Storage system and method for controlling storage system
View Patent ↗The storage system according to the present invention has a function to encrypt write data from the host and store the same in a storage media. Further, validation information of write data is added to the write data during storage thereof, and the data having the validation information added thereto is encrypted and stored in the storage media. When starting the storage system or restoring the encryption key information, the encrypted data stored in the storage media is read from the disk and decrypted prior to receiving a data access request from the host, and validation of data is performed using the validation information added to the decrypted data, so as to determine whether the encryption key stored in a storage controller is valid or not.
1. A storage system comprising a controller and one or more storage media; wherein
a host for reading and writing data in the storage media and a management terminal for performing a management operation of the storage system are connected to the storage system;
the controller has a storage area for storing an encryption key, and when a write request from the host is received, the controller creates a validation information corresponding to data accompanying the write request, adds the validation information to the data, encrypts the data having the validation information added thereto using the encryption key stored in the storage area and stores the same in the storage media;
when a second encryption key is stored in the storage area, prior to receiving an access request to the storage media from the host, the controller:
reads the encrypted data having the validation information added thereto and stored in the storage media;
decrypts the encrypted data having the validation information added thereto using the second encryption key;
validates the decrypted data using the decrypted validation information; and
when the result of the validation is abnormal, displays that abnormality has occurred on a management screen of the management terminal, and
wherein
the validation information includes a position information of the data write destination included in the write request; and
when validating the decrypted data using the validation information, the controller:
displays that abnormality has occurred on the management screen of the management terminal if the information related to the storage position of the encrypted data stored in the storage media and the position information of the write destination of the data included in the decrypted validation information are inconsistent.
2. The storage system according to claim 1 , wherein
the validation information includes an error-detecting code created by executing a given operation to the data;
when validating the decrypted data using the validation information, the controller:
creates a second validation information by executing the given operation to the decrypted data using the second encryption key; and
displays that abnormality has occurred on the management screen of the management terminal if the second validation information and the error-detecting code included in the decrypted validation information are inconsistent.
3. The storage system according to claim 1 , wherein
the second encryption key is a replica of the encryption key stored in the storage area saved in a given area of the storage media;
the controller stores the second encryption key saved in a portion of the storage media to the storage area when starting the storage system; and
when validating the decrypted data using the validation information, the controller uses the second encryption key stored in the storage area to decrypt the encrypted data having the validation information added thereto.
4. The storage system according to claim 3 , wherein
the controller discontinues a starting process of the storage system if the result of validation is abnormal in the validation of the decrypted data using the validation information.
5. The storage system according to claim 3 , wherein
the controller re-reads the encrypted data having the validation information added thereto from the storage media if the result of validation is abnormal in the validation of the data decrypted using the validation information; and
decrypts the re-read data using the second encryption key, and performs validation using the validation information included in the decrypted re-read data, and if the result of the validation is not abnormal, continues a starting process of the storage system.
6. The storage system according to claim 1 , wherein
the storage system has a key management server performing backup and/or restoration of the encryption key connected thereto;
the second encryption key is a replica of the encryption key stored in the storage area subjected to back-up in the key management server;
when the controller receives the second encryption key from the key management server, prior to receiving an access request from the host to the storage media, the controller
reads the encrypted data having the validation information added thereto and stored in the storage media;
decrypts the encrypted data having the validation information added thereto using the received second encryption key; and
performs validation of the decrypted data using the decrypted validation information.
7. The storage system according to claim 6 , wherein
when performing validation of the decrypted data using the validation information, if the result of the validation is not abnormal, the controller stores the received second encryption key in the storage area.
8. A method for controlling a storage system, the storage system comprising a controller and one or more storage media; wherein
a host for reading and writing data in the storage media and a management terminal for performing a management operation of the storage system are connected to the storage system;
the controller has a storage area for storing an encryption key, and when a write request from the host is received, the controller creates a validation information corresponding to data accompanying the write request, adds the validation information to the data, encrypts the data having the validation information added thereto using the encryption key stored in the storage area and stores the same in the storage media;
when a second encryption key is stored in the storage area, prior to receiving an access request to the storage media from the host, the controller:
reads the encrypted data having the validation information added thereto and stored in the storage media;
decrypts the encrypted data having the validation information added thereto using the second encryption key;
validates the decrypted data using the decrypted validation information; and
when the result of the validation is abnormal, displays that abnormality has occurred on a management screen of the management terminal, and
wherein
the validation information includes a position information of the data write destination included in the write request; and
when validating the decrypted data using the validation information, the controller:
displays that abnormality has occurred on the management screen of the management terminal if the information related to the storage position of the encrypted data stored in the storage media and the position information of the write destination of the data included in the decrypted validation information are inconsistent.
9. The method for controlling a storage system according to claim 8 , wherein
the validation information includes an error-detecting code created by executing a given operation to the data;
when validating the decrypted data using the validation information, the controller:
creates a second validation information by executing the given operation to the decrypted data using the second encryption key; and
displays that abnormality has occurred on the management screen of the management terminal if the second validation information and the error-detecting code included in the decrypted validation information are inconsistent.
10. The method for controlling a storage system according to claim 8 , wherein
the second encryption key is a replica of the encryption key stored in the storage area saved in a given area of the storage media;
the controller stores the second encryption key saved in a portion of the storage media to the storage area when starting the storage system; and
when validating the decrypted data using the validation information, the controller uses the second encryption key stored in the storage area to decrypt the encrypted data having the validation information added thereto.
11. The method for controlling a storage system according to claim 10 , wherein
the controller discontinues a starting process of the storage system if the result of validation is abnormal in the validation of the decrypted data using the validation information.
12. The method for controlling a storage system according to claim 8 , wherein
the storage system has a key management server performing backup and/or restoration of the encryption key connected thereto;
the second encryption key is a replica of the encryption key stored in the storage area subjected to back-up in the key management server;
when the controller receives the second encryption key from the key management server, prior to receiving an access request from the host to the storage media, the controller
reads the encrypted data having the validation information added thereto and stored in the storage media;
decrypts the encrypted data having the validation information added thereto using the received second encryption key; and
performs validation of the decrypted data using the decrypted validation information.
13. The method for controlling a storage system according to claim 12 , wherein
when performing validation of the decrypted data using the validation information, if the result of the validation is not abnormal, the controller stores the received second encryption key in the storage area.