Local Key Manager for Secure Key Exchange Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The FC-SP-2 standard's certificate-based authentication in Fibre Channel environments is computationally intensive and time-consuming, leading to elongated link initialization times and system constraints, especially in large enterprise servers with numerous Fibre Channel ports.
Innovation Solution
A secure key exchange (SKE) protocol is implemented using a local key manager (LKM) to manage private security keys, establishing a security association between nodes through unencrypted SKE SA Init Request and Response messages, followed by encrypted SKE Auth Request and Response messages, reducing the need for frequent re-authentication and optimizing key management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If certificate-based authentication (FCAP protocol) is used to establish secure communication, then security strength is improved, but link initialization time increases and system performance deteriorates
Solution Approach 1:
The patent implements preliminary key establishment through a key distribution center (KDC) before the actual authentication process. Security keys are pre-distributed to authentication agents (AAs) on each port, so that when FCAP authentication is needed, the actual cryptographic operations can proceed faster since the key material is already in place rather than being generated or retrieved during the authentication process itself.
Solution Approach 2:
The patent introduces authentication agents (AAs) as intermediary components that reside on each Fibre Channel port. These AAs handle the computationally intensive cryptographic operations locally, acting as intermediaries between the FCAP protocol and the core authentication logic. This distributes the computational burden away from the main system and enables parallel processing across multiple ports.
2Reliability
If certificate-based authentication is performed on every Fibre Channel link, then security coverage is improved, but computational overhead increases and system performance decreases
Solution Approach 1:
The patent segments the authentication function into separate authentication agents (AAs) that reside on individual Fibre Channel ports rather than centralizing authentication processing. Each AA independently handles authentication for its associated port, enabling parallel processing of multiple authentication operations simultaneously. This segmentation distributes the computational load across multiple processing units, improving overall system throughput and performance.
Solution Approach 2:
Each authentication agent on a Fibre Channel port performs its own authentication operations independently using pre-distributed keys from the key distribution center. The AAs are self-sufficient in performing cryptographic operations locally without requiring centralized coordination for each authentication event, reducing inter-process communication overhead and improving processing efficiency.
3Reliability
If FCAP protocol with certificate exchange is used, then authentication strength is improved, but processing speed deteriorates due to intensive mathematical computations
Solution Approach 1:
The patent performs preliminary key distribution through a secure key establishment protocol between the key distribution center and authentication agents before FCAP authentication is needed. This pre-establishment of cryptographic keys means that when FCAP authentication occurs, the computationally intensive key generation and exchange operations have already been completed, and only the actual authentication verification remains, significantly reducing processing time while maintaining strong security.
Data Source
AI summary
Aspects of the invention include generation of a secure key exchange (SKE) authentication response by a responder node of a computing environment. A computer-implemented method includes receiving an authentication request message at a responder channel on the responder node from an initiator channel on an initiator node to establish a secure communication, the receiving at a local key manager (LKM) executing on the responder node. A state check is performed based on a security association of the initiator node and the responder node. A validation of the authentication request message is performed. A proposal list of the authentication request message is checked. An authentication response message is built based at least in part on a successful state check, a successful validation, and selecting an encryption algorithm from the proposal list. The authentication response message is sent from the LKM to the responder channel.