Automated Encryption Key Recovery in Tape Libraries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In information handling systems, particularly in data storage systems with multiple recording media, the loss of partition information associated with key managers leads to significant time consumption in manually identifying and recovering encryption keys, making the encrypted data unrecoverable until proper association is restored.
Innovation Solution
An automated encryption key recovery method that involves requesting a key from a primary key manager associated with each drive, providing a key identifier, and storing identifying information in memory if the key is provided, thereby automating the process of determining the key manager and partition associated with each recording medium.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If manual methods are used to identify and recover encryption keys for each recording medium, then the process can be completed with simple system architecture, but the recovery time becomes excessively long and productivity decreases
Solution Approach 1:
The system performs self-identification of key manager associations by automatically cycling through drives and testing key retrieval without human intervention. The storage system autonomously determines which key manager is associated with each recording medium by attempting key retrieval operations and storing the results, eliminating the need for manual identification while maintaining reasonable system architecture.
Solution Approach 2:
The system pre-establishes associations between recording media and key managers by storing identifying information in memory during the recovery process. This preliminary action creates a lookup table that enables future key retrieval operations to be performed quickly without repeating the full identification process, thereby improving recovery speed for subsequent operations.
2Reliability
If partition information is lost in a tape library, then data security is maintained through encryption, but the encrypted media becomes unreadable and recovery time increases significantly
Solution Approach 1:
The system introduces an intermediary identification layer that stores key manager association information in memory separate from the encrypted data. When partition information is lost, this intermediary storage contains the mapping between recording media and key managers, allowing the system to recover access without compromising the encryption security of the stored data.
Solution Approach 2:
The system segments the key management function from the data storage function by using separate key managers for different partitions and storing identification information separately in memory. This segmentation allows the identification layer to be recovered independently from the encrypted data, enabling faster recovery while maintaining security through the preserved separation of keys and data.
3Reliability
If multiple key managers are used for different partitions in a tape library, then data security and access control are improved, but the complexity of managing and recovering keys increases
Solution Approach 1:
The system creates a universal identification mechanism that works across multiple key managers and partitions. The identifying information stored in memory serves as a universal lookup key that can resolve associations regardless of which specific key manager is involved, simplifying the management interface while maintaining the security benefits of multiple key managers.
Solution Approach 2:
The system creates a copy of the key manager association information in memory that can be queried without accessing the actual key managers. This copying mechanism allows the system to manage multiple key managers through a single unified interface, reducing the apparent complexity while maintaining the security and access control benefits of the multi-key-manager architecture.
Data Source
AI summary
An information handing system provides a method for recovering encryption keys. The method includes providing a first recording medium of a plurality of recording media in a first drive of a plurality of drives. A first key is requested from a primary key manager (PKM) associated with the first drive, wherein the first drive provides a first key identifier (ID) to the PKM. If it is determined that the PKM provides the first key corresponding to the first key ID, a first identifying information for the PKM is stored in a memory for the first recording medium.