In-band Detection for Storage I/O Encryption Metadata
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing approach to data encryption in computer systems, which relies on software filter drivers, is inefficient due to the cycle-intensive nature of encryption, leading to slow performance, and requires offloading encryption tasks to specialized hardware components while ensuring proper transmission of encryption metadata through the storage I/O stack.
Innovation Solution
A technique is disclosed for detecting intermediate drivers or components along the data path using an in-band communications protocol with signature values to confirm the presence and correct configuration of necessary components for data encryption, ensuring that encryption metadata is effectively shared and processed by hardware-level components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data encryption is performed in a software filter driver on the host, then encryption can be implemented flexibly with key management, but performance deteriorates due to the cycle-intensive nature of encryption operations
Solution Approach 1:
The patent extracts the encryption operation from the software filter driver layer and relocates it to a hardware-level component (storage device or separate encryption device). This extraction allows the software layer to retain flexibility in key management and encryption policy while the hardware layer handles the computationally intensive encryption operations, thereby resolving the performance bottleneck without sacrificing adaptability.
Solution Approach 2:
The patent introduces an intermediary mechanism - the in-band communication protocol with signature verification - that bridges the software filter driver and the hardware encryption component. This intermediary ensures that encryption metadata is properly transmitted and verified through intermediate layers, enabling seamless coordination between the flexible software layer and the high-performance hardware layer.
2Productivity
If encryption metadata is transmitted through the storage I/O stack to hardware components, then hardware-assisted encryption can be utilized, but the system complexity increases due to requirements for intermediate layer configuration and protocol handling
Solution Approach 1:
The patent makes the in-band communication protocol universal across all intermediate layers of the storage I/O stack. By defining a standard protocol with signature verification that can be implemented at any layer (driver layer, block layer, filesystem layer), the system achieves multi-functionality where any intermediate layer can handle encryption metadata transmission. This universality reduces configuration complexity compared to requiring custom solutions for each layer.
Solution Approach 2:
The protocol includes self-verification mechanisms where each intermediate layer automatically verifies the signature of incoming encryption metadata and forwards it only if verification succeeds. This self-service approach eliminates the need for complex external configuration and management of intermediate layers, as each layer autonomously ensures proper metadata transmission.
3Reliability
If signature verification is performed at each intermediate layer to confirm component presence, then correct configuration can be ensured, but processing time increases due to additional verification steps
Solution Approach 1:
The patent performs signature verification as a preliminary action during the initialization phase when encryption metadata is first transmitted through the I/O stack. By verifying signatures upfront rather than continuously during data operations, the system ensures configuration correctness while minimizing time loss. The verification results are cached and reused for subsequent operations.
Data Source
AI summary
A system shares encryption-related metadata between layers of a storage I/O stack. Additionally, a detection mechanism ensures that certain layers within the storage I/O stack are present and cooperate with a particular protocol. Along these lines, functional components engage in an in-band communications protocol, such as a data encryption key (DEK) management protocol. The in-band communications protocol employs protocol commands and responses carried along the data path as contents of in-band transport messages and responses, such as special SCSI read commands and their responses. The protocol commands and responses include a handshake command and a handshake response used during an initial handshake operation. Each protocol command and response has a protocol signature field carrying one of distinct first and second signature values which are used to identify the presence of the protocol command or response in the transport messages and responses at different locations along the data path.