Encryption is also enabled on the operational path at the host port

Abstract

The host port is enabled for security. In response to determining that the audit mode indicator has been enabled to allow input / output (I / O), the host port performs plain text I / O on a path between the host port and the storage port, even if authentication or security association negotiation between the host port and the storage port cannot be successfully completed. Concurrently with performing the plain text I / O on the path, the host port enables encryption of data for the I / O on the path.

Description

Technical Field

[0001] The present invention generally relates to enabling encryption simultaneously on an operational path at a host port. Background Art

[0002] Fibre Channel refers to an integrated set of architectural standards for data transmission developed by the American National Standards Institute (ANSI). Security solutions for the Fibre Channel architecture are provided by the Fibre Channel Security Protocol (FC-SP) developed by ANSI. FC-SP provides mechanisms for device authentication, per-message security, policy distribution, etc. in a Fibre Channel environment. Further details of FC-SP are provided in the publication "Fiber Channel Security Protocol-2 (FC-SP-2)" (Revision 2.71) published by ANSI on June 12, 2012.

[0003] FC-LS-4 provides mechanisms for link services in Fibre Channel and further details are provided in the ANSI publication “Fiber Channel Link Services (FC-LS-4)” (Revision 4.04), dated July 16, 2019. FC-FS-5 provides mechanisms for framing and signaling in Fibre Channel and further details are provided in the ANSI publication “Fiber Channel Framing and Signaling-5 (FC-FS-5)” (Revision 1.0), dated April 3, 2018.

[0004] In a Fibre Channel environment, in order to provide secure and encrypted communications between nodes in a Fibre Channel architecture, a security association (SA) management transaction is performed between an SA_Initiator and an SA_Responder using a security establishment protocol. The initiator and responder may include ports in an adapter in a device in a Fibre Channel network. Separate security associations are established for data transmission and data reception at the port. Completion of the SA establishment transaction results in a set of security associations and associated key materials, which are used to encrypt / decrypt data communications between the initiator and the responder under the established security association. An example of a security association protocol is the security association management protocol in FC-SP-2. The protocol includes a pair of messages SA_Init and SA_Init Response to establish a parent association, followed by a pair of messages SA_Auth and SA_AuthResponse to perform authentication of entities and establish a security association to protect data transmitted between entities.

[0005] The storage controller can control access to the storage of one or more host computing devices, which can be coupled to the storage controller via a Fibre Channel network. A storage management application executed in the storage controller can manage multiple storage devices coupled to the storage controller, such as disk drives, tape drives, flash drives, direct access storage devices (DASD), etc. The host computing device can send input / output (I / O) commands to the storage controller, and the storage controller can execute the I / O commands to read data from the storage device or write data to the storage device. Communication between the host and the storage controller occurs via Fibre Channel ports on adapters located in the host and the storage controller.

[0006] US Patent Publication 20100154053 discusses a storage security mechanism using password splitting. US Patent Publication 20190251282 discusses a network security mechanism for transmitting data between servers. US Patent Publication 20160139845 discusses storage-level access control for data packet structures. US Patent Publication 20160378691 discusses a mechanism for protecting storage devices from attacks. US Patent 8275950 discusses a fiber channel-attached storage controller that can use a login request control table to manage a one-to-one correspondence of ports of a host computer and a storage controller to prevent any unauthorized access attempts from the host computer on a port-by-port basis, thereby maintaining enhanced security. US Patent 6219771 discusses a data storage device with improved security processing and partition allocation functions. US Patent Publication 20040107342 discusses a secure network file access control system. European Patent Application EP1276034A2 discusses the security of logical units in a storage subsystem. US Patent Publication 20160342798 discusses a system and method for protected device management. US Patent 8,799,436 discusses a system and method for auditing and validating configuration items in an information technology (IT) configuration management database.

[0007] US Patent 6832313 describes a system including a central computer and a remote computer that can communicate over a link and transfer from plaintext work to encrypted work when the computer receives and installs a long-term key required for encrypted communication. US Patent 8250625 describes a method for reducing downtime of a communication system when cryptographic operations of a cryptographic system of the communication system are enabled, wherein the cryptographic system includes a first cryptographic device operatively coupled to a plurality of second cryptographic devices via a communication network of the communication system. Summary of the invention

[0008] A method, system, and computer program product are provided in which a host port is enabled for security. In response to determining that an audit mode indicator has been enabled to allow input / output (I / O), the host port performs plaintext I / O on a path between the host port and a storage port, even if authentication or security association negotiation between the host port and the storage port cannot be successfully completed. Concurrently with performing plaintext I / O on the path, the host port enables encryption of data for the I / O on the path. As a result, in embodiments where the audit mode indicator is enabled, a mechanism for transitioning from plaintext data to encrypted data is provided.

[0009] In certain embodiments, simultaneously enabling encryption of data includes initiating a security association SA management transaction between the host port and the storage port. As a result, a mechanism is provided that allows embodiments to be implemented in conjunction with a Fibre Channel Security Association.

[0010] In a further embodiment, the host port is programmed with key material for the exchange of encrypted data and an allow plaintext indicator configured to allow exchange of plaintext data on the path simultaneously with exchange of encrypted data on the path. As a result, encrypted data from certain points in time is allowed.

[0011] In some embodiments, in response to the allow plaintext indicator being configured to allow exchange of plaintext data on the path simultaneously with exchange of encrypted data on the path, the host port is configured for both plaintext reception and for reception of encrypted data using the key material. As a result, a new indicator is used to allow mixing of plaintext and encrypted data.

[0012] In a further embodiment, in response to the host port determining that all plaintext reception has completed due to the expiration of a timer after a security association has been activated for transmission, the host port is programmed to no longer process plaintext data. As a result, a transition from mixed plaintext and encrypted data to encrypted data only occurs.

[0013] In some further embodiments, the timer expires after a timeout period that is sufficient to flush the plaintext data of the path that has been queued for transmission when the transmission of the encrypted data begins on the path. As a result, sufficient time is allowed to complete all queued plaintext I / O.

[0014] In a further embodiment, when both plaintext data and encrypted data are exchanged in the path during a predetermined period of time indicated by the timer, no I / O error is generated.As a result, the audit mode is integrated into the Fibre Channel without causing I / O errors. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Referring now to the drawings, wherein like reference numerals designate corresponding parts throughout:

[0016] Figure 1 A block diagram of a heterogeneous computing environment including multiple hosts communicating with multiple storage controllers and / or storage devices via a Fibre Channel fabric is shown according to some embodiments;

[0017] Figure 2 A block diagram of a system for maintaining access of a host for security enablement in a heterogeneous computing environment is shown in accordance with certain embodiments;

[0018] Figure 3 A block diagram illustrating security bits for logging into Fibre Channel and enhancements to Fibre Channel via an audit mode indicator is shown in accordance with certain embodiments;

[0019] Figure 4 shows a block diagram illustrating login and response in Fibre Channel according to some embodiments;

[0020] Figure 5 A block diagram is shown according to certain embodiments, which illustrates enhancements to Fibre Channel to provide indications of "enforce security" and "enable security" via an enabled or disabled audit mode indicator;

[0021] Figure 6 A flow chart illustrating the operation of a storage port that enforces security according to certain embodiments is shown;

[0022] Figure 7 A flow chart illustrating the operation of a security-enabled storage port according to certain embodiments is shown;

[0023] Figure 8 shows a block diagram illustrating conditions that prevent authentication and security association management from successfully completing according to certain embodiments;

