Patent Application
20080059795
Reference will be made to embodiments of the invention, examples of which may be illustrated in the accompanying figures. These figures are intended to be illustrative, not limiting. Although the invention is generally described in the context of these embodiments, it should be understood that it is not intended to limit the scope of the invention to these particular embodiments.
An apparatus and method are described for encrypting and decrypting information stored in a plurality of disk drives located within a large storage system. In various embodiments of the invention, encryption and decryption processes are implemented within a storage controller or controllers in the storage system.
In the following description, for purpose of explanation, specific details are set forth in order to provide an understanding of the invention. It will be apparent, however, to one skilled in the art that the invention may be practiced without these details. One skilled in the art will recognize that embodiments of the present invention, some of which are described below, may be incorporated into a number of different systems and devices including storage environments. The embodiments of the present invention may also be present in software, hardware or firmware. Structures and devices shown below in block diagram are illustrative of exemplary embodiments of the invention and are meant to avoid obscuring the invention. Furthermore, connections between components and/or modules within the figures are not intended to be limited to direct connections. Rather, data between these components and modules may be modified, re-formatted or otherwise changed by intermediary components and modules.
Reference in the specification to “one embodiment” or “an embodiment” means that a particular feature, structure, characteristic, or function described in connection with the embodiment is included in at least one embodiment of the invention. The appearances of the phrase “in one embodiment” in various places in the specification are not necessarily all referring to the same embodiment.
A. Overview
The encryption-enabled controller 202 communicate with the host system 201 through a peripheral component interface (such as one on a PCI card) to receive data that is to be stored on the memory drives 204. The encryption-enabled controller 202 generates security keys by using various available encryption and decryption processes. The controller 202 also associates these keys with the data and/or location within the drives 204 where the data is to be stored.
In various embodiments of the invention, the security keys may be generated by using a standard encryption process such as Project 1619 (“P1619”) from IEEE, that are implemented fully or in part within the controller, and fully or in part by the host system. The generated encryption keys are subsequently used to encrypt the data before it is sent to the drives by the encryption-enabled controller. In order to access and read the data subsequent to this storage, a decryption process must be performed in which decryption keys are required. As a result, if someone should gain access to the storage drives, they are only able to read data that had not been encrypted.
These security keys may be generated using various techniques and methods within the encryption-enabled controller 202. In various embodiments of the invention, a unique set of security keys are generated for data or block of data and its corresponding storage location. These keys may include different sets of encryption keys including a Host System key particular for that host, Disk Drive keys wherein a specific key is allotted to a specific disk drive and a Block Level key that changes depending upon the various blocks of data accessed within each drive.
B. Encryption-Enabled Controller
A system interface processor subsystem 302 is located in the control path between the PCI controller 301 and the SAS controller(s) 305, which are connected to the actual drives 203 or expanders 204. The system interface processor subsystem 302 may also be coupled to an optional external memory device 306, such as an NVSRAM, FLASH, SRAM etc., that stores information related to the management of the controller 202 and processing of control data received from the PCI controller 301. The external optional memory 306 may be accessed by the system interface processor subsystem 302 for buffering any sort of data related to its processing function. The system interface processor subsystem 302 processes the control data from the host system and manages the encryption of data and association of storage locations with the encrypted data.
An encryption block module 303 is positioned in the data path between the PCI Controller 301 and the SAS Controller(s) 305. The encryption block module 303 may also be coupled to an optional storage device, either on-chip or off-chip, on which security keys and other information may be stored. The encryption block module 303 is also communicatively coupled to the system interface processor subsystem 302. As previously described, the encryption block module 303 provides the encryption and decryption of the encrypted data that is stored in the disk drives and may additionally generate, all or in part as previously described, the keys used for the encryption and decryption. In various embodiments of the invention, a look-up table is generated that stores these keys, data storage addresses, etc. to enable this decryption process to properly occur. In one embodiment, the look-up table comprises columns or rows that include encryption keys and data storage locations within the disk drives. The encryption block module 303 may employ various types of encryption and decryption processes to perform these functions including the use of AES to encode data prior to storage and decode data upon retrieval.
The SAS controller modules 305 are connected to the disk drives according to the Serial Attached SCSI (“SAS”) standard. It is important to note that other embodiments of the invention may use other protocols, standards or methods to connect with the disk drives.
According to various embodiments of the invention, a high speed PCI controller interface 310 is employed that allows for data rates up to 10 GB/sec. As the number of drives associated with the controller 202 expands, this high speed interface will be able to process data at sufficient rates to avoid bottlenecks. If the number of drives becomes too large, then the controller 202 may create a bottleneck. In such a scenario, some of these drives may be associated with a previously installed, less-burdened controller or a new controller with data encryption may be installed within the system and associated with some of these drives.
One skilled in the art will recognize that locating encryption and decryption blocks within a storage controller provides more efficient scalability within an encryption-enabled storage system. In addition, the likelihood of data bottlenecks within the storage system is significantly reduced because of the ability to manage the encryption and decryption processes across a plurality of storage controllers within the system.
C. Method of Encrypting/Decrypting Data
The encryption keys are subsequently used to encrypt 403 the data so that it is unreadable without performing a decryption process. These keys and storage location(s) of the data are then stored locally on the controller card or on external memory that is coupled to controller card. After the data has been encrypted, it is stored 404 on one or more drives within the storage system.
In an alternative embodiment of the invention, the controller card is able to select whether data should be encrypted or not. For example, if particular data is deemed valuable or otherwise important, then it is encrypted by the controller. However, if the data is not considered important, then the controller may store that data without previously encrypting it. This selective encryption procedure may increase the amount of data that the controller can process because certain data does not require the encryption processes.
Using the decryption keys, the stored data is read from the drives and decrypted 503 on the controller. In various embodiments of the invention, this decryption process may occur in other locations because the encrypted data and decryption keys may be transmitted from the controller to another processing device. Once the data has been decrypted, it may be transmitted 504 to various computer devices to enable processing, storage, visualization or other processing of the decrypted data.
While the present invention has been described with reference to certain exemplary embodiments, those skilled in the art will recognize that various modifications may be provided. Accordingly, the scope of the invention is to be limited only by the following claims.
