Encryption Endpoint LBA Metadata Preservation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems face performance issues due to the cycle-intensive nature of encryption tasks when performed in software filter drivers on hosts, leading to slow performance, and there is a need for efficient and secure passing of encryption metadata between system components to specialized hardware devices.
Innovation Solution
The proposed solution involves an encryption endpoint in a distributed computer system that receives encryption metadata through a storage I/O stack, allowing it to transfer this information to specialized hardware devices for efficient and secure data encryption operations, utilizing a DEK management protocol for communication among the storage I/O stack components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption is performed in a software filter driver on the host, then data can be encrypted securely with keys from a network key server, but performance becomes slow due to the cycle-intensive nature of encryption
Solution Approach 1:
The patent extracts the encryption function from the software filter driver layer and relocates it to a dedicated hardware encryption device. The filter driver retains key management responsibilities (obtaining keys from the key server), but the actual encryption operations are performed by the hardware device, thereby separating security management from performance-critical encryption execution.
Solution Approach 2:
The patent introduces an intermediary component - the hardware encryption device - that acts as a mediator between the filter driver and the storage device. This intermediary receives encryption metadata and keys from the filter driver, performs the computationally intensive encryption operations in hardware, and returns encrypted data, thus bridging the gap between software-based key management and hardware-based performance optimization.
2Productivity
If encryption tasks are offloaded to specialized hardware devices, then performance improves, but it becomes necessary to establish complex communication protocols for passing encryption metadata between system components
Solution Approach 1:
The patent implements preliminary action by having the filter driver prepare and transmit encryption metadata (including key identifiers and encryption parameters) to the hardware encryption device before actual encryption operations begin. This pre-establishment of encryption context allows the hardware device to be pre-configured with necessary parameters, reducing runtime complexity and enabling faster encryption execution.
3Reliability
If encryption metadata is passed between multiple layers of the storage I/O stack, then hardware devices can obtain necessary encryption information, but ensuring secure and reliable transmission of this metadata becomes challenging
Solution Approach 1:
The patent uses the filter driver as an intermediary that centrally manages encryption metadata. Rather than having multiple components independently handle key distribution, the filter driver acts as the single source of truth for encryption parameters, obtaining keys from the key server and distributing them to the hardware encryption device through standardized interfaces, thereby simplifying metadata management and ensuring consistency.
Data Source
AI summary
An encryption endpoint (EE) receives, via a storage I/O stack (having a key controller module (KCM)), encryption metadata identifying an encryption key and a set of region entries. Each region entry includes an identification of a region within a storage device subject to encryption with the encryption key and an identification of a correlation between the region and a corresponding region on a logical volume (LV) managed by the KCM. The EE receives, via the stack, a storage command to process a block having a first address on the storage device. It corresponds to a second address located within the corresponding region of the LV. The EE determines the second address within the LV and then cryptographically processes the block using an address-dependent cryptographic algorithm and (a) data of the block, (b) the determined second address, and (c) the encryption key.