Storage Controller Key Generation for Encrypted Multi-Tenant I/O
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In a three-layer ICT infrastructure system where multiple tenants share storage resources, existing methods of encrypting data with different keys for each drive or storage pool lead to inefficiencies and security risks, including potential data leakage and performance degradation during drive replacement or tenant departure.
Innovation Solution
A storage control unit that integrates an IO processing unit and an encryption/decryption-related processing unit, capable of generating and applying keys based on key generation method information, to encrypt and decrypt data efficiently, ensuring secure data handling and maintaining performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If different keys are allocated for each drive to prevent data leakage upon drive removal or replacement, then data security is improved, but device complexity increases due to key management overhead
Solution Approach 1:
The patent segments the key management into two independent components: drive-specific keys for preventing data leakage upon drive removal, and storage pool-specific keys for tenant isolation. This segmentation allows each key type to serve its specific security function without managing all keys centrally, reducing overall key management complexity while maintaining both security requirements.
Solution Approach 2:
The patent introduces a key generation unit as an intermediary component that automatically generates and manages both drive-specific keys and storage pool-specific keys. This intermediary centralizes the key generation logic, eliminating the need for manual key distribution and management, thereby reducing operational complexity while enhancing security.
2Reliability
If encryption/decryption is performed for each I/O operation to ensure data security, then data protection is improved, but processing time increases leading to performance degradation
Solution Approach 1:
The patent performs encryption before data is written to the drive and decryption before data is read from the drive, making encryption/decryption a preliminary action integrated into the I/O workflow. This ensures data is encrypted at rest without requiring additional encryption steps during I/O operations, minimizing performance impact while maintaining security.
Solution Approach 2:
The patent merges the encryption/decryption functionality with the existing I/O processing units in the storage control node. By combining these functions into a unified processing architecture, the patent eliminates separate encryption/decryption steps and reduces overall processing latency, thereby maintaining I/O performance while ensuring data protection.
3Reliability
If multiple storage pools are created for different tenants to ensure data isolation, then data security is improved, but storage resource utilization efficiency decreases
Solution Approach 1:
The patent applies local quality by creating storage pools with specific security properties tailored to each tenant's requirements. Each storage pool is configured with tenant-specific keys and access control mechanisms, allowing data isolation and security customization without creating separate physical storage systems for each tenant, thereby optimizing resource utilization.
Solution Approach 2:
The patent implements a universal storage pool structure that can serve multiple tenants through logical partitioning and key-based access control. The same physical storage resources can be dynamically allocated to different tenants via storage pools, allowing a single storage infrastructure to provide isolated storage environments for multiple tenants, improving overall resource utilization efficiency.
4Reliability
If drive-specific keys are used for encryption, then prevention of data leakage upon drive removal is improved, but the system becomes vulnerable to data leakage if a single key is compromised
Solution Approach 1:
The patent segments the encryption key hierarchy into drive-specific keys and storage pool-specific keys. Drive-specific keys prevent data leakage upon drive removal, while storage pool-specific keys provide an additional layer of security. If a drive-specific key is compromised, the storage pool-specific key remains secure, limiting the impact of key compromise to only the affected drive rather than the entire storage system.
Data Source
AI summary
An information processing system includes a physical drive, a compute unit, and a storage control unit that processes a data input/output request from the compute unit, in which: the storage control unit includes an IO processing unit and an encryption/decryption-related processing unit; the encryption/decryption-related processing unit is capable of referring to key generation method information including at least one element used to generate a key used to encrypt/decrypt the data and an algorithm for generating a key by using the element; and the encryption/decryption-related processing unit generates a key used to encrypt/decrypt the data according to a content set in the key generation method information, and encrypts data received from the compute unit by the IO processing unit or decrypts data read from the physical drive by the IO processing unit by using the key.