Selective Encryption for Self-Encrypting Drive Passphrases
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Self-encrypting drives face security risks when passphrases are intercepted during communication between a storage controller and a drive subsystem, especially in environments lacking hardware acceleration, leading to potential unauthorized access to stored data.
Innovation Solution
Implementing selective encryption using a second UDP port for security commands, with IPsec protection only on this port, while maintaining performance by redirecting traffic and keeping regular data communications unencrypted on the standard port, thus minimizing performance impact and ensuring compatibility with existing code bases.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption is applied to all data communications between storage controller and drive subsystem, then security of passphrases is improved, but performance degradation occurs due to lack of hardware acceleration
Solution Approach 1:
The patent segments data communications into two distinct channels: a first port for unencrypted data commands and a second port for encrypted security commands containing passphrases. This segmentation allows selective encryption applied only where needed (security commands) rather than encrypting all communications, thereby maintaining security for sensitive data while avoiding performance degradation from encrypting routine data operations.
Solution Approach 2:
The patent applies different encryption qualities to different parts of the communication system: the second port handling security commands uses IPsec encryption protection, while the first port handling data commands remains unencrypted. This local differentiation of encryption quality ensures that security is strengthened only where passphrases are transmitted, without imposing the performance cost of universal encryption across all data communications.
2Reliability
If a separate encrypted port is established for security commands, then passphrase security is improved, but device complexity increases due to additional port configuration
Solution Approach 1:
The patent implements a port configuration where the second port is specifically designated for security commands requiring encryption, while the first port handles general data commands. By creating specialized ports with specific functions rather than attempting to make a single port handle all types of commands, the system achieves multi-functionality at the port level. This approach, while adding some configuration complexity, provides a clean separation of concerns that simplifies the encryption logic and makes the system more manageable through functional specialization.
Data Source
AI summary
A drive subsystem engages in data communication with a storage controller by establishing first and second communication ports, wherein the second port is configured for decryption and forwarding of decrypted communications to the first port. The drive subsystem receives and processes data communications having selective encryption and identification of target port, by (1) for a security command containing secret data (e.g. a passphrase) enabling operation of a target drive, receiving the security command at the second port, decrypting the security command and forwarding it to the first port for delivery to the target drive, and (2) for data commands by which the storage controller stores and retrieves data to/from the target drive, receiving the data commands in non-encrypted form at the first port directly from the storage controller for delivery to the target drive.