300 i is any computer system used and controlled by an end user (e.g., a customer of the business that operates computer 1001), and may take any of the forms discussed above in connection with computer 1001, but which has service provider client code 311. i Typically, the service provider server 106 sends read and write requests to the service provider server 106 and other related commands to the computer 1001 that implements the service provider server 106. For example, the computer 1001 may read data from a tape cartridge and forward it to the user computer 300. i If the read data is designed to be returned to the user computer 300, this read data is typically transmitted from the network module 1015 of the computer 1001, over the WAN 1002, and to the user computer 300. i In this way, the user computer 300 i Archived Tape Cartridge 202 i In some embodiments, the user computer 300 may receive the requested data. i may be a client device, such as a thin client, a heavy client, a mainframe computer, a desktop computer, etc.

[0076] Remote server 1004 is any computer system that provides at least some data and / or functionality to computer 1001. Remote server 1004 may be controlled and used by the same entity that operates computer 1001. Remote server 1004 represents a machine that collects and stores useful and useful data for use by other computers, such as computer 1001. For example, in the hypothetical case where computer 1001 is designed and programmed to provide recommendations based on historical data, then this historical data may be provided to computer 1001 from a remote database 1030 of remote server 1004.

[0077] A public cloud 1005 is any computer system available for use by multiple entities that provides on-demand availability of computer system resources and / or other computer capacity, particularly data storage (cloud storage) and computing capacity, without requiring direct, active management by users. Cloud computing typically leverages resource sharing to achieve coherence and economies of scale. Direct, active management of the computing resources of the public cloud 1005 is performed by computer hardware and / or software in a cloud orchestration module 1041. The computing resources provided by the public cloud 1005 are typically implemented by virtual computing environments running on various computers comprising a host physical machine set 1042, which is the universe of physical computers within and / or available in the public cloud 1005. A virtual computing environment (VCE) typically takes the form of a virtual machine from a virtual machine set 1043 and / or a container from a container set 1044. It is understood that these VCEs may be stored as images and transferred among and between various hosts of physical machines either as images or after instantiation of the VCE. Cloud orchestration module 1041 manages the transfer and storage of images, deploys new instantiations of VCEs, and manages active instantiations of VCE deployments. Gateway 1040 is a collection of computer software, hardware, and firmware that enables public cloud 1005 to communicate over WAN 1002.

[0078] Here, we provide some further explanation of virtual computing environments (VCEs). A VCE can be stored as an "image." A new, active instance of a VCE can be instantiated from the image. Two well-known types of VCEs are virtual machines and containers. A container is a VCE that uses operating system-level virtualization. This refers to a feature of an operating system in which the kernel allows the existence of multiple isolated user space instances called containers. These isolated user space instances typically behave as actual computers from the perspective of the programs running within them. A computer program running on a typical operating system can utilize all of the computer's resources, such as connected devices, files and folders, network shares, CPU power, and quantifiable hardware capabilities. However, a program running inside a container can only use the contents of the container and the devices assigned to the container; this feature is known as containerization.

[0079] Private cloud 1006 is similar to public cloud 1005, except that its computing resources are available only for use by a single enterprise. While private cloud 1006 is shown in communication with WAN 1002, in other embodiments, the private cloud may be completely disconnected from the Internet and accessible only through a local / private network. A hybrid cloud is a composite of multiple clouds of different types (e.g., private, community, or public cloud types), often implemented by different vendors. While each of the multiple clouds remains a separate, discrete entity, the larger hybrid cloud architecture is bound together by standardized or proprietary technologies that enable orchestration, management, and / or data / application portability between the constituent clouds. In this embodiment, both public cloud 1005 and private cloud 1006 are part of a larger hybrid cloud.

[0080] The terms "an embodiment," "embodiment," "embodiments," "the embodiment," "the embodiments," "the embodiments," "one or more embodiments," "some embodiments," and "one embodiment" mean "one or more (but not all) embodiments of the present invention," unless expressly specified otherwise.

[0081] The terms "including," "comprising," "having," or variations thereof mean "including, but not limited to," unless expressly specified otherwise.

[0082] Listed items of elements do not imply that any or all of these items are mutually exclusive, unless expressly specified otherwise.

[0083] The terms "a," "an," and "the" mean "one or more" unless expressly specified otherwise.

[0084] Devices that are in communication with each other are not necessarily in continuous communication with each other unless expressly specified otherwise. In addition, devices that are in communication with each other may communicate directly or indirectly through one or more intermediaries.

