Data processing system having failover between hardware and software encryption of storage data

Patent metadata

Field	Value
Publication number	US-9787522-B1
Application number	US-201113172172-A
Country	US
Kind code	B1
Filing date	Jun 29, 2011
Priority date	Jun 29, 2011
Publication date	Oct 10, 2017
Grant date	Oct 10, 2017

Abstract

A computer of a data processing system includes a software encryption engine and path circuitry that initially provides one or more paths for conveying data of storage I/O requests to and from a storage device, the paths including an encrypting path having a hardware encrypting component. According to a failover technique, in a first operating state, (a) the data of the storage I/O requests is conveyed via the encrypting path with encryption and decryption of the data being performed by the hardware encrypting component, and (b) monitoring is performed for occurrence of an event indicating that the hardware encrypting component has become unavailable for encrypting and decrypting the data of the storage I/O requests. Upon occurrence of the event, if the path circuitry provides a non-encrypting path for conveying the data of the storage I/O requests to and from the storage device, then operation is switched to a second operating state in which the data of the storage I/O requests is conveyed via the non-encrypting path and is encrypted and decrypted by the software encryption engine. A failback technique provides for reverting to hardware-assisted encryption under proper circumstances.

First claim

What is claimed is:

1. A computer for use in a data processing system having a storage device on which data is to be stored in encrypted form, comprising:
memory for storing an executable software encryption engine;
path circuitry initially providing one or more paths for conveying data of storage I/O requests between a source of the storage I/O requests and a storage device, the paths including an encrypting path having a hardware encrypting component, the path circuitry including a plurality of host bus adaptors having respective independent storage interconnections to the storage device, each host bus adaptor being a hardware interface module providing a hardware interface between processing circuitry of the computer and the respective storage interconnection, one of the host bus adaptors being an encrypting host bus adaptor having the hardware encrypting component and through which the encrypting path extends, another of the host bus adaptors being a non-encrypting host bus adaptor through which a non-encrypting path extends; and
processing circuitry operative to cause the computer to perform a method supporting encryption of data of the storage device, the method including:
in a first operating state, (a) conveying the data of the storage I/O requests via the encrypting path with encryption and decryption of the data being performed by the hardware encrypting component, and (b) monitoring for occurrence of an event indicating that the hardware encrypting component has become unavailable for encrypting and decrypting the data of the storage I/O requests; and
upon occurrence of the event indicating that the hardware encrypting component has become unavailable for encrypting and decrypting the data of the storage I/O requests, and only if the path circuitry provides the non-encrypting path for conveying the data of the storage I/O requests to and from the storage device, then switching to a second operating state in which the data of the storage I/O requests is conveyed via the non-encrypting path and is encrypted and decrypted by the software encryption engine;

wherein the memory further stores an I/O filter driver executed by the processing circuitry to form an I/O stack of functional elements between an operating system of the computer and a driver for the host bus adaptors, the I/O filter driver including the software encryption engine as well as an encryption manager and a multipathing module, the encryption manager handling a reconfiguring of encryption operation from use of the hardware encrypting component to use of the software encryption engine in the second operating state, the multipathinq module handling the conveying of the data of the storage requests and the monitoring for the event as well as reporting the event to the encryption manager, and wherein the data of the storage I/O requests passes through the multipathinq module in unencrypted form in the first operating state to be encrypted by the hardware encrypting component of the encrypting host bus adaptor, and the data of the storage I/O requests passes through the multipathinq module in encrypted form after being encrypted by the software encryption engine in the second operating state.

2. A computer according to claim 1 , wherein the method further includes the step, performed upon occurrence of the event indicating that the hardware encrypting component has become unavailable for encrypting and decrypting the data of the storage I/O requests, of testing whether the path circuitry continues to provide one or more other encrypting paths for conveying the data of the storage I/O requests to and from the storage device, and if so then remaining in the first operating state and conveying the data of the storage I/O requests via one of the other encrypting paths, and wherein switching to the second operating state and conveying the data of the storage I/O requests via the non-encrypting path is performed only if the path circuitry does not provide the one or more other encrypting paths.

3. A computer according to claim 1 , wherein monitoring for occurrence of the event includes monitoring for occurrence of a failed storage I/O request directed to the storage device.

4. A computer according to claim 3 , wherein monitoring for occurrence of the event further includes attempting to renegotiate an encryption state of the storage device, the attempting being performed by a key controller module of the data processing system in response to the failed storage I/O request, the attempting resulting in an indication to the key controller module that no hardware-assisted encryption is provided for the storage device.

5. A computer according to claim 4 , wherein attempting to renegotiate the encryption state of the storage device includes engaging in a data encryption key management protocol between a key controller module and the path circuitry, the data encryption key management protocol including a query command and corresponding response, the query command being usable by the key controller module to ascertain the presence and capability of a hardware encrypting component, the response being usable by components of the path circuitry to indicate presence or absence of a hardware encrypting component.

6. A computer according to claim 1 , wherein switching to the second operating state includes sending a command to the path circuitry to cease use of hardware-assisted encryption for the storage device to prevent non-failed I/O processing circuitry from attempting to utilize a failed hardware encrypting component.

7. A computer according to claim 6 , wherein the command effects a disassociation of an encryption association previously established in the path circuitry for storage I/O requests directed to the storage device.

8. A computer according to claim 1 , wherein the method performed by the processing circuitry further includes:
in the second operating state, monitoring for the availability of a new path in the path circuitry to the storage device, and determining whether the new path provides hardware-assisted encryption and decryption of the data of the storage I/O requests to, and
only in the event that the new path provides hardware-assisted encryption and decryption of the data of the storage I/O requests, then switching to the first operating state.

9. A computer according to claim 8 , wherein determining whether the new path provides hardware-assisted encryption and decryption includes engaging in a data encryption key management protocol between a key controller module and the path circuitry, the data encryption key management protocol including commands and corresponding responses, the commands being usable by the key controller module to ascertain the presence of a hardware encrypting component and to control the encryption and decryption operation thereof, the responses being usable by components of the path circuitry to indicate presence or absence of a hardware encrypting component and to indicate successful and unsuccessful results for encryption-related control actions taken by the key controller module.

10. A computer according to claim 9 , wherein the data processing system uses an address-dependent encryption operation by which an address-associated value is included as an input in encryption and decryption operations, the address-associated value for each block of data being calculated based on a location of the block of data on a storage device, and wherein the data encryption key management protocol includes a mechanism for carrying crypto address information to be used by the hardware encrypting component in calculating the address-associated value, the mechanism including preserving the crypto address information between the key controller module

Assignees

• Contreras Cesareo
• Kabra Atul
• Bappe Michael E
• Epstein Edith
• Raizen Helen S
• Elpaev Alexander
• Emc Ip Holding Co Llc

Inventors

• Contreras Cesareo
• Kabra Atul
• Bappe Michael E
• Epstein Edith
• Raizen Helen S
• Elpaev Alexander

Classifications

• H04L29/08549

  Electricity · mapped topic

• H04L29/067 Primary

  Electricity · mapped topic

• H04L63/0485 Primary

  Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up · CPC title

• H04L67/1097 Primary

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title

• H04L69/14

  Multichannel or multilink protocols · CPC title