Fibre Channel Storage Port Encryption Protocol Modification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Fibre Channel protocols do not adequately secure client data and command status information units, leading to potential security exposures during data transmission, as only solicited data frames are encrypted, leaving unsolicited data and command/data frames unencrypted.
Innovation Solution
Modifying the protocol behavior to transmit command mode status information units without encryption and receiving command/data information units using solicited data frames, ensuring that command/data units are encrypted, while maintaining secure login associations between host and storage ports.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Fibre Channel protocols transmit unsolicited data and command/data frames without encryption, then data transmission speed and protocol compatibility are maintained, but security exposures occur during data transmission
Solution Approach 1:
The patent applies local quality by differentiating encryption requirements across different information unit types. Solicited data frames are encrypted while unsolicited data and command status IUs are transmitted unencrypted. This selective encryption approach maintains security for sensitive data while preserving protocol compatibility and transmission efficiency for control information.
Solution Approach 2:
The patent segments information units into different categories based on their security requirements. By dividing IUs into solicited data, unsolicited data, and command status categories, the system can apply appropriate encryption measures to each segment, resolving the contradiction between comprehensive security and protocol complexity.
2Reliability
If all information units are encrypted, then security is enhanced, but protocol compatibility and transmission efficiency deteriorate
Solution Approach 1:
The patent implements local quality by applying encryption selectively to solicited data frames while leaving unsolicited data and command status IUs unencrypted. This ensures that sensitive client data is protected while maintaining transmission efficiency for control information that does not require encryption.
3Reliability
If solicited data frames are encrypted but unsolicited data and command/data frames are not, then partial security is achieved, but security exposures remain in command status and unsolicited data transmission
Solution Approach 1:
The patent applies inversion by reversing the conventional approach of encrypting only solicited data. Instead, it encrypts solicited data while explicitly transmitting unsolicited data and command status IUs in unencrypted form with appropriate delimiters. This inverted approach maintains security for data while ensuring protocol compatibility for control information.
Data Source
AI summary
In response to receiving a login request message with a security indicator enabled for security, a storage port establishes a security association by transmitting a response indicating a login accept with the security indicator enabled for security. In response to establishing the security association, the storage port modifies a protocol behavior for transmitting and receiving information units.