[0085] A description of an embodiment having several components in communication with each other does not imply that all of these components are required. To the contrary, a variety of optional components are described to illustrate the wide range of possible embodiments of the present invention.

[0086] Where a single device or article is described herein, it will be readily apparent that more than one device / article (whether or not they cooperate) may be used in place of the single device / article. Similarly, where more than one device or article is described herein (whether or not they cooperate), it will be readily apparent that a single device / article may be used in place of more than one device or article, or that a different number of devices / articles may be used in place of the number of devices or programs shown. The functionality and / or features of a device may alternatively be embodied by one or more other devices not explicitly described as having such functionality / features. Thus, other embodiments of the present invention need not include the device itself.

[0087] The foregoing description of various embodiments of the invention has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form disclosed. Many modifications and variations are possible in light of the above teachings. It is intended that the scope of the invention be limited not by this detailed description, but rather by the claims appended hereto. The above specification, examples and data provide a complete description of the manufacture and use of the composition of the invention. Since many embodiments of the invention can be made without departing from the scope of the invention, the invention resides in the claims appended hereto.

Claims

1. 1. A computer program product implemented in a tape drive to which a tape cartridge including a non-volatile memory and a tape medium is coupled, the computer program product comprising a computer-readable storage medium having computer-readable program code embodied therein that is executable to perform operations, the operations being: determining whether the non-volatile memory of the tape cartridge stores a key encryption key associated with a user, the key encryption key including an encrypted user encryption key; and In response to determining that the non-volatile memory of the tape cartridge stores the key encryption key: decrypting the key encryption key to generate the user encryption key; and providing the user encryption key resulting from the decrypting step to an encryption engine of the tape drive to encrypt plaintext data read from the tape media in the tape cartridge with the user encryption key for return in response to a read request.

1. A computer program product comprising:

2. the action in response to the key encryption key in the non-volatile memory of the tape cartridge being signed by a user private key associated with the user, the non-volatile memory of the tape cartridge including a user public key, and the non-volatile memory of the tape cartridge storing the key encryption key and the user public key: authenticating the signed key encrypting key using the user public key to generate the key encrypting key, wherein the decryption of the key encrypting key is performed in response to authenticating the signed key encrypting key.

10. The computer program product of claim 1, comprising:

3. 2. The computer program product of claim 1, wherein the key encrypting key comprises a user encryption key encrypted with a product-specific public key associated with the tape drive, the key encrypting key being decrypted with a product-specific private key maintained within the tape drive to generate a user encryption key used to encrypt the plaintext data read from the tape media.

4. The action: receiving a read request for the plaintext data in the tape medium; and In response to the read request, the encryption engine encrypts the requested plaintext data from the tape medium using the user encryption key and returns the encrypted requested plaintext data to the read request. The computer program product of claim 1 , further comprising:

5. The action: receiving a write request including encrypted write plaintext data encrypted using the user encryption key for writing to the tape medium; in response to the write request, decrypting, by the encryption engine, the encrypted write plaintext data using the user encryption key to generate the write plaintext data; and writing the plain text data to the tape medium; The computer program product of claim 1 , further comprising:

6. The action: generating a valid encryption key in response to the decryption of the key encryption key, the encryption engine using the user encryption key to encrypt plain text read from the tape media in the tape cartridge for return in response to a read request when the encrypt-read mode is set. The computer program product of claim 1 , further comprising:

7. 2. The computer program product of claim 1, wherein the read request is from the user and a user computer associated with the user uses the user encryption key to decrypt the encrypted plaintext data returned in response to the read request.

8. the tape drive comprises a source tape drive, the tape cartridge comprises a source tape cartridge, and the tape medium comprises a source tape medium, and the read request comprises an operation of transferring encrypted plaintext data from the source tape medium to a destination tape medium in a destination tape cartridge coupled to a destination tape drive, the operation comprising: transferring the key encryption key from the source tape drive to the destination tape drive and storing it on the destination tape drive, wherein the destination tape drive decrypts the transferred key encryption key to generate the user encryption key for use in decrypting the plaintext data transferred from the source tape drive to generate the plaintext data to be written to the destination tape medium. The computer program product of claim 1 , further comprising:

9. 1. A computer program product implemented in a tape drive coupled to a tape cartridge containing a tape medium, the computer program product comprising a computer readable storage medium having computer readable program code embodied therein executable to perform operations, the operations comprising: receiving plain text data for writing to said tape medium from a user computer associated with a user; sending a product-specific public key associated with the tape drive to the user computer; receiving from the user computer a key encrypting key associated with the user and including a user encryption key encrypted with the product-specific public key, wherein the product-specific public key and a product-specific private key maintained within the tape drive are a key pair in a cryptosystem; decrypting the key encryption key with the product-specific private key to generate the user encryption key; and using the user encryption key to encrypt the plaintext data read from the tape medium for return in response to a read request.