[0024] Fig. 9 shows a block diagram illustrating logging into multiple host ports into a single storage port according to certain embodiments;

[0025] Fig.10 A flow chart illustrating operations in a storage device for determining whether to change a storage port to a forced security state is shown according to certain embodiments;

[0026] Fig.11 A flow chart illustrating operations for maintaining access for security enablement on a host system is shown in accordance with certain embodiments;

[0027] Fig.12A flow chart illustrating additional operations for maintaining access for security enablement on a host system is shown in accordance with certain embodiments;

[0028] Fig.13 A flow chart illustrating operations for maintaining access for security enablement in a storage device is shown in accordance with certain embodiments;

[0029] Fig.14 A flow chart illustrating additional operations for maintaining access for security enablement in a storage device is shown according to certain embodiments;

[0030] Fig.15 shows a block diagram according to certain embodiments, which illustrates, in an embodiment where audit mode has been enabled, a transition from plain text I / O to encrypted I / O after authentication and security association have been successfully completed;

[0031] Fig.16 A block diagram showing a data structure for a grace period to allow plain text I / O to continue when encrypted I / O begins on a path according to some embodiments;

[0032] Fig.17 shows a block diagram illustrating the start of plaintext I / O on a path according to some embodiments;

[0033] Fig.18 shows a block diagram showing the flow on a path from "plain text I / O" to "mixed plain text I / O and encrypted I / O" to "encrypted I / O" according to some embodiments;

[0034] Fig.19 A flow chart illustrating operations for simultaneously enabling encryption on an operational path at a host port is shown in accordance with certain embodiments;

[0035] Fig. 20 A flow chart illustrating operations for simultaneously enabling encryption on an operational path at a storage port is shown in accordance with certain embodiments;

[0036] Fig.21 A block diagram of a cloud computing environment according to some embodiments is shown;

[0037] Fig. 22 According to some embodiments, Fig.21 A block diagram of the cloud computing environment with further details; and

[0038] Fig.23 A block diagram of a computing system according to some embodiments is shown, which shows that the computing system may include Figure 1-22 Specific units in the host, storage controller, and storage device described in. DETAILED DESCRIPTION

[0039] In the following description, reference is made to the accompanying drawings which form a part hereof and which illustrate various embodiments. It is understood that other embodiments may be utilized and that structural and operational changes may be made.

[0040] The standard for encrypting Fibre Channel links (FC-SP-2) includes a protocol for mutual authentication of two endpoints (i.e., ports) and a protocol for negotiating encryption keys used in a communication session between the two endpoints. The standard provides support for various mechanisms to authenticate the parties involved and mechanisms to provision or develop key material.

[0041] In the FC-SP-2 standard, support for authentication within an endpoint is indicated by the setting of the security bit of the common service parameters passed to the peer during the login process. When set to a value of 1 in a login request, the security bit indicates that the sending port is able to perform authentication. When a responding port accepts a login request, if the responding port also sets the security bit to 1 in the reply, this indicates that the responding port requires the sender of the login to now perform authentication before granting any further access.

[0042] The FC-SP-2 standard specifies the behavior of a responding endpoint in accepting or rejecting a login request and setting the security bit based on the security policy in effect at the endpoint when the request is received. The standard does not specify how the policy is instantiated at the responding endpoint. In an enterprise data center, attention needs to be paid to protecting access to data as well as providing security for the data. When security is enabled in a heterogeneous environment that includes some systems and storage ports that do not support security (e.g., legacy ports), certain embodiments provide mechanisms to ensure that connectivity is not lost, in contrast to current standards that do not allow for such mechanisms.

[0043] Certain embodiments provide a mechanism for enabling security at the host in an "audit mode" in which host access to data is not lost when security is enabled in a storage device. An indication is provided at logon by setting an audit mode indicator that allows the host port to continue to access the storage port after security is enabled. Once authentication and enabling of the security mechanism are verified to have been successfully completed, enabling security can be changed to enforcing the security policy. Enabling security means that I / O can be performed even if authentication and enabling of the security mechanism are not successfully completed, while enforcing security means that I / O cannot be performed if authentication and enabling of the security mechanism are not successfully completed. While in audit mode, the host can continue to access the storage device, and tools are provided to audit the security status of the connection.

[0044] Certain embodiments provide a mechanism in which a host determines that an authentication and / or security association with a storage device cannot be successfully completed, and then uses an audit mode indicator to check whether security is not enforced on a storage port. If the audit mode indicator is set, the host processor continues to send I / O operations to the storage device along the selected port. If the audit mode indicator is not set, the host processor stops the I / O operation to the storage device and notifies the host application or operating system to find an alternative path to complete the I / O operation.

[0045] Additionally, in Fibre Channel, many host ports can log in (as described in FC·FS·5) to a single storage port. Some of these host ports may support security and some may not. If the port settings are set to force security, host ports that do not support security may lose access to the storage port because these host ports are not allowed to log in.

[0046] In some embodiments, information is provided by the storage device to show the number of logins currently on each port of the storage device. For the number of logins, the storage device provides the number of logins with security capabilities, and the number of logins that are successfully authenticated and enable security. Based on this information, it can be determined whether access to the port may be lost if the storage port setting is changed to mandatory security. Once it is determined that all logins are safe, the setting can be changed without losing access because all host ports can successfully enable security. In some embodiments, when it is desired to change the setting to mandatory security, the storage device checks the login counter to determine whether access loss may occur (i.e., there is a login that is not successfully authenticated) and prevents the setting from being changed to mandatory security.

[0047] Certain embodiments provide a storage port that supports enabling security without a mandatory setting and provides auditable statistics (e.g., login counts, security-capable login counts, and security-enabled login counts) to determine the impact of setting security to mandatory. An audit mode indicator is set in a login response to a host port, indicating that I / O can be sent to the storage port even if authentication cannot be successfully completed. The enabling or mandatory setting of security can be performed on a storage array or on an individual storage port basis.

[0048] In some embodiments, a setting for mandatory security is provided, which has an automatic check for a login indicator to prevent the setting from being changed in the event of a possible loss of access. An option to force the setting to mandatory security regardless of the login indicator is also provided.

[0049] As a result, in the enhancement of Fibre Channel based connectivity environments, improvements have been made to devices to maintain connectivity for performing I / O.

[0050] The above-described embodiments enable security at the host in an audit mode, wherein the host access to data is not lost when security is enabled on a storage device. An indication is provided at logon that allows the host port to continue to access the storage port after security is enabled. Access without an encrypted security association means that the host port and the storage port may be exchanging data in plain text, wherein exchanging data in plain text means that the data exchanged is not encrypted, and data exchanged in plain text is referred to as "plain text" data.

[0051] When a security association is successfully created to enable encryption, the host port and storage port need to be able to transition from exchanging plaintext data to exchanging "encrypted" data, where encrypted data refers to data that is encrypted. There is a transition period during which both plaintext data and encrypted data flow on the link between the host port and the storage port, and certain embodiments ensure that such a condition does not result in an error being detected by the mandatory security rules set by the security association.

[0052] Certain embodiments provide a mechanism for a host system to transition from exchanging plain text to exchanging encrypted data. Such embodiments also provide a mechanism for a storage port to transition from exchanging plain text to exchanging encrypted data. As a result, in an enhancement to a Fibre Channel-based connectivity environment, further improvements are made to devices to maintain connectivity for performing I / O.

