Methods and systems for securing data stored at a storage area network

1. A machine implemented method, comprising:

providing context information associated with a workflow handle for an input/output (I/O) operation to a security module by an adapter communicating with a computing device and a storage device via a network, the I/O operation is one of a read request to retrieve data from the storage device by the adapter and a write request to transmit data on behalf of the computing device by the adapter; wherein the context information includes a plurality of header fields that remain constant during an I/O sequence for the I/O operation and include information to predict frame headers by the security module without examining any frame headers that are transmitted and received by the adapter;

storing encryption parameters associated with a security association handle by the security module, the security association handle associated with the workflow handle and the context information;

using the workflow handle by the security module to obtain the security association handle for retrieving stored encryption parameters for encrypting payload transmitted by the adapter for the write request and for decrypting payload received by the adapter for the read request;

wherein for the write request:

only using the context information by the security module for predicting a first frame header for encrypting the payload to be transmitted by the adapter;

providing the encrypted payload for transmission to the adapter by the security module after discarding the first predicted header;

appending a header for the encrypted payload by the adapter, before transmitting the encrypted payload; and

wherein for the read request:

receiving a frame with the payload by the adapter;

discarding the frame header by the adapter and providing the payload to the security module for decryption;

only using the context information by the security module for predicting a second frame header for decrypting the payload in the received frame by the adapter; and

providing the decrypted payload to the computing device by the security module, after discarding the second predicted header.

2. The method of claim 1 , wherein the security module communicates with the computing device using a PCI-Express link.

3. The method of claim 1 , wherein the adapter is a host bus adapter that communicates with the security module using a PCI-Express link.

4. The method of claim 1 , wherein the first predicted frame header and the second predicted frame header are Fibre Channel headers for received and transmitted Fibre Channel frames.

5. The method of claim 4 , wherein the adapter pre-processes a received encrypted Fibre Channel frame, discards a header from the received Fibre Channel frame and the security module predicts the Fibre Channel header.

6. The method of claim 4 , wherein to transmit an encrypted Fibre Channel frame, the adapter adds the Fibre Channel frame header, after the frame is encrypted by the security module.

7. The method of claim 4 , wherein the security module computes and compares an authentication tag to decrypt an encrypted Fibre Channel frame.

8. A non-transitory, machine readable storage medium having stored thereon instructions for performing a method, comprising machine executable code which when executed by at least one machine, causes the machine to:

provide context information associated with a workflow handle for an input/output (I/O) operation to a security module by an adapter communicating with a computing device and a storage device via a network, the I/O operation is one of a read request to retrieve data from the storage device by the adapter and a write request to transmit data on behalf of the computing device by the adapter; wherein the context information includes a plurality of header fields that remain constant during an I/O sequence for the I/O operation and include information to predict frame headers by the security module without examining any frame headers that are transmitted and received by the adapter;

store encryption parameters associated with a security association handle by the security module, the security association handle associated with the workflow handle and the context information;

use the workflow handle by the security module to obtain the security association handle for retrieving stored encryption parameters for encrypting payload transmitted by the adapter for the write request and for decrypting payload received by the adapter for the read request;

wherein for the write request:

only using the context information by the security module for predicting a first frame header for encrypting the payload to be transmitted by the adapter;

provide the encrypted payload for transmission to the adapter by the security module after discarding the first predicted header;

append a header for the encrypted payload by the adapter, before transmitting the encrypted payload; and

wherein for the read request:

receive a frame with the payload by the adapter;

discard the frame header by the adapter and providing the payload to the security module for decryption;

only using the context information by the security module for predicting a second frame header for decrypting the payload in the received frame by the adapter; and

provide the decrypted payload to the computing device by the security module, after discarding the second predicted header.

9. The non-transitory, storage medium of claim 8 , wherein the security module communicates with the computing device using a PCI-Express link.

10. The non-transitory, storage medium of claim 8 , wherein the adapter is a host bus adapter that communicates with the security module using a PCI-Express link.

11. The non-transitory, storage medium of claim 8 , wherein the first predicted frame header and the second predicted frame header are Fibre Channel headers for received and transmitted Fibre Channel frames.

12. The non-transitory, storage medium of claim 11 , wherein the adapter pre-processes a received encrypted Fibre Channel frame, discards a header from the received Fibre Channel frame and the security module predicts the Fibre Channel header.

13. The non-transitory, storage medium of claim 11 , wherein to transmit an encrypted Fibre Channel frame, the adapter adds the Fibre Channel frame header, after the frame is encrypted by the security module.

14. The non-transitory, storage medium of claim 11 , wherein the security module computes and compares an authentication tag to decrypt an encrypted Fibre Channel frame.

15. A system comprising:

a computing device having a processor executing instructions out of a memory and interfacing with an adapter that receives frames from another device and transmits frames to the other device; and

a security module coupled to the computing device and the adapter;

wherein the adapter provides context information associated with a workflow handle for an input/output (I/O) operation to the security module, where the I/O operation is one of a read request to retrieve data from the storage device by the adapter and a write request to transmit data on behalf of the computing device by the adapter;

wherein the context information includes a plurality of header fields that remain constant during an I/O sequence for the I/O operation and include information to predict frame headers by the security module without examining any frame headers that are transmitted and received by the adapter;

wherein the security module stores encryption parameters associated with a security association handle that is associated with the workflow handle and the context information; uses the workflow handle to obtain the security association handle for retrieving stored encryption parameters for encrypting payload transmitted by the adapter for the write request and for decrypting payload received by the adapter for the read request;

wherein for the write request, the security module predicts a first frame header by only using the context information for encrypting the payload transmitted by the adapter; provides the encrypted payload for transmission to the adapter, after discarding the first predicted header; and the adapter appends a header for the encrypted payload, before transmitting the encrypted payload; and

wherein for the read request, the adapter discards the frame header for a frame received by the adapter, and the security module uses the context information to predict a second frame header for decrypting the payload and then provides the decrypted payload to the computing device, after discarding the second predicted header.

16. The system of claim 15 , wherein the security module communicates with the computing device using a PCI-Express link.

17. The system of claim 15 , wherein the adapter is a host bus adapter that communicates with the security module using a PCI-Express link.

18. The system of claim 15 , wherein the first predicted frame header and the second predicted frame header are Fibre Channel headers for received and transmitted Fibre Channel frames.

19. The system of claim 18 , wherein the adapter pre-processes a received encrypted Fibre Channel frame, discards a header from the received Fibre Channel frame and the security module predicts the Fibre Channel header.

20. The system of claim 18 , wherein to transmit an encrypted Fibre Channel frame, the adapter adds the Fibre Channel frame header, after the frame is encrypted by the security module.