Local Key Manager Secure Key Exchange Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The FC-SP-2 standard's certificate-based authentication in Fibre Channel environments is computationally intensive and time-consuming, leading to elongated link initialization times and system constraints, especially in large enterprise servers with numerous Fibre Channel ports.
Innovation Solution
A secure key exchange (SKE) protocol is implemented, where a local key manager (LKM) derives cryptographic keys from a security association payload, builds an authentication request message, and sends it to the initiator channel, enabling secure communication between nodes without the need for frequent re-authentication through a central key manager.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If certificate-based authentication (FCAP/IKE protocol) is used to ensure strong security, then authentication strength is improved, but link initialization time increases and system performance deteriorates
Solution Approach 1:
The authentication process is segmented into two distinct phases: an initial certificate-based authentication (FCAP/IKE) to establish trust, followed by a lightweight key-based authentication (SKE) for subsequent communications. This segmentation allows the heavy computational burden to occur only once, while faster authentication methods are used for repeated operations.
Solution Approach 2:
The certificate-based authentication is performed in advance during link initialization to establish a security association and derive cryptographic keys. These pre-computed keys are then cached and reused for subsequent authentication operations, eliminating the need to repeat the computationally intensive certificate validation process.
2Reliability
If certificate-based authentication is performed on every Fibre Channel link, then security is maintained, but system initialization and operation constraints increase due to computational overhead
Solution Approach 1:
The system implements self-service authentication by caching cryptographic keys locally after the initial certificate-based authentication. Subsequent authentication operations are performed autonomously using these cached keys without requiring repeated involvement of the central key manager or certificate authority, significantly reducing computational overhead.
Solution Approach 2:
The authentication mechanism transitions from using certificates and public-key infrastructure (computationally intensive) to using derived symmetric keys (computationally efficient) for subsequent authentication operations. This parameter change in the authentication approach maintains security while dramatically improving performance.
3Reliability
If multiple certified entities use public-private key pairs for mutual authentication, then strong authentication is achieved, but central processing unit intensive computations increase
Solution Approach 1:
The patent replaces the mechanical/computational process of repeated public-key cryptography operations with a substitution based on pre-computed symmetric keys. The initial public-key exchange is performed once to establish trust, but subsequent authentication uses lightweight symmetric key operations that require minimal CPU resources.
Data Source
AI summary
Aspects of the invention include generation of a secure key exchange (SKE) authentication request by an initiator node of a computing environment. A non-limiting example computer-implemented method includes receiving an initialization response message at an initiator channel on an initiator node from a responder channel on a responder node to initiate a secure communication, the receiving at a local key manager (LKM) executing on the initiator node. A set of cryptographic keys is derived based on a security association payload of the initialization response message. A proposal list is built based on one or more security capabilities supported by the initiator channel. An authentication request message is built based at least in part on the set of cryptographic keys and the proposal list. The authentication request message is sent from the LKM to the initiator channel.