Asymmetric Key Trust for Data Storage Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In data storage networks, the identity of host systems and their ports can be exploited for impersonation, allowing unauthorized systems to mimic authentic hosts, compromising security and integrity.
Innovation Solution
Implementing a trusted host facility (THF) with hardware-encrypted modules and one-time programmable cells to generate and manage asymmetric encryption keys, ensuring secure communication and identity validation between host and storage systems through cryptographic techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If host system identity information is stored on the storage system for authentication, then authentication capability is improved, but the system becomes vulnerable to impersonation attacks where unauthorized systems can mimic authentic hosts
Solution Approach 1:
The patent implements asymmetric cryptography where the host system generates a key pair consisting of a private key (kept secret on the host) and a public key (stored on the storage system). The storage system stores only the public key and uses it to verify authentication tokens generated by the host. This asymmetric approach allows the storage system to validate host identity without possessing the secret private key, thereby preventing impersonation while maintaining authentication capability.
2Ease of operation
If the private key is stored in readable form on the host system for encryption operations, then cryptographic functionality is improved, but security is compromised as the key becomes accessible to potential attackers
Solution Approach 1:
The patent segments the cryptographic key into two distinct parts: the private key and the public key. The private key remains securely stored in unreadable form on the host system and is used only to generate authentication tokens. The public key is separately stored on the storage system and used for verification. This segmentation allows cryptographic operations to proceed while protecting the secret private key from exposure.
3Device complexity
If traditional authentication methods are used without asymmetric cryptography, then system complexity is lower, but security against impersonation attacks is insufficient
Solution Approach 1:
The patent implements preliminary action by having the host system generate its asymmetric key pair and provide the public key to the storage system during an initial provisioning phase. The storage system stores this public key in advance, creating a pre-established trust relationship. When authentication is needed, the host can prove its identity by generating a token that the storage system verifies using the pre-stored public key, eliminating the need for complex real-time key exchange protocols.
Data Source
AI summary
A trust relationship may be established between a host system and a storage system. An asymmetric key pair including a private key unique to a host system and a public key may be generated. During provisioning of the host system to the storage system, the host system may send the public key to the storage system. The storage system may be configured to record the public key for the host system, for example, in a masking table that defines I/O connectivity for logical storage units between a host system and the storage system. The public key may be used later to validate the host system to the storage system. The private key may be stored on the host system and be unreadable, or may be encrypted with an unreadable encryption key stored on the host system.