Storage System Management Processor Encryption

The patent introduces a management processor as an intermediary component within the storage apparatus that receives encrypted management commands from the management server computer, decrypts them, and then routes them to the appropriate I/O processors. This intermediary layer isolates the I/O processors from direct external communication, allowing management functions to be performed while blocking external attack vectors from reaching the core processing units.

The patent segments the communication architecture into multiple isolated networks: a first network for management communication between the management server and management processor, and a second network for I/O operations between I/O processors and storage devices. This segmentation separates management traffic from data operations, allowing secure management communication while protecting the I/O processing path from external threats.

The management processor serves as a mandatory intermediary that all management commands must pass through. It receives encrypted commands from the management server, decrypts them using secure keys, identifies the target I/O processor, and forwards the decrypted command through the isolated second network. This ensures that I/O operations can be controlled efficiently while maintaining security through the intermediary decryption and routing function.

The patent adds a dimensional layer of security by introducing encryption and decryption operations as a separate processing dimension. Management commands are encrypted in the first network dimension, transmitted securely, then decrypted in the management processor before being routed to I/O processors in the second network dimension. This dimensional transformation ensures security is embedded in the communication architecture itself.