Method for verifying correct encryption key utilization
View Patent ↗Methods and systems are provided for verifying use of encryption keys. A request for verification information may be sent by a network element (e.g., server), with the request comprising combination of one or more identifiers, the combination associated with a particular I/O operation. The request may be sent to another element, which may be a centralized encryption management element (e.g., management server). In response to the request, key use verification information generated for the particular I/O operation may be received, and may be used thereafter in validating a corresponding encryption key, which may be used during data encryption or decryption, based on the received key use verification information and locally generated verification information associated with the particular I/O operation. The one or more identifiers include at least one of a target identifier, a LUN identifier, and a LBA range identifier.
1. A method comprising:
in a network device:
sending a request comprising a combination of one or more identifiers, the combination associated with a particular I/O operation;
receiving key use verification information generated for the particular I/O operation; and
validating an encryption key, used during data encryption or decryption, based on the received key use verification information and locally generated verification information associated with the particular I/O operation.
2. The method of claim 1 , wherein the one or more identifiers comprise a target identifier and a LUN identifier.
3. The method of claim 2 , wherein the one or more identifiers further comprise a LBA range identifier.
4. The method of claim 2 , comprising applying a hash algorithm to the target identifier and the LUN identifier when the locally generated verification information is generated.
5. The method of claim 4 , comprising applying the hash algorithm to a LBA range identifier when the locally generated verification information is generated.
6. The method of claim 4 , wherein applying the hash algorithm further comprises:
concatenating the target identifier and the LUN identifier to generate an intermediate identifier; and
hashing the intermediate identifier.
7. The method of claim 6 , wherein applying the hash algorithm further comprises concatenating a LBA range identifier to the hashed intermediate identifier.
8. The method of claim 2 , comprising, when the locally generated verification information is generated:
concatenating the target identifier and the LUN identifier; and
calculating a CRC on the concatenated target identifier and the LUN identifier.
9. The method of claim 8 , comprising concatenating a LBA range identifier to the CRC when the locally generated verification information is generated.
10. The method of claim 1 , wherein the key use verification information and the locally generated verification information are generated using a common formula.
11. A system, comprising:
a server that comprises at least one processor and at least one memory component, the server being operable to:
send to a key management server a request comprising a combination of one or more identifiers, the combination associated with a particular I/O operation;
receive from the key management server key use verification information generated for the particular I/O operation; and
validate an encryption key, used during data encryption or decryption, based on the received key use verification information and locally generated verification information associated with the particular I/O operation.
12. The system of claim 11 , wherein the one or more identifiers comprise a target identifier and a LUN identifier.
13. The system of claim 12 , wherein the one or more identifiers further comprise a LBA range identifier.
14. The system of claim 12 , wherein the server is operable to apply a hash algorithm to the target identifier and the LUN identifier when the locally generated verification information is generated.
15. The system of claim 14 , wherein the server is operable to apply the hash algorithm to a LBA range identifier when the locally generated verification information is generated.
16. The system of claim 14 , wherein applying the hash algorithm further comprises:
concatenating the target identifier and the LUN identifier to generate an intermediate identifier; and
hashing the intermediate identifier.
17. The system of claim 16 , wherein applying the hash algorithm further comprises concatenating a LBA range identifier to the hashed intermediate identifier.
18. The system of claim 12 , wherein the server is operable to, when the locally generated verification information is generated:
concatenate the target identifier and the LUN identifier; and
calculate a CRC from the concatenated target identifier and the LUN identifier.
19. The method of claim 18 , wherein the server is operable to concatenate a LBA range identifier to the CRC when the locally generated verification information is generated.
20. The system of claim 11 , wherein the key use verification information and the locally generated verification information are generated using a common formula.
21. The system of claim 11 , wherein the server is operable to receive the encryption key from the key management server.