Method for securing data storage in a storage area network
View Patent ↗Disclosed is a device and method for securing stored data in an IP based storage area network (SAN), where the physical storage media is located in an unprotected site. The connection between the client and the unprotected site is established over a public or private IP network preferably by means of an iSCSI protocol. According to the present invention a data block to be saved in a remote site is encrypted at the initiator host using a private encryption key and an encrypt key. The private encryption key is saved in a key management table which is shared among other hosts that may access the encrypted data block.
1. A method for securing data by performing block level encryption, comprising:
receiving at a host a write small computer system interface (SCSI) command, said write SCSI command including at least a data block and a location in a storage device into where said block is to be written to;
encrypting at the host said data block using a private encryption key, wherein the encrypted data block is transmitted from said host to a storage device over a distributed storage network;
saving said private encryption key associated with said data block in a key management table (KMT); and,
distributing said private encryption key to other hosts having an access to the encrypted data block.
2. The method of claim 1 , further comprising:
saving the encrypted data block in said storage device to said location designated in said write command.
3. The method of claim 1 , wherein said distributed storage network is at least one of: storage area network (SAN), network attached storage (NAS).
4. The method of claim 1 , wherein said storage device is at least one of: tape drive, optical drive, disk, sub-disk, redundant array of independent disks (RAID).
5. The method of claim 1 , wherein encrypting said data block is performed by means of at least one of the following encryption algorithms: data encryption standard (DES), 3DES, advanced encryption standard (AES).
6. The method of claim 1 , wherein said KMT is saved in an encrypted management space allocated within a storage device.
7. The method claim 1 , wherein distributing said KMT between said hosts comprises the step of: sending said KMT to said hosts over a secured link.
8. The method of claim 1 , wherein said KMT comprises a target entry and a key entry, said target entry including a logical unit number (LUN) corresponding to said storage device, and said key entry including said private encryption key.
9. The method of claim 8 , wherein each record in said KMT is associated with said encrypted data block.
10. A computer executable code for securing data by performing block level encryption, said code comprising:
receiving at a host a write small computer system interface (SCSI) command, said write SCSI command including at least a data block and a location in a storage device into where said block is to be written to;
encrypting at the host said data block using a private encryption key, wherein the encrypted data block is transmitted from said host to a storage device over a distributed storage network;
saving said private encryption key associated with said data block in a key management table (KMT); and,
distributing said private encryption key to other hosts having an access to the encrypted data block.
11. The computer executable code of claim 10 , further comprising:
saving the encrypted data block in said storage device to a location designated in said write command.
12. The computer executable code of claim 10 , wherein said distributed storage network is at least one of: storage area network (SAN), network attached storage (NAS).
13. The computer executable code of claim 10 , wherein said storage device is at least one of: tape drive, optical drive, disk, sub-disk, redundant array of independent disks (RAID).
14. The computer executable code of claim 10 , wherein encrypting said data block is performed by means of at least one of the following encryption algorithms: data encryption standard (DES), 3DES, advanced encryption standard (AES).
15. The computer executable code of claim 10 , wherein said KMT is saved in an encrypted management space allocated within a storage device.
16. The computer executable code claim 10 , wherein distributing said KMT between said hosts comprises the step of: sending said KMT to said hosts over a secured link.
17. The computer executable code of claim 10 , wherein said KMT comprises a target entry and a key entry, said target entry including a logical unit number (LUN) corresponding to said storage device, and said key entry including said private encryption key.
18. The computer executable code of claim 17 , wherein each record in said KMT is associated with said encrypted data block.
19. A method for securing data by performing block level decryption of previously encrypted data blocks, said comprising:
receiving at a host a read small computer system interface (SCSI) command, said read SCSI command including at least an address of an encrypted data block to be read from a storage device;
retrieving said encrypted data block from said storage device;
sending said encrypted data block to said host, wherein said encrypted data block is transmitted from said storage device to said host over a distributed storage network;
retrieving from a keys management table (KMT) a private encryption key associated with said encrypted data block; and,
decrypting at the host said encrypted data block using said private encryption key.
20. The method of claim 19 , wherein said distributed storage network is at least one of: storage area network (SAN), network attached storage (NAS).
