Secure data encryption in shared storage using namespaces
View Patent ↗A data storage device in a distributed computing system has physical block addresses that are each allocated to multiple namespaces. To access the data storage device, a host system issues a command to the data storage device that includes an access key and a virtual block address to be accessed. The data storage device converts the virtual block address to a physical block address of the data storage device using a mapping associated with the access key. Access to a physical data block associated with a particular namespace is granted only if an access key for that namespace is provided to the data storage device.
1. An information processing system comprising:
a host system; and
a storage system that includes
a nonvolatile storage device divided into blocks that are addressable using physical block addresses; and
a controller configured to: (i) extract from an input/output command issued by the host system a namespace identification code, an access key for accessing a namespace corresponding to the namespace identification code, and a virtual block address, (ii) authenticate access to the namespace using the access key, (iii) convert the virtual block address to a physical block address using a mapping associated with the namespace, (iv) use the access key to generate an encryption/decryption key for transforming data to be written in or read from the physical block address; and (v) access the nonvolatile storage device at the physical block address converted from the virtual block address.
2. The information processing system of claim 1 , wherein the host system includes multiple client applications and the command issued by the host system is issued by one of the multiple client applications.
3. The information processing system of claim 2 , wherein the one of the multiple client applications is one of multiple virtual machines running in the host system.
4. The information processing system of claim 3 , wherein the host system includes system-level virtualization software that is configured to maintain an access key for each of multiple namespaces.
5. The information processing system of claim 4 , wherein the system-level virtualization software is configured to determine the access key for a namespace in response to a namespace identification code received from a virtual machine.
6. The information processing system of claim 1 , wherein the nonvolatile storage device comprises one of a nonvolatile memory or a hard disk drive.
7. A method of executing a read for a client application running in a host computer that is connected to a storage system having a nonvolatile storage device divided into blocks that are addressable using physical block addresses, said method comprising:
determining an access key associated with a namespace to be accessed when executing the read;
issuing a read command, contents of which include the access key, a namespace identification code corresponding to the namespace to be accessed, and a virtual block address;
generating a decryption key using the access key to transform data to be read from the nonvolatile storage device at a physical block address determined from the virtual block address and a specific mapping for the namespace; and
accessing the nonvolatile storage device at the physical block address for reading.
8. The method of claim 7 , further comprising:
decrypting the data read from the nonvolatile storage device using the decryption key.
9. The method of claim 7 , wherein the specific mapping for the namespace is selected from a plurality of mappings maintained by the storage system using the access key.
10. The method of claim 9 , wherein the storage system maintains a plurality of namespaces and each of the mappings is associated with one of the namespaces.
11. The method of claim 10 , wherein the client application is one of multiple virtual machines running in the host computer.
12. The method of claim 11 , wherein a system-level virtualization software configured to support the virtual machines is configured to maintain the access keys for the virtual machines.
13. A method of executing a write for a client application running in a host computer that is connected to a storage system having a nonvolatile storage device divided into blocks that are addressable using physical block addresses, said method comprising:
determining an access key associated with a namespace to be accessed when executing the write;
issuing a write command, contents of which include the access key, a namespace identification code corresponding to the namespace to be accessed, and a virtual block address;
generating an encryption key using the access key to transform data to be written in the nonvolatile storage device at physical block addresses that are determined from a mapping for the namespace; and
accessing the nonvolatile storage device at the physical block address for writing.
14. The method of claim 13 , further comprising:
encrypting the data to be written using the encryption key prior to writing the data in the nonvolatile storage device.
15. The method of claim 13 , wherein the specific mapping for the namespace is selected from a plurality of mappings maintained by the storage system using the access key.
16. The method of claim 13 , wherein the storage system maintains a plurality of namespaces and each of the mappings is associated with one of the namespaces.
17. The method of claim 16 , wherein the client application is one of multiple virtual machines running in the host computer.
18. The method of claim 17 , wherein a system-level virtualization software configured to support the virtual machines is configured to maintain the access keys for the virtual machines.