[0053] Example implementation of audit mode

[0054] Figure 1 A block diagram 100 of a heterogeneous computing environment is shown according to some embodiments, the heterogeneous computing environment including multiple hosts 102, 104 communicating with multiple storage controllers and / or storage devices 108, 110 via a Fibre Channel fabric 106. The storage controllers and storage devices are both shown by reference numerals 108, 110, and the hosts 102, 104 may communicate with a storage controller that controls the storage devices, or may communicate with the storage devices without involving any storage controller. A storage controller may also be considered a high-level type of storage device because it controls and allows one or more hosts to access one or more storage devices.

[0055] Hosts 102, 104 and storage controllers 108, 110 may include any suitable computing devices, including those currently known in the art, such as personal computers, workstations, servers, mainframes, handheld computers, palmtop computers, telephone devices, network devices, blade computers, processing devices, controllers, etc. Storage devices may include storage devices currently known in the art, such as hard disk drives, tape drives, solid-state drives, etc.

[0056] The hosts 102, 104 and the storage devices 108, 110 may be elements in any suitable network (e.g., a storage area network, a wide area network, the Internet, an intranet). In some embodiments, the hosts 102, 104 and the storage devices 108, 110 may be elements in a cloud computing environment. The connection between the hosts 102, 104 and the storage devices 108, 110 in the network and / or cloud computing environment may be through a Fibre Channel fabric 106.

[0057] The host may include one or more host ports. For example, host 102 includes multiple host ports 112, and host 104 includes multiple host ports 114. The storage device may include multiple storage ports. For example, storage device 108 includes multiple storage ports 116, and storage device 110 includes multiple storage ports 118. Host ports 112, 114 and storage ports 116, 118 may communicate via Fibre Channel fabric 106.

[0058] In some embodiments, not all hosts support security of host ports. For example, some legacy hosts may not support security of host ports in Fibre Channel, or some legacy adapters in the hosts may not support security of host ports in Fibre Channel. For example, host 102 is shown as supporting security of host ports, while host 104 is shown as not supporting security of host ports.

[0059] In certain embodiments, certain storage devices may enable one or more storage ports to be configured to have security enabled with enforcement (i.e., I / O may not occur from a host port to a storage port unless a secure connection has been verified as being completed between the host port and the storage port). In certain embodiments, certain storage devices may enable one or more storage ports to be configured to have security not enabled without enforcement (i.e., I / O may occur from a host port to a storage port even if a secure connection has not been verified as being completed between the host port and the storage port). For example, the storage device 108 may have security enabled with enforcement for at least one of the storage ports 116 (other storage ports in the storage device 108 may have security enabled without enforcement). Figure 1 , the storage device 110 may have enabled security without enforcement for at least one of the storage ports 118 (other storage ports in the storage device 110 may have enabled security with enforcement).

[0060] therefore, Figure 1 Certain embodiments are shown that allow I / O operations to be sent from a host port to a storage port even if authentication or security association negotiation between the host port and the storage port cannot be successfully completed.

[0061] Figure 2A block diagram 200 of a system for maintaining access of a host 202 for security enablement in a heterogeneous computing environment is shown in accordance with certain embodiments.

[0062] The host 202 is communicatively coupled to a plurality of storage devices 204, 206 via a Fibre Channel fabric 208. The storage device 204 has security enabled with enforcement for a storage port 210 of the storage device 204, and the storage device 206 has security enabled without enforcement for a storage port 212 of the storage device 206. In some embodiments, a storage port may be changed from enabling security without enforcement to enabling security with enforcement, or vice versa.

[0063] The host 202 includes a host port 214, wherein the host port 214 communicates with the storage ports 210, 212. Figure 2 In the illustrated embodiment, even if the authentication or security association negotiation between the host port 214 and the storage port 212 cannot be successfully completed, the host port 214 can still send I / O to the storage port 212 because the storage port 212 has security enabled without enforcement. However, if the authentication or security association negotiation between the host port 214 and the storage port 210 cannot be successfully completed, the host port 214 cannot send I / O to the storage port 210 because the storage port 210 has security enabled with enforcement.

[0064] In the event that the host port 214 is unable to send an I / O operation to the storage port, the operating system 216 of the host 202 attempts to send the I / O operation via another mechanism.

[0065] Figure 3 A block diagram 300 is shown according to some embodiments, illustrating security bits 302 for logging in the current Fibre Channel standard and enhancements to Fibre Channel via an audit mode indicator 304. The audit mode indicator 304 may be enabled (reference numeral 306) or not enabled (reference numeral 308).

[0066] It should be noted that the audit mode indicator 304 is not found in existing Fibre Channel standards. The enabling of the audit mode indicator 304 allows for enabling security without enforcement to work in conjunction with the configuration of the security bit 302.

[0067] In some embodiments, the audit mode indicator 304 is enabled via an indication in the auxiliary parameter data word 0 bit 23 in a program implementing the Fibre Channel Link Service (FC-LS-4). In other embodiments, other mechanisms may be provided for implementing the audit mode indicator 304. The audit mode indicator 304 and the security bit 302 may be part of one or more data structures used to perform operations.

[0068] Figure 4 A block diagram 400 illustrating logins and responses in Fibre Channel is shown according to some embodiments. A host port 402 sends a login request 404 to a storage port 406. The host port 402 is also referred to as a "sending port" and the storage port 406 is also referred to as a "receiving port."

[0069] In the login request 404 from the host port 402, the security bit 302 is set to 1 to indicate that the sending port (ie, the host port 402) is capable of performing authentication.

[0070] Upon receiving the login request 404, the storage port 406 sends a response 408 to the host port 402. The response 408 from the storage port 406 may set the security bit 302 to 1 to indicate that the receiving port (i.e., the storage port 406) requires the sending port (i.e., the host port 402) to now perform authentication before granting any further access.

[0071] In some embodiments, even if security bit 302 is set to 1 in a response, if audit mode indicator 304 is enabled (ie, set) to indicate that security is enabled without enforcement, the requirement to complete authentication before any further access is granted is overridden.

[0072] Figure 5 A block diagram 500 is shown that illustrates enhancements to Fibre Channel to provide an indication of “security enforced” and “security enabled” via an audit mode indicator 304 that is enabled or not enabled, in accordance with certain embodiments.

[0073] The receiving port (e.g., a storage port in a storage device) provides an indication in a response to a login request issued from the host (as shown via reference numeral 502). The indication may be provided via configuration of an audit mode indicator 304. Configuration of an enabled audit mode indicator 304 may cause the state of the storage port to be changed to "security enabled" 504, which means that security is enabled without enforcement. Configuration of a non-enabled audit mode indicator 304 may cause the state of the storage port to be changed to "security enforced" 506, which means that security is enabled with enforcement.

[0074] Figure 6A flow chart 600 showing the operation of a storage port that enforces security according to certain embodiments is shown. Control proceeds to block 604, where authentication and security association management is initiated between the host port and the storage port. Control proceeds to block 606, where it is determined whether authentication and security association management have been successfully completed between the host port and the storage port. If so ("yes" branch 608), control proceeds to block 610, where the host port is allowed to begin performing I / O through the storage port (at block 610). If not ("no" branch 612), control proceeds to block 614, where the host port is blocked from performing I / O through the storage port.

[0075] Figure 7 A flow chart 700 illustrating the operation of a security-enabled storage port is shown in accordance with certain embodiments.

[0076] Control begins at block 702, where security is enabled for the storage port. Control proceeds to block 704, where authentication and security association management is initiated between the host port and the storage port. The host port is allowed to perform I / O through the storage port (block 706), regardless of whether the authentication and security association management operation is successful or unsuccessful (at block 708). In different embodiments, the time to begin allowing I / O may be different.

