Management of encryption agents in data storage systems
A method for managing keys and encrypting data is provided. The method includes receiving data to be written to a logical disk, generating an encryption table indicating one or more locations on the logical disk for storing the data and indicating a key used for encrypting the data, encrypting the data to be written to the logical disk, and transmitting the encrypted data and the encryption table to a storage array.
1. A method, comprising:
receiving data to be written to a logical disk,
generating an encryption table indicating one or more locations on the logical disk for storing the data and indicating a key used for encrypting the data;
encrypting the data to be written to the logical disk for producing encrypted data;
transmitting, from a host system to a storage array, a write request comprising the encrypted data and the encryption table; and
executing the write request by the storage array only when the storage array previously receives, from the host system:
a first command indicating that an encryption agent of the host system is activated, and
a second command notifying the encryption agent to coordinate and synchronize said encrypting with said storage array to secure said encrypted data during said transmitting,
thereby allowing the storage array to perform the steps of
decrypting the encrypted data received from the host, prior to
compressing the data in said storage array, and therafter
encrypting the data in said storage array after said compressing.
2. The method of claim 1 , wherein generating an encryption table comprises:
providing an opaque key identffier, a start offset, a cipher to encrypt the data, and an initial vector.
3. The method of claim 1 , further comprising:
notifying, by the host system, the storage array that the encryption agent of the host system is deactivated; and
responsive to the notifying, blocking, by the storage array, any write request received subsequently from the host system.
4. The method of claim 1 , wherein generating an encryption table comprises:
transmitting the encryption table to the storage array within a payload of a SCSI security protocol out (SPOUT) command.
5. The method of claim 1 , wherein generating an encryption table comprises:
generating an attribute of a key object associated with the key.
6. A tangible, non-transitory, computer-readable media having instructions thereupon which, when executed by a processor, cause the processor to perform a method comprising:
receiving data to be written to a logical disk;
generating an encryption table indicating one or more locations on the logical disk for storing the data and indicating a key used for encrypting the data;
encrypting the data to be written to the logical disk for producing encrypted data;
transmitting, from a host system to a storage array, a write request comprising the encrypted data and the encryption table; and
executing the write request by the storage array only when the storage array previously receives, from the host system:
a first command indicating that an encryption agent of the host system is activated, and
a second command notifying the encryption agent to coordinate and synchronize said encrypting with said storage array to secure said encrypted data during said transmitting,
thereby allowing the storage array to perform the steps of
decrypting the encrypted data received from the host, prior to
compressing the data in said storage array, and therafter
encrypting the data in said storage array after said compressing.
7. The computer readable media of claim 6 , wherein generating an encryption table comprises:
providing an opaque key identifier start offset, a cipher to encrypt the data, and an initial vector.
8. The computer readable media of claim further comprising:
notifying, by the host system, the storage array that the encryption agent of the host system is deactivated; and
responsive to the notifying, blocking, by the storage array, any write request received subsequently from the host system.
9. The computer readable media of claim 6 , wherein generating an encryption table comprises:
transmitting the encryption table to the storage array within a payload of a SCSI security protocol out (SPOUT) command.
10. The computer readable media of claim 6 , wherein generating an encryption table comprises:
generating an attribute of a key object associated with the key.
11. The method of claim 1 , further comprising:
transmitting by the host system the write request to the storage array only after receipt of a response indicating the storage array is notified that the encryption agent is active.
12. The computer readable media of claim 6 , wherein the host system is configured to transmit the write request to the storage array only after receipt of a response indicating the storage array is notified that the encryption agent is active.