Storage Key Management for Encrypted Host Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The FC-SP-2 standard's certificate-based authentication for Fibre Channel links is computationally intensive and time-consuming, leading to elongated link initialization times and system constraints, especially in large enterprise environments with many Fibre Channel physical ports and dynamic switched fabrics.
Innovation Solution
A system that uses a shared wrapping key, obtained from a key server and stored locally, to facilitate cryptographic operations between trusted nodes, reducing the need for frequent key exchanges and authentication with a key server, and employing a key look-up mechanism for multi-threaded access to encryption keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If certificate-based authentication (FCAP/IKE protocol) is performed on every Fibre Channel link, then security authentication is achieved, but link initialization time is significantly elongated and system performance is degraded
Solution Approach 1:
The patent implements preliminary authentication at the fabric level before individual link establishment. The Fibre Channel fabric performs mutual authentication between host and storage device using certificate-based FCAP protocol in advance, so that when individual links are established, the authentication is already completed, eliminating the need for repeated authentication computations on each link.
Solution Approach 2:
The patent extracts the authentication function from the link level and moves it to the fabric level. By separating authentication (performed once at fabric level) from link establishment (performed repeatedly at link level), the computationally intensive certificate validation is performed only once, while link initialization can proceed rapidly without repeated authentication overhead.
2Reliability
If certificate-based authentication with public-private key pairs is performed on every link, then strong security authentication is achieved, but CPU computational overhead is excessive
Solution Approach 1:
The patent performs the computationally intensive public-private key pair authentication in advance at the fabric level during host and storage device mutual authentication. Once authenticated at the fabric level, the resulting security context is reused for all subsequent link establishments, eliminating the need for repeated CPU-intensive cryptographic operations on each link.
Solution Approach 2:
The patent makes the fabric-level authentication result universally applicable to all links between the authenticated host and storage device. A single fabric-level authentication establishes a security context that can be reused across multiple links, making the authentication function serve multiple links simultaneously rather than requiring separate authentication for each link.
3Reliability
If frequent key exchange with key server is performed, then key security is maintained, but system performance and initialization speed are reduced
Solution Approach 1:
The patent performs key exchange and establishment of security contexts in advance during fabric-level authentication. The encryption keys and security parameters are established once at the fabric level, and these pre-established keys are then reused for all subsequent link encryptions, eliminating the need for frequent key exchange requests to the key server during link initialization.
Solution Approach 2:
The patent creates and reuses security contexts that contain encryption keys established at the fabric level. Instead of generating new keys for each link, the system copies and reuses the security context from the fabric-level authentication, significantly reducing key management overhead and improving link initialization performance while maintaining security.
Data Source
AI summary
Key management for encrypted data. A node, such as a storage device, obtains a shared key to be used in cryptographic operations. The obtaining includes using an identifier of another node, such as a host of the computing environment, and a unique identifier of the shared key to obtain the shared key. The obtained shared key is then used in one or more cryptographic operations.