[0077] Figure 8 A block diagram 800 is shown illustrating conditions that prevent authentication and security association management from successfully completing, in accordance with certain embodiments.

[0078] The first condition 802 is an incomplete configuration of a security policy, which may prevent authentication and security association management from being successfully completed. The second condition 804 includes an inaccessible key server that provides credentials for accessing the storage device, which may prevent authentication and security association management from being successfully completed. The third condition 806 is a failure in an authentication and security association management exchange, which may prevent authentication and security association management from being successfully completed. All of these conditions may result in authentication and security association management failing. Figure 6 and 7 The indicated operation could not be completed successfully.

[0079] Fig. 9 A block diagram 900 is shown showing multiple host ports 902, 904, 906 logging into a single storage port 908, in accordance with certain embodiments. The single storage port 908 may be included in a storage device or storage controller 910, which may have other storage ports.

[0080] exist Fig. 9In FIG. 1 , host ports 902 and 906 support security, while host port 904 does not support security because host port 904 may be included in a legacy adapter or a legacy host, or for some other reason (including configuration by an administrator).

[0081] The storage device or storage controller 910 maintains statistics about login counters and login characteristics, which are referred to as login indicators (reference numeral 912). The statistics include: the number of current logins to the storage port (reference numeral 914); the number of security-capable login counts to the storage port (reference numeral 916); and the number of security-enabled login counts to the storage port (reference numeral 918). Security-enabled logins are those that have been successfully authenticated and have security enabled.

[0082] In some embodiments, if the forced security mode is configured, the statistics 912 about the login counter and login characteristics are used by the storage device or storage controller 910 to determine the impact on the host's I / O access. In additional embodiments, the statistics 912 about the login counter and login characteristics are used by the storage device or storage controller to prevent switching from the enabled security mode to the forced security mode if the host would lose I / O access if switching to the forced security mode.

[0083] In further embodiments, the storage device or storage controller 910 provides an option 920 for forcibly switching to a mandatory security mode without regard to the statistics 912 regarding login counters and login characteristics.

[0084] Fig.10 A flow chart 1000 is shown illustrating operations in a storage device for determining whether to change a storage port to a forced security state, according to some embodiments.

[0085] Control begins at block 1002, where the storage device determines that multiple host ports have performed logins to the storage port of the storage device. Control proceeds to block 1004, where the storage device maintains statistics about the login counter and the login characteristics. If the setting of the storage port is changed to mandatory security, the storage device determines (at block 1006) whether any host port will lose access to the I / O of the storage device based on the login counter and the login characteristics. If so ("yes" branch 1008), not all host port logins are secure (i.e., not all host ports are successfully authenticated), and control proceeds to block 1010, where the setting that blocks the storage port is changed to mandatory security.

[0086] If in box 1006, the storage device determines based on the login counter and login characteristics that no host port will lose access to the I / O of the storage device if the setting of the storage port is changed to enforced security ("No" branch 1012), then all host port logins are secure (i.e., all host ports are successfully authenticated) and control passes to box 1014, where the setting of the storage port is allowed to be changed to enforced security.

[0087] Fig.11 A flow diagram 1100 is shown illustrating operations for maintaining access for security enablement on a host system in accordance with certain embodiments.

[0088] Control begins at block 1102 where a host port is enabled for security. The host port determines (at block 1104) that authentication or security association negotiation with the storage port could not be successfully completed.

[0089] In response to the host port determining that authentication or security association negotiation with the storage port cannot be successfully completed, the host port determines (at block 1106) whether an audit mode indicator has been enabled in a login response from the storage port. The host port maintains input / output (I / O) access to the storage port based on determining whether the audit mode indicator has been enabled in the login response from the storage port. As a result, the host port is able to perform I / O via the storage port even if authentication or security association negotiation with the storage port cannot be successfully completed.

[0090] In response to determining that the audit mode indicator has been enabled in the login response from the storage port ("yes" branch 1108), the host port performs (at block 1110) I / O to the storage port. Performing I / O to the storage port means sending an I / O operation to the storage port to perform the I / O operation, wherein data is read or written or accessed. As a result, when the audit mode indicator has been enabled, the host port performs I / O via the storage port even if authentication or security association negotiation with the storage port cannot be successfully completed.

[0091] In response to determining that the audit mode indicator is not enabled in the login response from the storage port ("no" branch 1112), the host port refrains (at block 1114) from performing I / O to the storage port. As a result, if authentication or security association negotiation with the storage port cannot be successfully completed and the audit mode indicator has not been enabled, the host port does not perform I / O via the storage port. Control proceeds from block 1114 to block 1116, where the host port returns the I / O request to the operating system of the host computing device. As a result, if authentication or security association negotiation with the storage port cannot be successfully completed and the audit mode indicator has not been enabled, an alternative mechanism for performing I / O is attempted.

[0092] Fig.12 A flow chart 1200 is shown illustrating additional operations for maintaining access for security enablement on a host system, in accordance with certain embodiments.

[0093] If the host port cannot access the key server to obtain credentials for authenticating to the storage port, the host port determines (at block 1202) that the authentication or security association negotiation with the storage port cannot be successfully completed. As a result, the host port may take further action to determine the state of the audit indicator to determine whether to send an I / O request to the storage port.

[0094] Control proceeds from block 1202 to block 1204 where the host port determines that the authentication or security association negotiation with the storage port cannot be successfully completed if there is a failure in the process for authentication or security association negotiation with the storage port. As a result, the host port may take further action to determine the state of the audit indicator to determine whether to send an I / O request to the storage port.

[0095] Fig.13 A flow chart 1300 illustrating operations for maintaining access for security enablement in a storage device is shown in accordance with certain embodiments.

[0096] Control begins at block 1302 where a storage port receives a login request. Control may proceed from block 1302 to block 1304 or block 1306.

[0097] In block 1304, the storage port configures the audit mode indicator to be enabled in a login response to the host port to enter a security enabled mode to indicate to the host port that input / output (I / O) operations will be sent from the host port to the storage port even if authentication or security association negotiation with the storage port cannot be successfully completed. As a result, an unsecured host can perform I / O to the storage device.

[0098] In block 1306, if the authentication or security association negotiation with the storage port cannot be successfully completed, the storage port configures the audit mode indicator to be not enabled in the login response to the host port to enter the mandatory security mode to indicate to the host port that I / O operations will not be sent from the host port to the storage port. As a result, the unsecured host cannot perform I / O to the storage device.

[0099] Fig.14 A flow chart 1400 is shown for additional operations for maintaining access for security enablement in a storage device.

[0100] Control begins at block 1402, where a storage controller including a storage port maintains statistics about login counters and login characteristics, the statistics including: the number of current logins to the storage port; the number of security-capable login counts to the storage port; and the number of security-enabled login counts to the storage port. As a result, in some embodiments, if a security enforcement mode is configured, the statistics about the login counters and login characteristics are used by the storage controller to determine the impact on I / O access to the host.

[0101] In an additional embodiment, if the host would lose I / O access when switching to the forced security mode, the statistics about the login counter and the login characteristics are used by the storage controller to prevent (at block 1404) switching from the enabled security mode to the forced security mode. As a result, if the host would lose I / O access, the switch to the forced security mode is prevented.

[0102] In certain embodiments, the storage controller provides an option to force a switch to an enforced security mode without regard to statistics regarding login counters and login characteristics.