1. A computer program product comprising:

10. The action: storing the key encryption key in non-volatile memory of the tape cartridge; detecting that the tape cartridge has been reinserted into the tape drive after being ejected from the tape drive; accessing the key encryption key from the non-volatile memory of the reinserted tape cartridge; decrypting the accessed key encryption key with the product-specific private key to generate the user encryption key for use in encrypting plaintext data read from the tape media; 10. The computer program product of claim 9, further comprising:

11. the received key encrypting key comprises a first key encrypting key, the user encrypting key comprises a first user encrypting key, and the operation comprises: determining whether the decryption successfully generated the first user encryption key; and and storing the first key encryption key in non-volatile memory of the tape cartridge in response to determining that the decryption was successful in generating the user encryption key, wherein the storing the first key encryption key includes overwriting a second key encryption key stored in the non-volatile memory of the tape cartridge, the second key encryption including a second user encryption key associated with the user and encrypted with the product-specific public key, the second key encryption being overwritten from a second key encryption key stored in the non-volatile memory of the tape cartridge before the first key encryption key was received from the user.

10. The computer program product of claim 9, further comprising:

12. The action: and deleting the second key encryption key stored in the non-volatile memory of the tape cartridge in response to the determination that the decryption was not successful in generating the first user encryption key.

12. The computer program product of claim 11, further comprising:

13. The action: receiving a product-specific key from the user as part of receiving the key encryption key from the user; and determining whether the product-specific public key received from the user matches the product-specific key stored in the non-volatile memory of the tape cartridge, wherein the decryption of the key encryption key and use of the user encryption key decrypted from the key encryption key is performed in response to a determination that the product-specific public key received from the user matches the product-specific key stored in the non-volatile memory of the tape cartridge.

10. The computer program product of claim 9, further comprising:

14. 1. A system comprising a tape drive to which a tape cartridge is coupled, non-volatile memory; Tape media; A computer-readable storage medium having computer-readable program code embodied therein that is executable to perform operations, the operations being: determining whether the non-volatile memory of the tape cartridge stores a key encryption key associated with a user, the key encryption key including an encrypted user encryption key; and In response to determining that the non-volatile memory of the tape cartridge stores the key encryption key: decrypting the key encryption key to generate the user encryption key; and providing the user encryption key resulting from the decrypting step to an encryption engine of the tape drive to encrypt plaintext data read from the tape media in the tape cartridge using the user encryption key for return in response to a read request. A system comprising:

15. the action in response to the key encryption key in the non-volatile memory of the tape cartridge being signed by a user private key associated with the user, the non-volatile memory of the tape cartridge including a user public key, and the non-volatile memory of the tape cartridge storing the key encryption key and the user public key: authenticating the signed key encrypting key using the user public key to generate the key encrypting key, wherein the decryption of the key encrypting key is performed in response to authenticating the signed key encrypting key. The system of claim 14, comprising:

16. The action: receiving a read request for the plaintext data in the tape medium; and in response to the read request, encrypting, by the encryption engine, the requested plaintext data from the tape medium using the user encryption key and returning the encrypted requested plaintext data to the read request. The system of claim 14 further comprising:

17. the tape drive comprises a source tape drive, the tape cartridge comprises a source tape cartridge, and the tape medium comprises a source tape medium, and the read request comprises an operation of transferring encrypted plaintext data from the source tape medium to a destination tape medium in a destination tape cartridge coupled to a destination tape drive, the operation comprising: transferring the key encryption key from the source tape drive to the destination tape drive and storing it on the destination tape drive, wherein the destination tape drive decrypts the transferred key encryption key to generate the user encryption key for use in decrypting the plaintext data transferred from the source tape drive to generate the plaintext data to be written to the destination tape medium. The system of claim 14 further comprising:

