Storage system with data-dependent security

Abstract

A host-independent storage facility selectively provides data-dependent security by initially storing a security key in association with a storage region, where that key must be presented by any host seeking access to the region. The storage system includes a storage controller coupled to a digital data storage and one or more hosts. Initially, the controller receives a set-access-key command from one of the hosts, identifying a storage region, an operation parameter identifying prohibited types of storage operations, and a reference access key. The controller stores the access key and the operation parameter in a reference location associated with the identified storage region. Later, the controller may receive storage access requests from the hosts. Requests include an identification of a requested storage region, an access type, and an input access key. In response, the controller retrieves the reference access key and operation parameter associated with the requested storage region. If the requested access type is not prohibited by the operation parameter, the controller executes the storage access request. Also, if the requested access type is prohibited by the retrieved operation parameter, the controller nonetheless executes the storage access request if the input and reference access keys match.