Kernel Key Manager Communication via HMC Socket
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current storage systems face challenges in efficiently establishing communication between the CEC kernel and the Key Manager (KM) through a Hardware Management Console (HMC) for encryption support, especially in configurations with multiple HMCs/KMs, where existing solutions lack direct communication paths and are not cost-effective.
Innovation Solution
A system and method that allow the CEC kernel to initiate communication with a KM through a HMC by opening a socket along a selected event flow suborder type, enabling data exchange, including session key information, while simplifying the design by not requiring the Network Interface (NI) to retain event flow information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the CEC kernel directly communicates with the Key Manager, then communication efficiency is improved, but the device complexity increases due to requiring direct communication paths and additional system resources
Solution Approach 1:
The HMC acts as an intermediary between the CEC kernel and the Key Manager. The kernel initiates communication through the HMC by opening a socket along a selected event flow suborder type, and the HMC forwards requests to the appropriate KM. This mediator approach maintains communication efficiency while avoiding the need for direct kernel-to-KM communication paths, thereby reducing device complexity.
2Reliability
If multiple HMCs/KMs are configured for redundancy, then system reliability is improved, but the difficulty of establishing communication paths increases
Solution Approach 1:
The system dynamically selects which HMC and KM to use for communication based on current system state and availability. The kernel can initiate communication with any available KM through any available HMC, and the system adapts to changes in component availability. This dynamic approach maintains reliability through redundancy while simplifying communication path selection, as the system automatically handles the complexity of choosing among multiple paths.
3Measurement precision
If the NI retains event flow information, then communication accuracy is improved, but the device complexity increases
Solution Approach 1:
The event flow information is extracted from the NI and stored elsewhere in the system. The NI no longer needs to retain this information, reducing its complexity and memory requirements. The necessary event flow information is maintained in other components that have the appropriate context and capabilities to store and retrieve this information when needed for communication between the kernel and KM.
Data Source
AI summary
System, computer program product, and method embodiments for communication between a kernel operational on a storage subsystem and a key manager (KM) through a hardware management console (HMC) to provide encryption support are provided. In one embodiment, an event request is initiated by the kernel to the KM to execute an event flow. Pursuant to a communication request by the kernel to the HMC, a socket of the HMC is opened along a communication path between the KM and the kernel according to an event flow type selected by the KM for the event flow. Data including a data payload is sent by the KM to the kernel, the data payload corresponding to the selected event flow type.