Encryption Key Fingerprint Verification for Correct I/O Key Use
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data encryption methods lack a mechanism to verify the correct data encryption key is used during input/output operations, leading to potential data corruption and irrecoverability due to incorrect key usage.
Innovation Solution
Incorporating a key use fingerprint with each data encryption key, generated from identifiers associated with the intended use, to verify the correctness of the key during operations by comparing it with a fingerprint independently created by the HBA, ensuring the correct key is used for encryption and decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data encryption is performed using a data encryption key (DEK) during I/O operations, then data security is improved, but the risk of data corruption increases if the wrong DEK is used
Solution Approach 1:
The patent applies preliminary action by generating a key use fingerprint from I/O target identifying information before the actual encryption operation. This fingerprint is created in advance and stored with the wrapped DEK, enabling the HBA to verify key correctness before using the key to encrypt data, thus preventing data corruption from wrong key usage
Solution Approach 2:
The patent implements feedback by having the HBA independently create a second key use fingerprint from the I/O command target information and compare it with the stored key use fingerprint. This comparison provides feedback on whether the correct DEK is being used, allowing the system to detect and prevent wrong key usage before data corruption occurs
2Reliability
If a key verification mechanism is implemented by comparing key use fingerprints, then the correctness of the encryption key is ensured, but the operational complexity increases
Solution Approach 1:
The patent applies self-service by enabling the HBA to autonomously perform key verification. The HBA independently creates a key use fingerprint from the I/O command, compares it with the stored fingerprint, and determines whether to proceed with encryption without requiring external verification mechanisms, thus simplifying the overall system architecture
Solution Approach 2:
The patent uses copying by creating a duplicate key use fingerprint from the I/O target information and comparing it with the original stored fingerprint. This copying approach provides a simple and efficient verification method that avoids complex cryptographic protocols while ensuring key correctness
3Reliability
If the key management server generates and manages data encryption keys, then key security is improved, but the time required for key acquisition increases
Solution Approach 1:
The patent applies preliminary action by having the key management server generate and wrap the DEK with its key use fingerprint in advance, before the actual I/O operation occurs. This pre-preparation allows the server to deliver the wrapped key and fingerprint together, reducing key acquisition time during critical I/O operations while maintaining security through the wrapping mechanism
Data Source
AI summary
Methods and systems are provided for verifying use of encryption keys. A request for verification information may be sent by a network element (e.g., server), with the request comprising combination of one or more identifiers, the combination associated with a particular I/O operation. The request may be sent to another element, which may be a centralized encryption management element (e.g., management server). In response to the request, key use verification information generated for the particular I/O operation may be received, and may be used thereafter in validating a corresponding encryption key, which may be used during data encryption or decryption, based on the received key use verification information and locally generated verification information associated with the particular I/O operation. The one or more identifiers include at least one of a target identifier, a LUN identifier, and a LBA range identifier.