[0103] In some embodiments, the storage controller configures at least one storage port of the plurality of storage ports to a forced security mode. The storage controller configures at least another storage port of the plurality of storage ports to an enabled security mode. Thus, the enabling of the audit mode indicator is on a per-port basis.

[0104] In another embodiment, the storage port is included in a storage controller, the storage controller includes a first storage array and a second storage array, wherein the forced security mode is configured for the first storage array, and wherein the enabled security mode is configured for the second storage array. Thus, the enabling of the audit mode indicator is based on each storage array.

[0105] therefore, Figure 1-14 Certain embodiments are shown that enforce or do not enforce security based on the configuration of the audit mode indicator to enhance operation based on the configuration of the security bits in the Fibre Channel. As a result, legacy devices can continue I / O in a heterogeneous computing environment even when the security bits are enabled in the Fibre Channel.

[0106] Exemplary Embodiments for Plaintext to Encrypted Data Conversion

[0107] In Fibre Channel, to enable encryption on a link, a security association (SA) establishment protocol is used to establish an SA between an SA initiator and an SA responder. An example of an SA initiator is a Fibre Channel initiator (e.g., host port 112, 114) in a host bus adapter (HBA) of a host computing device 102, 104. An example of an SA responder is a Fibre Channel target port (e.g., storage port 116, 118) in a storage controller 108, 110. In Fibre Channel, separate security associations are established for data transmission and data reception at a port.

[0108] The SA establishment protocol includes a series of messages passed between two entities (eg, a host port and a storage port in a Fibre Channel SAN). An example of such a protocol is the Security Association Management Protocol in the Fibre Channel Security Protocol standard FC-SP-2.

[0109] The protocol includes a pair of messages SA_Init and SA_Init Response to establish a parent association, followed by a pair of messages SA_Auth and SA_Auth Response to perform authentication of the entities and establish a security association that protects data transmitted between the entities.

[0110] The first time an SA establishment protocol (e.g., Fibre Channel N_Port login) is executed on a path, a first set of security associations (SA1) is established. This set of security associations includes send key material (K1t) and receive key material (K1r). The key material may include both a key and a SALT (a SALT is random data that is used as an additional input to a one-way function that "hashes" the data used in the encryption mechanism) and is referred to simply as a key throughout the disclosure. Note that each side has a set of "send key material" (K1t) that is equivalent to the "receive key material" (K1r) on the other side.

[0111] At certain points in the protocol, the port is programmed to begin allowing data to be received using K1r and data to be transmitted using K1t. In some embodiments, these points in the protocol are chosen so that the receive key K1r is programmed before another port in the association can begin data transmission using that key.

[0112] After the SA_Auth message is verified, programming of the new key to the port for receiving data is completed. For the target (e.g., a storage port), this is after processing the SA_Auth request message. For the initiator (e.g., a host port), this is when the SA_Auth response is received. After the authentication transaction is successfully completed, the queuing of I / O requests to send data begins using the new SA1. For the target, this can be done only after the initiator has received the SA_Auth Response. When the target receives the LS_ACC Extended Link Service (ELS) response, it is confirmed that the SA_Auth Response is received at the initiator. For the initiator, this occurs upon receipt of Auth_Done.

[0113] After the SA establishment operation is complete, both the initiator port and the target port have begun queuing I / O for transmission using the new transmission key. However, in some embodiments, before the SA is established using plaintext I / O, there may still be I / O queued for transmission in the queue or in the SAN. In order to avoid reception errors, the port continues to allow plaintext reception for a certain period of time before SA1 encryption can be forced. This period of time is provided by a timer that can be called a "plaintext grace period timer". The timer is set to expire after a predefined predetermined period of time (e.g., 2 seconds).

[0114] When transitioning from plaintext to encryption, in some embodiments, when programming the security association for receiving data, an "allow plaintext indicator" is enabled and provided to the data receiver. This indicator indicates to the data receiver (or the firmware controlling the data receiver) that a mix of encrypted and unencrypted data frames is allowed.

[0115] At some point, once it has been verified that all plaintext I / O has been flushed from the system, the data receiver is reprogrammed to reset the allow plaintext indicator. At this point, the data receiver is allowed to receive encrypted data, but not plaintext data. This can be achieved by waiting for the timer to expire since the SA1 security key material has been activated for data transmission.

[0116] Fig.15 Block diagram 1500 is shown illustrating a transition from clear text I / O to encrypted I / O after authentication and security association have been successfully completed in an embodiment where audit mode has been enabled, in accordance with certain embodiments.

[0117] exist Fig.15 , arrow 1502 represents the passage of time when performing I / O on the path between the host port and the storage port. In other words, time increases in the direction pointed by the arrow.

[0118] Initially, plaintext I / O (i.e., unencrypted I / O) 1504 is sent over the path established between the host port and the storage port. Once authentication and security association are successfully completed (reference numeral 1506), encrypted I / O is then performed 1506. However, there are overlapping periods (shown via reference numeral 1508) where both plaintext I / O and encrypted I / O are performed simultaneously (i.e., plaintext and encrypted I / O are interspersed with each other). In some embodiments, plaintext I / O is allowed to continue for a predetermined period of time to complete I / O that was queued but not sent prior to successful completion of authentication and security association.

[0119] Fig.16 Block diagram 1600 shows a data structure for a grace period that allows plain text I / O to continue when encrypted I / O begins on a path, according to some embodiments.

[0120] Apart from Figure 3 In addition to the security bit 302 and the audit mode indicator 304 described in the foregoing, an allow plaintext indicator 1602 and a plaintext grace period timer 1604 are provided. The allow plaintext indicator 1602, when enabled (e.g., by being set to a value of 1), allows encrypted and plaintext data to be intermixed on a path, even after successful completion of authentication and security association. The plaintext grace period timer 1604 indicates a time period (e.g., 2 seconds) during which plaintext data is allowed on a path after encrypted data is allowed on the path. This time period is sufficient to flush out plaintext data that has been queued when encrypted I / O begins on the path.

[0121] Fig.17 Block diagram 1700 is shown illustrating the start of clear text I / O on a path, according to some embodiments.

[0122] An SA_Initiator, such as a host port (shown by reference numeral 1702), sends a port login (PLOGI 1704) to an SA_Responder, such as a storage port (shown by reference numeral 1706). Upon receiving the PLOGI 1704, the storage port 1706 sends a link service accept message (LS_ACC 1708) to the host port 1702, and the LS_ACC 1708 is received by the host port 1702. The host port 1702 may be included in a host, and the storage port 1706 may be included in a storage controller.

[0123] Then, a process login (PRLI 1710) is sent from the host port 1702 to the storage port 1706. The storage port 1706 receives the PRLI 1710 and sends a link service accept message (LS_ACC 1712) to the host port 1702, where the LS_ACC 1712 is received by the host port 1702. At this point, the plain text I / O starts on the path between the host port 1702 and the storage port 1706, as shown by reference numeral 1714. Reference numeral 1716 shows that the plain text I / O is being performed on the path.

[0124] Fig.18 A block diagram 1800 is shown of an embodiment of the operation of a flow from "plain text I / O" to "mixed plain text I / O and encrypted I / O" to "encrypted I / O" occurring between a host port 1702 and a storage port 1706. In one embodiment, the host port 1702 acts as an initiator and the storage port 1706 acts as a responder. It should be understood that an audit mode is enabled.

