End-to-End Encryption in Linux Multi-Pathing via IO Stack Checks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In a Linux native multi-pathing environment, conventional approaches often fail to provide adequate data security for logical storage devices, leading to potential corruption of data during end-to-end encryption.
Innovation Solution
Implementing end-to-end encryption techniques within a multi-path layer of host devices configured to communicate over a storage area network (SAN) with storage arrays, using a multi-path input-output (MPIO) driver and check modules inserted in the IO stack to verify the origin of IO operations, ensuring that they come from the expected overlying device to prevent data corruption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If end-to-end encryption is implemented in a Linux native multi-pathing environment, then data security is improved, but data corruption risk increases due to improper IO operation handling
Solution Approach 1:
The patent introduces check modules as intermediary components within the IO stack that mediate between encryption devices and multi-path devices. These check modules verify the origin of IO operations and ensure proper routing, preventing data corruption while maintaining encryption security. The intermediary validates that IO operations originate from expected devices and prevents improper handling that would cause corruption.
Solution Approach 2:
The patent implements feedback mechanisms through check modules that monitor and verify IO operation origins throughout the IO stack. The check modules provide feedback by confirming whether IO operations come from expected overlying devices, allowing the system to detect and prevent improper IO handling that would lead to data corruption while maintaining encryption integrity.
2Reliability
If check modules are inserted in the IO stack to verify IO operation origins, then data corruption is prevented, but device complexity increases
Solution Approach 1:
The patent divides the IO stack into segmented functional components with check modules inserted at specific points between encryption devices and multi-path devices. Rather than implementing a monolithic complex verification system, the check modules are segmented into discrete verification points that independently validate IO origins, reducing overall system complexity while maintaining data integrity.
Solution Approach 2:
The check modules perform self-service verification by autonomously checking the origin of IO operations without requiring external intervention. Each check module independently validates whether IO operations originate from expected devices, eliminating the need for complex external verification mechanisms and reducing overall system complexity.
Data Source
AI summary
An apparatus comprises at least one processing device comprising a processor coupled to a memory, with the at least one processing device being configured to provide at least a portion of an input-output (IO) stack for processing of IO operations in a host device for delivery to a storage system over selected ones of a plurality of paths through a network. The IO stack comprises at least a multi-path device overlying one or more logical storage devices. The at least one processing device is further configured to perform a check at each of one or more points in the IO stack to confirm that a given IO operation directed to a given device of the IO stack is received from an expected overlying device of the IO stack. The IO stack illustratively comprises an encryption device overlying the multi-path device, supporting end-to-end encryption for one or more logical storage devices.