18. 1. A system comprising a tape drive having a tape cartridge coupled thereto: Tape media; receiving plain text data for writing to the tape medium from a user computer associated with a user; and A computer-readable storage medium having computer-readable program code embodied therein that is executable to perform operations, the operations being: sending a product-specific public key associated with the tape drive to the user computer; receiving from the user computer a key encrypting key associated with the user and including a user encryption key encrypted with the product-specific public key, wherein the product-specific public key and a product-specific private key maintained within the tape drive are a key pair in a cryptosystem; decrypting the key encryption key with the product-specific private key to generate the user encryption key; and using the user encryption key to encrypt the plain text data read from the tape medium for return in response to a read request. A system comprising:

19. The action: storing the key encryption key in non-volatile memory of the tape cartridge; detecting that the tape cartridge has been reinserted into the tape drive after being ejected from the tape drive; accessing the key encryption key from the non-volatile memory of the reinserted tape cartridge; and decrypting the accessed key encryption key with the product-specific private key to generate the user encryption key for use in encrypting plaintext data read from the tape media; 20. The system of claim 18, further comprising:

20. the received key encrypting key comprises a first key encrypting key, the user encrypting key comprises a first user encrypting key, and the operation comprises: determining whether the decryption successfully generated the first user encryption key; and and storing the first key encryption key in non-volatile memory of the tape cartridge in response to determining that the decryption was successful in generating the user encryption key, wherein the storing the first key encryption key includes overwriting a second key encryption key stored in the non-volatile memory of the tape cartridge, the second key encryption including a second user encryption key associated with the user and encrypted with the product-specific public key, the second key encryption being overwritten from a second key encryption key stored in the non-volatile memory of the tape cartridge before the first key encryption key was received from the user.

20. The system of claim 18, further comprising:

21. The action: and deleting the second key encryption key stored in the non-volatile memory of the tape cartridge in response to the determination that the decryption was not successful in generating the first user encryption key.

20. The system of claim 18, further comprising:

22. 1. A method implemented in a tape drive having a tape cartridge coupled thereto, comprising: determining whether the non-volatile memory of the tape cartridge stores a key encryption key including an encrypted user encryption key associated with a user; and In response to determining that the non-volatile memory of the tape cartridge stores the key encryption key: decrypting the key encryption key to generate the user encryption key; and providing the user encryption key resulting from the decryption to an encryption engine of the tape drive to encrypt plaintext data read from tape media within the tape cartridge with the user encryption key for return in response to a read request. A method comprising:

23. the key encryption key in the non-volatile memory of the tape cartridge is signed with a user private key associated with the user, and the non-volatile memory of the tape cartridge contains a user public key; and in response to the non-volatile memory of the tape cartridge storing the key encrypting key and the user public key, authenticating the signed key encrypting key using the user public key to generate the key encrypting key, wherein the decrypting the key encrypting key is performed in response to the signed key encrypting key being authenticated.

23. The method of claim 22, comprising:

24. receiving a read request for the plaintext data in the tape medium; and in response to the read request, encrypting, by the encryption engine, the requested plaintext data from the tape medium using the user encryption key and returning the encrypted requested plaintext data to the read request.

23. The method of claim 22, further comprising:

25. the tape drive comprises a source tape drive, the tape cartridge comprises a source tape cartridge, and the tape medium comprises a source tape medium, and the read request comprises an operation of transferring encrypted plaintext data from the source tape medium to a destination tape medium in a destination tape cartridge coupled to a destination tape drive; transferring the key encryption key from the source tape drive to the destination tape drive and storing it on the destination tape drive, wherein the destination tape drive decrypts the transferred key encryption key to generate the user encryption key for use in decrypting the plaintext data transferred from the source tape drive to generate the plaintext data to be written to the destination tape medium.

23. The method of claim 22, further comprising:

26. 1. A computer program product implemented in a user computer for a user to store data on a tape medium in a tape cartridge, the computer program product comprising a computer readable storage medium having computer readable program code embodied therein that is executable to perform operations, the operations being: writing plain text data associated with said user to a tape medium within a tape cartridge; and writing a key encryption key, including an encrypted user encryption key associated with the user, to non-volatile memory of the tape cartridge, wherein storing the key encryption key in the non-volatile memory of the tape cartridge causes a tape drive into which the tape cartridge is inserted to decrypt the key encryption key and generate the user encryption key for use by an encryption engine of the tape drive to encrypt plaintext data read from the tape media in the tape cartridge with the user encryption key for return in response to a read request.

1. A computer program product comprising:

27. The action: signing the key encrypting key with a user private key associated with the user; and a step of writing a user public key, wherein the user private key and user public key are a key pair in a cryptosystem, and storing the key encryption key in the non-volatile memory of the tape cartridge allows the tape drive to validate the signature of the signed key encryption key using the user public key.