[0125] To initiate the operation of establishing a security association, the host port 1702 sends a security association initialization message (SA_Init 1804) from the host port 1702 to the storage port 1706 to establish a security association with the storage port 1706, the security association initialization message including key material for creating an encryption key. Upon receiving the security association initialization message, the storage port 1706 sends an acceptance of the security association initialization message to the host port 1702 for processing. In the Fibre Channel protocol implementation, the "acceptance" for processing the message can take the form of a link service acceptance message (LS_ACC 1806). After sending the acceptance, the storage port 1706 sends an initialization response message (SA_Init Resp 1808) to the host port 1702 to accept the security association, the initialization response message including the selected transformation method for encryption / decryption. The security association initialization message may include a plurality of different encryption transformation methods, from which the storage port 1706 may select for the security association being established.

[0126] Upon receiving the sent initialization response message (SA_Init Resp 1808), the host port 1702 sends an acceptance (LS_ACC 1810) to the storage port 1706 that the initialization response message is accepted for processing, and then sends an authentication message (SA_Auth 1812) to the storage port 1706 to request the storage port 1706 to establish authentication between the storage port 1706 and the host port 1702.

[0127] Upon receiving the security association authentication message (SA_Auth 1812), the storage port 1706 sends an accept message (LS_ACC 1814) to the host port 1702, indicating that the authentication message is accepted for processing, and then programs the security association SA1 for reception, including the key K1r, with the clear text allowed indicator set to 1 (as shown by reference numeral 1816).

[0128] After the storage port 1706 is programmed with the security association SA1 for the storage port 1706, the storage port 1706 sends an authentication response message (SA_Auth Resp 1818) to the host port 1702 to accept the authentication.

[0129] After receiving the security association authentication response message, the host port 1702 programs the security association SA1 for reception, including the key K1r, with the allow plaintext indicator set to 1 (as shown by reference numeral 1820). After programming the security association SA1, the host port 1702 sends an acceptance (LS_ACC 1822) that the authentication message is accepted to the storage port 1706 for processing.

[0130] Upon receiving the acceptance 1822, the storage port 1706 activates the security association SA1 for transmission along with the key K1t (shown via reference numeral 1824), and starts a timer 1826 to indicate the start of transmission of encrypted data from the storage port 1706 to the host port 1702. At this point, the storage port 1706 begins sending encrypted data, and the timer 1826 begins counting down from a predetermined value. The timer 1826 is Fig.16 An instantiation of the plaintext grace period timer 1604 is shown.

[0131] After activating the security association SA1, the storage port 1706 sends an authentication complete message (AUTH Done 1828) to the host port 1702, indicating that the security association initialization and authentication are complete and that transmissions may now be encrypted and decrypted for the newly established security association SA1.

[0132] After receiving the authentication completion message, the host port 1702 activates the created security association SA1 to be transmitted together with the key K1t (as shown by reference numeral 1830). After activating the security association SA, the host port 1702 sends an acceptance (LS_ACC 1832) that the security association SA1 is activated to the storage port 1706, and starts transmitting encrypted I / O to the storage port, and starts a timer 1834 to count down from a predetermined value. Timer 1834 is Fig.16With the instantiation of the plaintext grace period timer 1604 shown, in some embodiments, the predetermined values ​​of timers 1834 and 1836 may be the same.

[0133] exist Fig.18 In the example, from the time point when the timer 1826 starts counting down, when the encrypted data is sent from the storage port 1706, the plaintext data in the queue is also sent. Fig.18 In the example, starting from the time point when timer 1834 starts counting down, when the encrypted data is sent from the host port 1702, the plaintext data in the queue is also sent from the host port 1702.

[0134] Once the timer 1826 expires (i.e., the predetermined time period expires), the storage port 1706 no longer supports plain text I / O (as shown by reference numeral 1836). Once the timer 1834 expires (i.e., the predetermined time period expires), the host port 1702 no longer supports plain text I / O (as shown by reference numeral 1838). Under this condition, the allow plain text indicator is set to 0.

[0135] The predetermined time period for the expiration of timers 1826, 1834 is set high enough so that all pending plaintext I / O in the queue are cleared at time point 1840 and there is a transition from "mixed plaintext and SAI encrypted I / O" 1840 to "SA1 encrypted I / O" 1844.

[0136] therefore, Fig.18 The transition from plaintext I / O 1716 to mixed plaintext and encrypted I / O 1842 to encrypted I / O 1844 is shown on the path between the host port 1702 and the storage port 1706. This allows all pending plaintext I / O to be flushed from the queue after authentication and security associations have been successfully established. The shading and cross-hatching show Fig.18 The cycles of different types of data transmission.

[0137] Fig.19 A flow diagram illustrating operations for simultaneously enabling encryption on an operational path at a host port is shown in accordance with certain embodiments.

[0138] Control begins at block 1902 where a host port is enabled for security. In response to determining that the audit mode indicator has been enabled to allow input / output (I / O), the host port performs (at block 1904) clear text I / O on a path between the host port and the storage port, even if authentication or security association negotiation between the host port and the storage port cannot be successfully completed.

[0139] Control advances from block 1904 to block 1906, wherein, concurrently with performing plaintext I / O on the path, the host port enables encryption of data for the I / O on the path, and in some embodiments, concurrently enabling encryption of the data includes initiating a security association SA management transaction between the host port and the storage port.

[0140] Control proceeds from block 1906 to block 1908, where, in response to the host port determining that all plaintext reception has completed due to the expiration of a timer after the security association has been activated for transmission, the host port is programmed to no longer process plaintext data. It should be noted that the timer expires after a timeout period that is sufficient to flush the plaintext data that has been queued for transmission on the path when the transmission of encrypted data begins on the path.

[0141] In execution Fig.19 In the context of the illustrated embodiment, a host port is programmed with keying material for the exchange of encrypted data and an allow-plaintext indicator configured to allow the exchange of plaintext data on a path simultaneously with the exchange of encrypted data on the path.

[0142] In response to the allow plaintext indicator being configured to allow plaintext data to be exchanged on the path simultaneously with the exchange of encrypted data on the path, the host port is configured for both plaintext reception and for encrypted data reception using the key material. In addition, no I / O error is generated when both plaintext data and encrypted data are exchanged in the path during a predetermined time period indicated by the timer.

[0143] Fig. 20 A flow diagram 2000 is shown illustrating operations for simultaneously enabling encryption on operational paths at a storage port, in accordance with certain embodiments.

[0144] Control begins at block 2002 where a storage port is enabled for security. In response to determining that an audit mode indicator has been enabled to allow input / output (I / O), the storage port performs (at block 2004) clear text I / O on a path between the storage port and the host port, even if authentication or security association negotiation between the storage port and the host port cannot be successfully completed.

[0145] Control advances from box 2004 to box 2006, where, while performing plain text I / O on the path, the storage port enables encryption of data of the I / O on the path, and in some embodiments, enabling encryption of the data at the same time includes: initiating a security association SA management transaction between the storage port and the host port.

[0146] Control proceeds from block 2006 to block 2008, where, in response to the storage port determining that all plaintext reception has completed due to the expiration of the timer after the security association has been activated for transmission, the storage port is programmed to no longer process plaintext data. It should be noted that the timer expires after a timeout period that is sufficient to flush the plaintext data that has been queued for transmission on the path when the transmission of encrypted data begins on the path.

