Local Key Manager Secure Key Exchange Protocol

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The FC-SP-2 standard's certificate-based authentication for Fibre Channel links is computationally intensive and time-consuming, leading to elongated link initialization times and system constraints, especially in large enterprise environments with numerous Fibre Channel physical ports and dynamic switched fabrics.

Innovation Solution

A secure key exchange (SKE) protocol is implemented, where a local key manager (LKM) on each node connects to a security key lifecycle manager to create shared secret messages, using four messages (SKE SA Init Request, SKE SA Init Response, SKE Auth Request, and SKE Auth Response) to establish a security association between endpoints, reducing the need for link-by-link authentication and improving initialization efficiency.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If certificate-based authentication (FCAP protocol) is performed on every Fibre Channel link, then security authentication is ensured, but link initialization time is significantly elongated

Engineering Contradiction:

Improveauthentication securityVSAvoidlink initialization time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent performs certificate-based authentication in advance during link initialization, before client traffic flows. The FCAP protocol completes the computationally intensive authentication and key exchange beforehand, so that subsequent data transfers can proceed without repeated authentication delays.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary authentication mechanism where a security association is established between endpoints using pre-shared keys or certificate-based authentication. This intermediary layer handles the complex authentication logic, allowing the main data path to operate efficiently without repeated authentication overhead.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If FCAP protocol with certificate validation is executed on every link, then strong authentication is achieved, but system performance is negatively affected due to CPU intensive computations

Engineering Contradiction:

Improveauthentication strengthVSAvoidsystem initialization performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent performs the CPU-intensive certificate validation and key exchange operations in advance during link initialization. The FCAP protocol completes these computationally demanding tasks before client workloads begin, distributing the computational burden over time rather than during peak operation.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent uses ephemeral session keys derived from the authentication process. These short-lived cryptographic objects are generated during the initial FCAP exchange and discarded after use, replacing the need for repeated expensive certificate validations during normal operation.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

3Reliability

If mutual authentication and key negotiation are performed for each Fibre Channel link, then security is maintained, but the number of frame exchanges increases causing constraints in heavy operation

Engineering Contradiction:

Improvesecurity protectionVSAvoidframe exchange volume

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent merges the authentication and key negotiation processes into a single integrated FCAP protocol exchange. Instead of separate authentication and encryption setup procedures, the FCAP protocol combines mutual authentication, key derivation, and security parameter negotiation into one unified process, reducing the total number of frame exchanges.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The patent creates a universal security association that can be applied across multiple Fibre Channel links between the same endpoints. Once authenticated via FCAP, the security parameters and keys can be reused for multiple links, reducing redundant authentication frames and simplifying the overall communication complexity.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS11489821B2Processing a request to initiate a secure data transfer in a computing environment

Publication Date: 2022.11.01 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

Aspects of the invention include receiving a request from a responder channel on a responder node to initiate a secure communication with an initiator channel on an initiator node. The request includes an identifier of a shared key, and a nonce and security parameter index generated by the initiator node for the secure communication. The receiving is at a local key manager (LKM) executing on the responder node. A security association is created at the LKM between the initiator node and the responder node. The shared key is obtained based at least in part on the identifier of the shared key. Based on obtaining the shared key, a message requesting initialization of the secure communication between the responder channel and the initiator channel is built. The message includes an initiator nonce and an initiator security parameter index generated by the LKM for the secure communication.