21. The method of claim 19 , wherein said storage device is at least one of: tape drive, optical drive, disk, sub-disk, redundant array of independent disks (RAID).
22. The method of claim 19 , wherein encrypting said data block is performed by means of at least one of the following encryption algorithms: data encryption standard (DES), 3DES, advanced encryption standard (AES).
23. The method of claim 19 , wherein said KMT is saved in an encrypted management space allocated in a storage device.
24. The method of claim 19 , wherein said KMT comprises a target entry and a key entry, said target entry including a logical unit number (LUN) corresponding to said storage device, and said key entry including said private encryption key.
25. A computer executable code for securing data by performing block level decryption of previously encrypted data blocks, said code comprising:
receiving at a host a read small computer system interface (SCSI) command, said read SCSI command including at least an address of an encrypted data block to be read from a storage device;
retrieving said encrypted data block from said storage device;
sending said encrypted data block to said host, wherein said encrypted data block is transmitted from said storage device to said host over a distributed storage network;
retrieving from a keys management table (KMT) a private encryption key associated with said encrypted data block; and,
decrypting at the host said encrypted data block using said private encryption key.
26. The computer executable code of claim 25 , wherein said distributed storage network is at least one of: storage area network (SAN), network attached storage (NAS).
27. The computer executable code of claim 25 , wherein said storage device is at least one of: tape drive, optical drive, disk, sub-disk, redundant array of independent disks (RAID).
28. The computer executable code of claim 25 , wherein encrypting said data block is performed by means of at least one of the following encryption algorithms: data encryption standard (DES), 3DES, advanced encryption standard (AES).
29. The computer executable code of claim 25 , wherein said KMT is saved in an encrypted management space allocated in a storage device.
30. The computer executable code of claim 25 , wherein said KMT comprises a target entry and a key entry, said target entry including a logical unit number (LUN) corresponding to said storage device, and said key entry including said private encryption key.
31. A method for securing data by performing data shuffling, comprising:
a) receiving at a host a write small computer system interface (SCSI) command together with a data block and an original location indicating the destination of said data block;
b) applying at the host a mapping function for the purpose of determining a new location for said data block; and,
c) writing said data block to said new location.
32. The method of claim 31 , wherein writing said data block further comprising: encrypting at the host said data block.
33. The method of claim 31 , wherein said mapping function determines said new location according to said original location and a secret key.
34. The method of claim 31 , wherein said data block is transmitted from said host to said storage device over a distributed storage network.
35. The method of claim 34 , wherein said distributed storage network is at least one of: storage area network (SAN), network attached storage (NAS).
36. The method of claim 34 , wherein said storage device is at least one of: tape drive, optical drive, disk, sub-disk, redundant array of independent disks (RAID).
37. A computer executable code for securing data by performing data shuffling, said code comprising:
receiving at a host a write small computer system interface (SCSI) command together with a data block and an original location indicating the where to save said data block;
applying at the host a mapping function for the purpose of determining a new location for said data block; and,
writing said data block to its said new location.
38. The computer executable code of claim 37 , wherein writing said data block further comprising: encrypting at the host said data block.
39. The computer executable code of claim 37 , wherein said mapping function determines said new location according to said original location and secret key.
40. The computer executable code of claim 37 , wherein said data block is transmitted from said host to said storage device over a distributed storage network.
41. The computer executable code of claim 40 , wherein said distributed storage network is at least one of: storage area network (SAN), network attached storage (NAS).
42. The computer executable code of claim 40 , wherein said storage device is at least one of: tape drive, optical drive, disk, sub-disk, redundant array of independent disks (RAID).
43. A host computer for the purpose of securing data by performing block level encryption, said host computer comprising at least:
an encryption engine;
a decryption engine;
a host initiator;
a connection to a network, the network being coupled to at least a storage gateway;
means for receiving a write small computer system interface (SCSI) command from the host initiator, said write SCSI command including at least a data block and a location in a storage device into where said block is to be written to;
means for saving a private encryption key associated with said data block in a key management table (KMT); and,
means for distributing said private encryption key to other hosts having an access to said data block.