27. The computer program product of claim 26, further comprising:

28. The action: encrypting the user encryption key with a product-specific public key associated with the tape drive to form the key encryption key, wherein storing the key encryption key in the non-volatile memory of the tape cartridge causes the tape drive to decrypt the key encryption key using a product-specific private key maintained within the tape drive, the product-specific public key and the product-specific private key being a key pair in a cryptosystem.

27. The computer program product of claim 26, further comprising:

29. The action: sending a read request for the plaintext data on the tape media to a tape drive, wherein the read request causes the encryption engine of the tape drive to encrypt the requested plaintext data from the tape media using the user encryption key and return the encrypted requested plaintext data to the user computer.

27. The computer program product of claim 26, further comprising:

30. The action: sending a write request including encrypted write plaintext data to be written to the tape medium, encrypted using the user encryption key, wherein the write request causes the encryption engine of the tape drive to decrypt the encrypted write plaintext data using the user encryption key to generate the write plaintext data to be written to the tape medium.

27. The computer program product of claim 26, further comprising:

31. 27. The computer program product of claim 26, wherein the storing of the key encryption key in non-volatile memory of the tape cartridge causes the tape drive to indicate an encrypt-read mode for the tape cartridge and to use the user encryption key to encrypt plain text read from the tape media in the tape cartridge for read requests.

32. 1. A computer program product implemented in a user computer for a user to store data on a tape medium in a tape cartridge, the computer program product comprising a computer readable storage medium having computer readable program code embodied therein that is executable to perform operations, the operations being: transmitting plaintext data for writing to the tape medium in the tape cartridge loaded in a tape drive; receiving from the tape drive a product-specific public key associated with the tape drive; generating a key encryption key by encrypting a user encryption key associated with the user with the product-specific public key, wherein the product-specific public key and a product-specific private key maintained within the tape drive are a key pair in a cryptosystem; and transmitting the key encryption key to the tape drive and causing the tape drive to decrypt the key encryption key with the product-specific private key to generate the user encryption key for use in encrypting the plaintext data read from the tape medium for return in response to a read request.

1. A computer program product comprising:

33. The action: signing the key encrypting key with a user private key associated with the user, wherein the signed key encrypting key is transmitted to the tape drive having a user public key, the user public key and the user private key being a key pair, and transmitting the user public key causes the tape drive to use the user public key to remove the signature and obtain the key encrypting key.

33. The computer program product of claim 32, further comprising:

34. 33. The computer program product of claim 32, wherein said transmitting said key encryption key to said tape drive causes said tape drive to store said key encryption key in non-volatile memory of said tape cartridge and later retrieve said key encryption key from said non-volatile memory of said tape cartridge for use in encrypting data read from said tape media when said tape cartridge is re-inserted into said tape drive.

35. 8. The computer program product of claim 7, wherein the step of transmitting the key encryption key to the tape drive causes the tape drive to store the key encryption key in the non-volatile memory of the tape cartridge, overwriting a pre-existing key encryption key stored in the non-volatile memory of the tape cartridge.

36. 1. A system for data communication with a tape cartridge, the system having a non-volatile memory, a tape medium, and a tape drive, the system comprising: a processor; and a computer-readable storage medium having computer-readable program code embodied therein that is executable by said processor to perform operations, said operations being: writing plain text data associated with said user to a tape medium within a tape cartridge; and writing a key encryption key to the non-volatile memory of the tape cartridge, the key encryption key including an encrypted user encryption key associated with the user, wherein storing the key encryption key in the non-volatile memory of the tape cartridge causes the tape drive into which the tape cartridge is inserted to decrypt the key encryption key and generate the user encryption key for use by an encryption engine of the tape drive to encrypt plaintext data read from the tape media in the tape cartridge with the user encryption key for return in response to a read request. A system comprising:

37. The action: signing the key encrypting key with a user private key associated with the user; and a step of writing a user public key, wherein the user private key and user public key are a key pair in a cryptosystem, and storing the key encryption key in the non-volatile memory of the tape cartridge allows the tape drive to validate the signature of the signed key encryption key using the user public key.

37. The system of claim 36, further comprising:

38. The action: encrypting the user encryption key with a product-specific public key associated with the tape drive to form the key encryption key, wherein storing the key encryption key in the non-volatile memory of the tape cartridge causes the tape drive to decrypt the key encryption key using a product-specific private key maintained within the tape drive, the product-specific public key and the product-specific private key being a key pair in a cryptosystem.

