DATA PROTECTION IN A STORAGE SYSTEM USING EXTERNAL SECRETS

摘要

A system, method, and computer-readable storage medium for protecting a set of storage devices using a secret sharing scheme in combination with an external secret. An initial master secret is generated and then transformed into a final master secret using an external secret. A plurality of shares are generated from the initial master secret and distributed to the storage devices. The data of each storage device is encrypted with a device-specific key, and this key is encrypted using the final master secret. In order to read the data on a given storage device, the initial master secret reconstructed from a threshold number of shares and the external secret is retrieved. Next, the initial master secret is transformed into the final master secret using the external secret, and then the final master secret is used to decrypt the encrypted key of a given storage device.

主权项

1. A computing system comprising a plurality of storage devices, wherein the computing system is configured to:
generate a plurality of shares from an initial master secret; store one or more shares on one or more storage devices of the plurality of storage devices; transform the initial master secret into a final master secret using one or more external secrets, wherein the one or more external secrets are stored separately from the computing system; and utilize the final master secret to encrypt at least a portion of data stored on each storage device of the plurality of storage devices.