I/O Filter Driver Selective Access Encrypted Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in accessing encrypted logical units when the encryption key is not available, leading to failures and delays in I/O operations, particularly during system restarts or when the device state is unknown.
Innovation Solution
Implementing an I/O filter driver that allows specific I/O requests to encrypted devices without the data encryption key, such as non-destructive operations or inquiries, to enable early boot key lookup and determine the device state, thereby allowing selective I/O access and preventing system failures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption is implemented at the host or storage level, then data security is improved, but I/O operations fail when the encryption key is not available during early boot stages
Solution Approach 1:
The patent segments I/O requests into two categories: those requiring the encryption key (which are blocked) and those that do not require the key (which are allowed to proceed). This segmentation enables selective I/O processing, allowing system boot and initialization to continue while maintaining encryption security.
Solution Approach 2:
The patent introduces an intermediary component (such as a boot loader or initialization routine) that operates before the full encryption system is active. This intermediary handles early I/O requests and key acquisition, bridging the gap between unencrypted boot processes and encrypted operational modes.
2Reliability
If all I/O requests are blocked when the encryption key is unavailable, then data protection is maintained, but system boot and initialization processes are delayed
Solution Approach 1:
The patent applies partial action by allowing only a subset of I/O requests (those that do not require encryption key processing) to proceed during early boot. Non-critical I/O operations are permitted while critical encrypted operations wait for key availability, optimizing boot time without compromising security.
3Reliability
If the system waits for the encryption key before processing any I/O requests, then security is ensured, but system responsiveness and interoperability are reduced
Solution Approach 1:
The patent implements dynamic I/O request handling where the system's response to I/O requests changes based on the availability of the encryption key. During early boot when the key is unavailable, the system dynamically allows non-encrypted I/O operations. Once the key is available, the system transitions to full encrypted I/O processing, maintaining both responsiveness and security.
Data Source
AI summary
A method is provided for controlling I/O request access to an encrypted storage device when the encryption key for the encrypted storage device is not available. The method comprises the unordered steps of: providing an I/O filter driver in operable communication with an encrypted storage device, such that all I/O requests to the encrypted storage device are processed first through the I/O filter driver; receiving at the I/O filter driver an I/O request to the encrypted storage device; determining, for each I/O request, the type of the I/O request and, if the I/O request comprises a read, SCSI read, write, or SCSI write, determining a location on the storage device to which the I/O request is directed; determining, in a processor, whether a time period for obtaining the encryption key is still running; and, based on at least one of the I/O request type, whether the time period for obtaining the encryption key is still running, and, if applicable, the location on the device to which the I/O is requested, determining, in a processor, whether the I/O request to the encrypted storage device will be allowed.