[0147] In execution Fig. 20 In the context of the illustrated embodiment, a storage port is programmed with key material for exchange of encrypted data and an allow plaintext indicator configured to allow exchange of plaintext data on a path concurrently with exchange of encrypted data on the path. In response to the allow plaintext indicator being configured to allow exchange of plaintext data on the path concurrently with exchange of encrypted data on the path, the storage port is configured for both plaintext reception and for reception of encrypted data using the key material. Furthermore, no I / O error is generated when both plaintext data and encrypted data are exchanged in the path during a predetermined time period indicated by a timer.

[0148] therefore, Figure 1-20 Provided are mechanisms for causing a host system to transition from exchanging plain text to exchanging encrypted data by allowing a time period during which mixed plain text and encrypted data are exchanged in embodiments where an audit mode indicator is enabled. Such embodiments also provide mechanisms for causing a storage port to transition from exchanging plain text to exchanging encrypted data by allowing a time period during which mixed plain text and encrypted data are exchanged in embodiments where an audit mode indicator is enabled.

[0149] Cloud computing environment

[0150] Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (eg, networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

[0151] Reference now Fig.21, depicts an illustrative cloud computing environment 50. Security enforcement or enabling and transition to encryption (shown via reference numeral 52) are performed in the cloud computing environment 50. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which a local computing device used by a cloud consumer can communicate, such as a personal digital assistant (PDA) or cellular phone 54A, a desktop computer 54B, a laptop computer 54C, and / or an automobile computer system 54N. The nodes 10 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as a private cloud, community cloud, public cloud, or hybrid cloud, or a combination thereof, as described above. This allows the cloud computing environment 50 to provide infrastructure, platform, and / or software as a service for which the cloud consumer does not need to maintain resources on a local computing device. It should be understood that Fig.21 The types of computing devices 54A-N shown in are intended to be illustrative only, and computing node 10 and cloud computing environment 50 may communicate with any type of computerized device over any type of network and / or network addressable connection (eg, using a web browser).

[0152] Reference now Fig. 22 , showing the cloud computing environment 50 ( Fig.21 ) provides a set of functional abstraction layers. It should be understood in advance that Fig. 22 The components, layers, and functions shown in are intended to be illustrative only, and embodiments of the present invention are not limited thereto.

[0153] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include mainframes, in one example, IBM ZSERIES* systems; servers based on RISC (Reduced Instruction Set Computer) architecture, in one example, IBM PSERIES* systems; IBM XSERIES* systems; IBM BLADECENTER* systems; storage devices; network and networking components. Examples of software components include network application server software, in one example, IBM WEBSPHERE* application server software; and database software, in one example, IBM DB2* database software.

[0154] Virtualization layer 62 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers; virtual storage; virtual networks, including virtual private networks; virtual applications and operating systems; and virtual clients.

[0155] In one example, the management layer 64 may provide the functionality described below. Resource provisioning provides dynamic procurement of computing resources and other resources used to perform tasks within a cloud computing environment. Metering and pricing provides cost tracking when utilizing resources in a cloud computing environment, as well as billing or invoicing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. A user portal provides access to the cloud computing environment for consumers and system administrators. Service level management provides cloud computing resource allocation and management so that the required service levels are met. Service level agreement (SLA) planning and fulfillment provides pre-scheduling and procurement of cloud computing resources, where future demand is anticipated based on the SLA.

[0156] The workload layer 66 provides examples of functions that can take advantage of the cloud computing environment. Examples of workloads and functions that can be provided from this layer include: mapping and navigation; software development and lifecycle management; virtual classroom education delivery; data analysis processing; transaction processing; and security enforcement or enabling and transitioning to encryption 68, such as Figure 1-21 shown.

[0157] Additional Embodiment Details

[0158] The described operation can be implemented as a method, device or computer program product that uses standard programming and / or engineering techniques to produce software, firmware, hardware or any combination thereof. Therefore, the aspects of the embodiment can take the form of a complete hardware embodiment, a complete software embodiment (including firmware, resident software, microcode, etc.) or an embodiment of a combination of software and hardware, which can be collectively referred to as "circuit", "module" or "system" herein. In addition, the various aspects of the embodiment can take the form of a computer program product. The computer program product may include a computer-readable storage medium (or multiple media) storing computer-readable program instructions thereon, and these computer-readable program instructions are used to cause a processor to perform various aspects of an embodiment of the present invention.

[0159] A computer-readable storage medium may be a tangible device capable of retaining and storing instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device such as a punch card or a raised structure in a groove on which instructions are recorded, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium should not be interpreted as a temporary signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated by a waveguide or other transmission medium (e.g., a light pulse by an optical fiber cable), or an electrical signal transmitted by a wire.

[0160] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device, or downloaded to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in a computer-readable storage medium in the corresponding computing / processing device.

[0161] The computer-readable program instructions for performing the operation of the embodiment of the present invention can be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages ​​(including object-oriented programming languages, such as Java, Smalltalk, C++, etc.) and conventional process programming languages ​​(such as "C" programming language or similar programming languages). The computer-readable program instructions can be executed completely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on a remote computer, or completely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider through the Internet). In some embodiments, in order to perform the various aspects of the embodiment of the present invention, the electronic circuit including, for example, a programmable logic circuit, a field programmable gate array (FPGA) or a programmable logic array (PLA) can execute the computer-readable program instructions by utilizing the state information of the computer-readable program instructions to personalize the electronic circuit.

[0162] Various aspects of embodiments of the present invention are described herein with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to embodiments of the present invention. It will be understood that each frame of the flowchart and / or block diagram and the combination of frames in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0163] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device create a device for implementing the functions / actions specified in one or more boxes of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, which can guide the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable storage medium having the instructions stored therein includes an article of manufacture, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0164] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, so that a series of operational steps are performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0165] Flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention.In this regard, each frame in the flow chart or block diagram can represent the module, segment or part of instruction, which includes one or more executable instructions for realizing the specified logical function.In some alternative embodiments, the function noted in the frame may not occur in the order noted in the figure.For example, two frames shown continuously can actually be performed substantially simultaneously, or these frames can sometimes be performed in reverse order, depending on the function involved.It will also be noted that the combination of the frames in each frame of the block diagram and / or flow chart illustration and the block diagram and / or flow chart illustration can be realized by a dedicated hardware-based system that performs a specified function or action or performs a combination of special hardware and computer instructions.

[0166] Fig.23 A block diagram is shown according to some embodiments, which shows that a Figure 1-22 2302. The system 2300 may include a circuit 2302, which may include at least a processor 2304 in some embodiments. The system 2300 may also include a memory 2306 (e.g., a volatile storage device) and a storage device 2308. The storage device 2308 may include a non-volatile storage device (e.g., an EEPROM, a ROM, a PROM, a flash memory, a firmware, a programmable logic, etc.), a disk drive, an optical drive, a tape drive, etc. The storage device 2308 may include an internal storage device, an attached storage device, and / or a network accessible storage device. The system 2300 may include a program logic 2310, which includes a code 2312 that can be loaded into the memory 2306 and executed by the processor 2304 or the circuit 2302. In some embodiments, the program logic 2310 including the code 2312 may be stored in the storage device 2308. In some other embodiments, the program logic 2310 may be implemented in the circuit 2302. One or more components in the system 2300 may communicate via a bus or via other couplings or connections 2314. Thus, while Fig.23 Program logic 2310 is shown separate from other elements, but program logic 2310 may be implemented in memory 2306 and / or circuit 2302 .

[0167] Certain embodiments may be directed to a method for deploying computing instructions into a computing system by integrating computer readable code by a human or automated process, wherein the code in conjunction with the computing system is enabled to perform the operations of the described embodiments.

