Drive Subsystem Port Binding for Selective Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems with self-encrypting drives face challenges in protecting passphrases from interception, leading to unauthorized access, especially in environments lacking hardware acceleration for IPsec, which results in performance degradation when all communications are encrypted.
Innovation Solution
Implement selective encryption by using a separate UDP port (4792) for security commands and IPsec protection, while maintaining performance by encrypting only sensitive commands, ensuring compatibility with existing systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all communications are encrypted using IPsec, then security of passphrases is improved, but performance degrades due to lack of hardware acceleration
Solution Approach 1:
The patent segments communications into two distinct types: data commands transmitted over a non-encrypting port and security commands transmitted over an encrypting port. This segmentation allows selective encryption of only the passphrase-containing security commands while leaving data commands unencrypted, thereby maintaining performance while securing sensitive information.
Solution Approach 2:
The patent applies different encryption qualities to different communication streams. Security commands receive full IPsec encryption protection, while data commands transmit in clear text. This local quality differentiation ensures that only the critical passphrase transmission is secured, avoiding the performance penalty of encrypting all traffic.
2Productivity
If selective encryption is implemented for security commands only, then performance is maintained, but complexity of communication handling increases
Solution Approach 1:
The patent introduces port numbers as an intermediary mechanism to distinguish between data commands and security commands. By using different port numbers (non-encrypting port for data, encrypting port for security commands), the system can route traffic appropriately without complex inspection logic, simplifying the implementation of selective encryption.
Solution Approach 2:
The patent changes the port parameter to indicate the type of command being transmitted. This parameter change allows the system to automatically determine whether encryption should be applied, eliminating the need for complex content inspection and reducing processing complexity while maintaining performance.
Data Source
AI summary
A drive subsystem engages in data communication with a storage controller by establishing logic for selectively decrypting data communications based on identification of a controller encryption port as source port in received data communications. Data communications from the storage controller are processed by (1) for data commands, based on a non-encrypting port being identified as the source port, delivering the received data commands without decryption to the target drive, and (2) for a security command containing secret data enabling operation of the target drive, based on the controller encryption port being identified as the source port, decrypting the security command and delivering the decrypted security command to the target drive.