Encryption Endpoint Offloading Host I/O Filter Driver Bottleneck
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption methods in computer systems are inefficient due to the performance overhead of performing encryption tasks in software filter drivers on hosts, which can lead to slow performance and the need to offload these tasks to specialized hardware devices while ensuring secure and efficient transfer of encryption metadata.
Innovation Solution
A method for sharing encryption-related metadata between layers of a storage I/O stack, allowing specialized hardware devices to receive encryption keys and perform encryption operations efficiently, using a DEK management protocol for secure and in-band communication among system components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If data encryption is performed in a software filter driver on the host, then encryption can be implemented using available software components, but performance becomes slow due to the cycle-intensive nature of encryption tasks
Solution Approach 1:
The patent extracts the encryption function from the software filter driver on the host and relocates it to a specialized hardware device (encryption endpoint). The host's I/O filter driver sends encryption requests and receives encrypted data, while the actual encryption/decryption operations are performed by the hardware device, thereby separating the control logic from the computationally intensive encryption tasks.
Solution Approach 2:
The patent introduces an intermediary encryption endpoint device that acts as a mediator between the host's I/O filter driver and the storage system. This intermediary hardware device handles the cycle-intensive encryption operations,缓冲 (buffering) the computational load and allowing the host to continue processing other tasks while encryption is performed.
2Productivity
If encryption tasks are offloaded to specialized hardware devices, then encryption performance is improved, but it becomes necessary to securely transfer encryption metadata such as data encryption keys between system components
Solution Approach 1:
The patent segments the encryption system into distinct functional components: the host's I/O filter driver, the external key server, and the encryption endpoint hardware device. Each component has a specific responsibility - the filter driver manages I/O operations, the key server securely stores and distributes keys, and the encryption endpoint performs encryption - which simplifies the overall system architecture despite the added hardware component.
Solution Approach 2:
The patent introduces an intermediary key server that acts as a secure mediator for key distribution. Instead of directly sharing encryption keys between the host and encryption hardware, the key server securely stores keys and provides them to authorized components through controlled interfaces, thereby managing the complexity of secure key transfer.
3Reliability
If multiple hosts within a security domain need to securely access the same encrypted data, then data security is improved, but the complexity of key management and secure access control increases
Solution Approach 1:
The patent implements a universal key server that serves multiple hosts within a security domain through a single centralized system. The key server can authenticate and provide encryption keys to multiple different hosts, eliminating the need for separate key management systems for each host and simplifying multi-host security access while maintaining strong security controls.
Data Source
AI summary
A method performed in a device is provided. The method includes (a) receiving key identification information from a key controller module on an external host, (b) obtaining a key identified by the key identification information from an external key server, (c) decrypting encrypted data from an encrypted storage system using the key, and (d) processing the decrypted data. A corresponding computer program product is also provided.