Encrypted Storage Provisioning Through an Intermediary Controller
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing storage provisioning systems in cloud-native data centers lack support for volume-level encryption, leading to compliance issues with data protection regulations, recurring development costs, and licensing problems, especially when working with third-party storage provisioning nodes.
Innovation Solution
A method and system that enables volume-level encryption by generating encrypted storage volumes from unencrypted ones, allowing independent deployment and use across different storage provisioning nodes without requiring additional software on application nodes, and supporting fine-grained security domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If volume-level encryption is implemented in existing storage provisioning systems, then data protection compliance is improved, but device complexity and implementation difficulty increase
Solution Approach 1:
The patent introduces a storage provisioner as an intermediary component between the orchestrator and the storage backend. This storage provisioner includes a volume controller that intercepts volume creation requests, applies encryption transformations, and manages encryption keys. By placing the encryption functionality in this intermediary layer rather than modifying existing storage provisioning systems, the patent achieves volume-level encryption without increasing overall system complexity.
Solution Approach 2:
The patent segments the storage provisioning system into distinct functional components: the orchestrator for resource management, the storage provisioner for volume management, and the volume controller for encryption management. This segmentation allows encryption to be implemented as a separate, modular function that can be added without complicating the existing orchestration and storage management layers.
2Reliability
If encryption functionality is integrated into third-party storage provisioning nodes, then data protection is improved, but licensing issues and compatibility problems arise
Solution Approach 1:
The storage provisioner is designed as a universal component that can work with multiple different storage backends and orchestrators. The volume controller implements a standardized encryption interface that is independent of the underlying storage system, allowing the same encryption functionality to be applied across different third-party storage provisioning nodes without requiring modifications to each specific vendor's system.
Solution Approach 2:
By positioning the volume controller as an intermediary between the orchestrator and various storage backends, the patent creates a compatibility layer that translates different storage protocols and interfaces into a unified encryption mechanism. This intermediary approach allows third-party storage systems to benefit from encryption without requiring integration of vendor-specific encryption solutions.
3Reliability
If additional software is deployed on application nodes to enable encryption, then encryption capability is improved, but ease of operation and deployment simplicity deteriorate
Solution Approach 1:
The patent extracts the encryption functionality from the application nodes and relocates it to the storage provisioner layer. By removing the encryption software requirement from application nodes and concentrating it in the storage provisioner's volume controller, the system maintains encryption capability while simplifying application deployment and operation.
Solution Approach 2:
The storage provisioner automatically manages encryption key generation, storage, and application to volumes without requiring manual configuration or additional software on application nodes. The volume controller handles encryption transparently, allowing application nodes to access encrypted storage without needing to know or manage the encryption process, thereby maintaining operational simplicity.
4Measurement precision
If fine-grained security domains are implemented, then data protection precision is improved, but device complexity increases
Solution Approach 1:
The volume controller implements fine-grained security domains by applying different encryption settings and key management policies to individual volumes based on their specific security requirements. Each volume can have its own encryption configuration, allowing precise control over security domains without requiring complex system-wide changes. This local quality approach enables differentiated security policies to be applied where needed while leaving other volumes unaffected.
Data Source
AI summary
There is provided a method performed by a first storage provisioning node of a system for provisioning storage in the system. In response to a first request for an encrypted storage volume for an application node, transmission of a second request is initiated (20) towards a second storage provisioning node for an unencrypted storage volume. In response to the requested unencrypted storage volume becoming available to the first storage provisioning node, an encrypted storage volume is generated (22) from the unencrypted storage volume and provisioning of the encrypted storage volume is initiated (24) to make the encrypted storage volume available at a compute node of the system for use by the application node.