SAN Switch Key Management via Extraction and Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current mechanisms for managing and securing encryption keys in storage area network (SAN) devices are limited, making it impractical to efficiently perform cryptographic processes across multiple hosts and storage devices without the need for individual cryptographic accelerators.
Innovation Solution
A network-based key management system that uses a key database with unique identifiers and hierarchical encryption, where keys are managed by a SAN switch, allowing for efficient retrieval and migration, and utilizing a master key split using threshold secret sharing for secure recovery during disasters.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a network-based key management system is implemented without cryptographic accelerators on hosts or storage devices, then device complexity is reduced and cost is decreased, but cryptographic processing efficiency may be limited by network communication overhead
Solution Approach 1:
The cryptographic processing function is extracted from hosts and storage devices and centralized in the SAN switch. The SAN switch contains cryptographic processing logic and key management capabilities, allowing encryption/decryption operations to be performed at the network layer rather than requiring distributed cryptographic accelerators on each endpoint device.
Solution Approach 2:
The SAN switch acts as an intermediary between hosts and storage devices, performing cryptographic operations on data as it passes through the network. This mediator approach allows centralized security management while maintaining the simplicity of endpoint devices, as the SAN switch handles all cryptographic processing for multiple hosts and storage devices simultaneously.
2Ease of operation
If encryption keys are stored centrally in the SAN switch, then key management is simplified and security is improved, but the system becomes vulnerable to single points of failure and disaster loss
Solution Approach 1:
The master key is segmented into multiple distributed shares using secret sharing technology. Each share is stored in different locations or secured by different administrators, so that no single point of failure can compromise the entire key. The key management database stores encrypted key material that requires multiple shares to reconstruct the original key.
Solution Approach 2:
Backup mechanisms are implemented to protect against disaster loss. The system includes key backup and recovery procedures where encrypted key copies are stored in secure locations, and secret sharing arrangements ensure that sufficient shares can be recovered to reconstruct lost or damaged key material.
3Reliability
If unique keys are assigned to each disk LUN or tape cartridge, then data security and authentication are improved, but key management complexity and overhead increase significantly
Solution Approach 1:
The SAN switch provides universal key management capabilities that serve multiple hosts, storage devices, disk LUNs, and tape cartridges through a single centralized system. This multi-functional approach allows the same infrastructure to manage keys for numerous individual data objects without requiring separate key management systems for each device or data unit.
Solution Approach 2:
The system uses templates and key hierarchies where master keys and key management policies are copied and applied across multiple data objects. Instead of manually managing each unique key, the system uses automated key generation and distribution mechanisms that replicate security policies consistently across numerous LUNs and cartridges while maintaining individual key uniqueness.
4Adaptability or versatility
If keys are migrated between storage devices or locations, then data accessibility and flexibility are improved, but key security and integrity may be compromised during transfer
Solution Approach 1:
Keys are pre-encoded and encrypted before migration occurs. The key management system prepares key material in advance with appropriate security measures, so that during actual migration the keys are already protected. This preliminary security preparation ensures that keys maintain their security properties throughout the migration process regardless of transmission medium or distance.
Data Source
AI summary
An encryption key management system is provided for storage area network devices. A create key request is received at a storage area network switch. The key is created at the storage area network switch and the created key request is transmitted to a key management center. The key object is stored in the key management center and includes a unique identifier, an encrypted key, a wrapper unique identifier, and a key entity. The encrypted key can later be decrypted to generate a decrypted key. The encrypted key is decrypted using keying material accessed using the wrapper unique identifier that identifies another key object.