Hardware Software Encryption Failover Mechanism
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data processing systems face challenges in maintaining availability and performance of encrypted storage devices, particularly when hardware encryption components fail, leading to potential system unavailability due to the operation-intensive nature of encryption and decryption processes.
Innovation Solution
Implementing a redundancy mechanism that switches between hardware and software encryption engines, ensuring encrypted storage devices remain accessible by maintaining a software encryption engine and switching operations from hardware to software encryption when hardware components become unavailable, thereby maintaining data encryption and decryption functionality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If hardware encryption circuitry is used, then encryption performance is improved, but availability deteriorates due to potential hardware failure
Solution Approach 1:
The system dynamically changes the encryption mode parameter between hardware-based and software-based encryption. When hardware encryption is available, the system uses hardware mode for high performance. When hardware fails or is unavailable, the system switches to software mode to maintain availability, thus adapting the encryption parameter based on system state
Solution Approach 2:
The encryption system is made dynamic by implementing automatic failover capability. The system continuously monitors hardware encryption availability and dynamically switches between hardware and software encryption engines. This dynamic adaptation ensures both high performance when hardware is available and high availability when hardware fails
2Reliability
If software encryption is used, then availability is improved, but encryption performance deteriorates due to operation-intensive processing
Solution Approach 1:
The system introduces an intermediary layer (the failover mechanism) that sits between the storage I/O operations and the encryption engines. This intermediary automatically selects the appropriate encryption engine (hardware or software) based on availability, allowing software encryption to be used as a backup without permanently sacrificing performance when hardware is available
3Reliability
If redundant hardware encryption components are implemented, then availability is improved, but system cost increases
Solution Approach 1:
Instead of copying hardware encryption components (which would be expensive), the system creates a software-based copy or alternative implementation of the encryption function. The software encryption engine serves as a virtual duplicate of the hardware encryption capability, providing the same encryption function through a different medium that is less costly to replicate
Solution Approach 2:
The system uses software encryption as a disposable or temporary solution that activates only when hardware encryption fails. Software encryption is less expensive than hardware, making it suitable for use as a backup mechanism that accepts reduced performance in exchange for cost-effective availability
Data Source
AI summary
A computer of a data processing system includes a software encryption engine and path circuitry that initially provides one or more paths for conveying data of storage I/O requests to and from a storage device, the paths including an encrypting path having a hardware encrypting component. According to a failover technique, in a first operating state, (a) the data of the storage I/O requests is conveyed via the encrypting path with encryption and decryption of the data being performed by the hardware encrypting component, and (b) monitoring is performed for occurrence of an event indicating that the hardware encrypting component has become unavailable for encrypting and decrypting the data of the storage I/O requests. Upon occurrence of the event, if the path circuitry provides a non-encrypting path for conveying the data of the storage I/O requests to and from the storage device, then operation is switched to a second operating state in which the data of the storage I/O requests is conveyed via the non-encrypting path and is encrypted and decrypted by the software encryption engine. A failback technique provides for reverting to hardware-assisted encryption under proper circumstances.