37. The system of claim 36, further comprising:

39. The action: sending a read request for the plaintext data on the tape media to a tape drive, wherein the read request causes the encryption engine of the tape drive to encrypt the requested plaintext data from the tape media using the user encryption key and return the encrypted requested plaintext data to the user computer.

37. The system of claim 36, further comprising:

40. The action: sending a write request including encrypted write plaintext data to be written to the tape medium, encrypted using the user encryption key, wherein the write request causes the encryption engine of the tape drive to decrypt the encrypted write plaintext data using the user encryption key to generate the write plaintext data to be written to the tape medium.

37. The system of claim 36, further comprising:

41. 37. The system of claim 36, wherein the storing of the key encryption key in non-volatile memory of the tape cartridge causes the tape drive to indicate an encrypt-read mode for the tape cartridge and to use the user encryption key to encrypt plain text read from the tape media in the tape cartridge for read requests.

42. A system for data communication of a tape cartridge having a non-volatile memory, a tape medium, and a tape drive, comprising: a processor; and a computer-readable storage medium having computer-readable program code embodied therein that is executable by said processor to perform operations, said operations being: transmitting plaintext data for writing to the tape medium in the tape cartridge loaded in a tape drive; receiving from the tape drive a product-specific public key associated with the tape drive; generating a key encryption key by encrypting a user encryption key associated with the user with the product-specific public key, wherein the product-specific public key and a product-specific private key maintained within the tape drive are a key pair in a cryptosystem; and transmitting the key encryption key to the tape drive and causing the tape drive to decrypt the key encryption key with the product-specific private key to generate the user encryption key for use in encrypting the plaintext data read from the tape medium for return in response to a read request. A system comprising:

43. The action: signing the key encrypting key with a user private key associated with the user, wherein the signed key encrypting key is transmitted to the tape drive having a user public key, the user public key and the user private key being a key pair, and transmitting the user public key causes the tape drive to use the user public key to remove the signature and obtain the key encrypting key.

43. The system of claim 42, further comprising:

44. 43. The system of claim 42, wherein said transmitting said key encryption key to said tape drive causes said tape drive to store said key encryption key in non-volatile memory of said tape cartridge and later retrieve said key encryption key from said non-volatile memory of said tape cartridge for use in encrypting data read from said tape media when said tape cartridge is re-inserted into said tape drive.

45. 43. The system of claim 42, wherein said transmitting said key encryption key to said tape drive causes said tape drive to store said key encryption key in said non-volatile memory of said tape cartridge, overwriting a pre-existing key encryption key stored in said non-volatile memory of said tape cartridge.

46. 1. A method implemented in a user computer for a user to store data on a tape medium in a tape cartridge, comprising: writing plain text data associated with the user to a tape medium within a tape cartridge; and writing a key encryption key to a non-volatile memory of the tape cartridge, the key encryption key including an encrypted user encryption key associated with the user, wherein storing the key encryption key in the non-volatile memory of the tape cartridge causes a tape drive into which the tape cartridge is inserted to decrypt the key encryption key and generate the user encryption key for use by an encryption engine of the tape drive to encrypt plaintext data read from the tape media in the tape cartridge with the user encryption key for return in response to a read request. A method comprising:

47. signing the key encrypting key with a user private key associated with the user; and writing a user public key, wherein the user private key and user public key are a key pair in a cryptosystem, and storing the key encryption key in the non-volatile memory of the tape cartridge allows the tape drive to validate the signature of the signed key encryption key using the user public key.

47. The method of claim 46, further comprising:

48. encrypting the user encryption key with a product-specific public key associated with the tape drive to form the key encryption key, wherein storing the key encryption key in the non-volatile memory of the tape cartridge causes the tape drive to decrypt and generate the key encryption key with a product-specific private key maintained within the tape drive, the product-specific public key and the product-specific private key being a key pair in a cryptosystem.

47. The method of claim 46, further comprising:

49. sending a read request for the plaintext data on the tape medium to a tape drive, wherein the read request causes the encryption engine of the tape drive to encrypt the requested plaintext data from the tape medium using the user encryption key and return the encrypted requested plaintext data to the user computer.

47. The method of claim 46, further comprising:

50. sending a write request including encrypted write plaintext data for writing to the tape medium, encrypted using the user encryption key, wherein the write request causes the encryption engine of the tape drive to decrypt the encrypted write plaintext data using the user encryption key to generate the write plaintext data for writing to the tape medium.

47. The method of claim 46, further comprising:

Images