Automatic Link Re-authentication via Key Caching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The FC-SP-2 standard's certificate-based authentication for Fibre Channel links is computationally intensive and time-consuming, leading to elongated link initialization times and performance constraints in large enterprise servers with many physical ports, especially due to the IKE protocol's high CPU requirements and frequent frame exchanges.
Innovation Solution
A method is introduced where a node in a computing environment determines if a shared key is about to expire and automatically initiates re-authentication by obtaining a new key from a key server, allowing ongoing processing to continue uninterrupted and reducing link re-initialization times by having the new key ready when needed, without repeatedly obtaining it from the key server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If certificate-based authentication is performed on every Fibre Channel link using the FCAP and IKE protocols, then security and authentication reliability are improved, but link initialization time and system performance deteriorate
Solution Approach 1:
The patent implements key caching mechanism where authentication keys are obtained and stored in advance before actual link initialization. The system proactively retrieves authentication keys from a key server and caches them locally, so that when a link needs to be established, the authentication can proceed using the pre-cached keys without performing the full IKE protocol exchange at that moment. This preliminary action significantly reduces link initialization time while maintaining authentication security.
Solution Approach 2:
The patent extracts the computationally intensive key exchange portion of the authentication process from the link initialization sequence. By separating the key obtaining operation from the link establishment operation, the system can perform key caching independently and use the cached keys for rapid link initialization. This extraction allows the authentication reliability to be maintained through proper key management while removing the time-consuming elements from the critical link initialization path.
2Reliability
If certificate-based authentication with IKE protocol is performed on every Fibre Channel link, then authentication security is improved, but CPU processing load and system performance deteriorate
Solution Approach 1:
The system performs the computationally intensive IKE protocol execution and key generation in advance, caching the results for later use. This preliminary execution of authentication operations eliminates the need to repeat heavy CPU computations during normal link initialization, thereby maintaining strong authentication security while dramatically improving system performance during operational phases.
Solution Approach 2:
The patent creates and stores copies of authentication keys in a local cache after the initial IKE protocol execution. Instead of repeatedly performing the full certificate-based authentication with heavy mathematical computations for each link, the system uses cached key copies. This copying approach maintains authentication security through proper key management and validation while reducing CPU processing load by avoiding redundant intensive computations.
3Reliability
If re-authentication is performed when shared keys expire, then security reliability is maintained, but link initialization time increases
Solution Approach 1:
The system implements proactive key renewal by detecting when cached authentication keys are approaching expiration and automatically obtaining fresh keys from the key server before they become invalid. This preliminary key renewal action ensures that re-authentication can occur smoothly without interrupting link operations, maintaining security reliability while minimizing the time impact by avoiding emergency re-authentication scenarios.
Solution Approach 2:
The patent implements a key expiration monitoring mechanism that tracks the validity period of cached authentication keys. When keys are detected to be expiring or have expired, the system triggers automatic re-authentication operations. This feedback loop ensures security reliability by maintaining valid authentication credentials while managing re-authentication timing to minimize disruption to link operations.
Data Source
AI summary
A shared key, used by one node and another node of a computing environment in authentication of one or more links coupling the one node and the other node, is determined to be within an expiration range. Based on determining the shared key is within the expiration range, re-authentication of at least one link is automatically initiated. The automatically initiating re-authentication includes obtaining, by the one node, a new shared key from a key server, sending a message encrypted with the new shared key from the one node to the other node via one link of the one or more links, and receiving by the one node via the one link an indication that the other node decrypted the message using the new shared key.