Host-Based Encryption Key Segmentation for Non-Self-Encrypting Drives
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data storage systems using non-self-encrypting drives (NSEDs) face challenges in encrypting data while allowing host systems to access physical storage devices independently of directors, without compromising security by sharing encryption keys.
Innovation Solution
Assigning unique encryption keys to logical storage units and providing encryption metadata to authorized host systems, enabling them to encrypt and decrypt data while maintaining security by controlling access through masking tables and internal fabric connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption keys are shared with host systems to enable data encryption on NSEDs, then data security is improved, but the risk of key exposure and unauthorized access increases
Solution Approach 1:
The patent divides the encryption key into multiple segments or components, where each host system receives only a portion of the key rather than the complete key. This segmentation ensures that no single host system has full access to the encryption key, thereby maintaining data security while enabling encryption functionality on NSEDs.
Solution Approach 2:
The storage system acts as an intermediary that manages and distributes key components to host systems. Instead of directly sharing complete encryption keys with hosts, the storage system mediates the key distribution process, controlling what each host receives and ensuring that key exposure risk is minimized while still enabling authorized encryption operations.
2Speed
If host systems are granted independent access to physical storage devices, then access speed and autonomy are improved, but security control and key protection are worsened
Solution Approach 1:
The storage system performs preliminary actions by pre-configuring masking tables and determining key distribution requirements before host systems access the storage devices. This preliminary setup ensures that security controls are already in place and that hosts receive only the specific key components they are authorized to use, maintaining security control while allowing fast independent access.
Solution Approach 2:
Different host systems are assigned different local qualities or permissions regarding key access. Each host system receives a specific portion of the encryption key tailored to its authorized access level, as defined in masking tables. This local differentiation allows hosts to access storage devices independently at high speed while maintaining granular security control over what each host can decrypt.
3Reliability
If unique encryption keys are assigned to each logical storage unit, then data security and access control are improved, but system complexity and key management overhead increase
Solution Approach 1:
The storage system implements self-service mechanisms where masking tables automatically manage the association between logical storage units and host systems. The system autonomously determines which hosts receive which key components based on pre-configured masking rules, eliminating the need for manual key management and reducing operational complexity despite having multiple unique encryption keys.
Solution Approach 2:
The masking table structure serves multiple functions simultaneously: it defines host access permissions, determines key distribution, and manages logical storage unit associations. This multi-functionality reduces the need for separate key management systems and procedures, thereby reducing overall complexity while maintaining fine-grained access control through unique encryption keys for each logical storage unit.
Data Source
AI summary
A storage system may assign a different encryption key to each logical storage unit (LSU) of a storage system. For each LSU, the encryption key of the LSU may be shared only with host systems authorized to access data of the LSU. In response to a read request for a data portion received from a host application executing on the host system, encryption metadata for the data portion may be accessed. If it is determined from the encryption metadata that the data portion is encrypted, the data encryption metadata for the data portion may be further analyzed to determine the encryption key for the data portion. The data may be retrieved from the storage system, for example, by performance of a direct read operation. The retrieved data may be decrypted, and the decrypted data may be returned to the requesting application.