[0168] The terms “embodiment,” “embodiments,” “the embodiment,” “these embodiments,” “one or more embodiments,” “some embodiments,” and “one embodiment” mean “one or more (but not all) embodiments of the invention,” unless expressly stated otherwise.

[0169] The terms "including", "comprising", "having" and variations thereof mean "including but not limited to", unless expressly stated otherwise.

[0170] Unless expressly stated otherwise, the enumerated listing of items does not imply that any or all of the items are mutually exclusive.

[0171] The terms "a", "an" and "the" mean "one or more" unless expressly stated otherwise.

[0172] Unless expressly stated otherwise, devices that are in communication with each other need not be in continuous communication with each other. In addition, devices that are in communication with each other may communicate directly or indirectly through one or more intermediaries.

[0173] The description of an embodiment with several components in communication with each other does not imply that all such components are required. Rather, various optional components are described to illustrate various possible embodiments of the invention.

[0174] In addition, although process steps, method steps, algorithms, etc. may be described in a sequential order, such processes, methods, and algorithms may be configured to work in an alternating order. In other words, any order or sequence of steps that may be described does not necessarily indicate a requirement to perform the steps in that order. The steps of the processes described herein may be performed in any feasible order. In addition, some steps may be performed simultaneously.

[0175] When a single device or product is described herein, it is apparent that more than one device / product (whether or not they collaborate) may be used in place of a single device / product. Similarly, where more than one device or product (whether or not they collaborate) is described herein, it will be readily apparent that a single device / product may be used in place of more than one device or product, or that a different number of devices / products may be used in place of the number of devices or programs shown. The functions and / or features of a device may alternatively be embodied by one or more other devices that are not explicitly described as having such functions / features. Therefore, other embodiments of the present invention need not include the device itself.

[0176] At least some of the operations shown in the accompanying drawings show some events that occur in a particular order. In alternative embodiments, some operations can be performed, modified or removed in different orders. In addition, steps can be added to the above logic and still meet the described embodiments. In addition, the operations described here can occur sequentially, or some operations can be processed in parallel. In addition, the operations can be performed by a single processing unit or by a distributed processing unit.

[0177] For the purpose of illustration and description, the above description of various embodiments of the present invention has been given. It is not exhaustive, nor is it intended to limit the present invention to the precise form disclosed. In light of the above teachings, many modifications and variations are possible. The scope of the present invention is not limited by this detailed description, but by the appended claims. The above description, examples and data provide a complete description of the manufacture and use of the composition of the present invention. Since many embodiments of the present invention can be made without departing from the scope of the present invention, the present invention lies in the appended claims.

Claims

1. A method for simultaneously enabling encryption on an operational path at a host port, comprising: Enable host ports for security; In response to determining that the audit mode indicator has been enabled to allow input / output (I / O), performing, by the host port, clear text I / O on a path between the host port and a storage port even if authentication or security association negotiation between the host port and the storage port cannot be successfully completed; as well as Concurrently with performing plain text I / O on the path, encryption of data for I / O on the path is enabled by the host port.

2. The method according to claim 1, wherein: Enabling encryption of data at the same time includes: initiating a security association SA management transaction between the host port and the storage port.

3. The method according to claim 2, wherein: The host port is programmed with keying material for exchange of encrypted data and an allow-plaintext indicator configured to allow exchange of plaintext data on the path concurrently with exchange of encrypted data on the path.

4. The method according to claim 3, further comprising: In response to the allow-plaintext indicator being configured to allow exchange of plaintext data on the path simultaneously with exchange of encrypted data on the path, the host port is configured for both plaintext reception and for reception of encrypted data using the key material.

5. The method according to claim 4, further comprising: In response to the host port determining that all plaintext reception has completed due to expiration of a timer after a security association has been activated for transmission, the host port is programmed to no longer process plaintext data.

6. The method according to claim 5, wherein: The timer expires after a timeout period that is sufficient to flush the path of plaintext data that was queued for transmission when transmission of the encrypted data began on the path.

7. The method according to claim 1, wherein: When both plaintext data and encrypted data are exchanged in the path during a predetermined period of time indicated by the timer, no I / O error is generated.

8. A system for simultaneously enabling encryption on an operational path at a host port, comprising: Memory; as well as A processor coupled to the memory, wherein the processor performs operations including: Enable host ports for security; In response to determining that the audit mode indicator has been enabled to allow input / output (I / O), performing, by the host port, clear text I / O on a path between the host port and a storage port even if authentication or security association negotiation between the host port and the storage port cannot be successfully completed; and Concurrently with performing plain text I / O on the path, encryption of data for I / O on the path is enabled by the host port.

9. The system according to claim 8, wherein: Enabling encryption of data at the same time includes: initiating a security association SA management transaction between the host port and the storage port.

10. The system according to claim 9, wherein: The host port is programmed with keying material for exchange of encrypted data and an allow-plaintext indicator configured to allow exchange of plaintext data on the path concurrently with exchange of encrypted data on the path.

11. The system of claim 10, wherein the operations further comprise: In response to the allow-plaintext indicator being configured to allow exchange of plaintext data on the path simultaneously with exchange of encrypted data on the path, the host port is configured for both plaintext reception and for reception of encrypted data using the key material.

12. The system of claim 11, the operations further comprising: In response to the host port determining that all plaintext reception has completed due to expiration of a timer after a security association has been activated for transmission, the host port is programmed to no longer process plaintext data.

13. The system according to claim 12, wherein: The timer expires after a timeout period that is sufficient to flush the path of plaintext data that was queued for transmission when transmission of the encrypted data began on the path.

14. The system according to claim 8, wherein: When both plaintext data and encrypted data are exchanged in the path during a predetermined period of time indicated by the timer, no I / O error is generated.

15. A computer program product, the computer program product comprising a computer-readable storage medium, the computer-readable storage medium storing a computer-readable program code, the computer-readable program code being configured to perform operations, the operations comprising: Enable host ports for security; In response to determining that the audit mode indicator has been enabled to allow input / output (I / O), performing, by the host port, clear text I / O on a path between the host port and a storage port even if authentication or security association negotiation between the host port and the storage port cannot be successfully completed; as well as Concurrently with performing plain text I / O on the path, encryption of data for I / O on the path is enabled by the host port.

16. The computer program product of claim 15, wherein: Enabling encryption of data at the same time includes: initiating a security association SA management transaction between the host port and the storage port.

17. The computer program product of claim 16, wherein: The host port is programmed with keying material for exchange of encrypted data and an allow-plaintext indicator configured to allow exchange of encrypted data on the path while plaintext data is exchanged on the path.

18. The computer program product of claim 17, the operations further comprising: In response to the allow-plaintext indicator being configured to allow exchange of plaintext data on the path simultaneously with exchange of encrypted data on the path, the host port is configured for both plaintext reception and for reception of encrypted data using the key material.

19. The computer program product of claim 18, the operations further comprising: In response to the host port determining that all plaintext reception has completed due to expiration of a timer after a security association has been activated for transmission, the host port is programmed to no longer process plaintext data.

20. The computer program product of claim 19, wherein: The timer expires after a timeout period that is sufficient to flush the path of plaintext data that was queued for transmission when transmission of the encrypted data began on the path.

21. The computer program product of claim 15, wherein: When both plaintext data and encrypted data are exchanged in the path during a predetermined period of time indicated by the timer, no I / O error is generated.

Images