Method, apparatus and computer program product for managing encryption key in a storage system
Techniques manage an encryption key in a storage system. The techniques involve: transmitting an encryption key request from a storage management component to a key management service component; obtaining, via the key management service component, an encryption key encrypted by the key management service component based on the encryption key request; providing the obtained encrypted encryption key to the storage management component; maintaining, in the storage management component, correspondence between the encrypted encryption key and a storage device; and registering, according to the correspondence, the encrypted encryption key corresponding to the storage device to an encryption hardware unit, such that the encryption hardware unit can decrypt the encrypted encryption key to obtain the encryption key corresponding to the storage device. Effective management of the encryption key is thus realized.
1. A method of managing an encryption key in a storage system, comprising:
transmitting an encryption key request from a storage management component to a key management service component;
obtaining, via the key management service component, an encryption key encrypted by the key management service component based on the encryption key request;
providing the obtained encrypted encryption key to the storage management component;
maintaining, in the storage management component, correspondence between the encrypted encryption key and a storage device; and
registering, according to the correspondence, the encrypted encryption key corresponding to the storage device to an encryption hardware unit, such that the encryption hardware unit can decrypt the encrypted encryption key to obtain the encryption key corresponding to the storage device,
wherein the storage device corresponding to the encrypted encryption key comprises a physical disk which maps to a virtual disk object corresponding to the encrypted encryption key in a disk extent pool,
wherein the encryption key request conveys at least identity information of the disk extent pool and the virtual disk object associated with the request, and
wherein obtaining the encrypted encryption key based on the encryption key request includes accessing the encrypted encryption key from a mapping table indexed at least by the identity information of the disk extent pool and the virtual disk object.
2. The method of claim 1 , wherein when the storage management component determines an input/output operation request for the storage device, the encryption hardware unit can encrypt or decrypt data corresponding to the input/output operation request by using the encryption key.
3. The method of claim 1 , wherein a type of the encryption key request includes one or more of an encryption key creating request, an encryption key retrieving request, an encryption key updating request, and an encryption key deleting request.
4. The method of claim 3 , wherein obtaining, via the key management service component, an encrypted encryption key based on the encryption key request comprises:
in response to the encryption key creating request, creating an encrypted encryption key corresponding to the encryption key creating request via the key management service component; and
storing the created encrypted encryption key in a specified storage area of a system disk of the storage system.
5. The method of claim 3 , wherein obtaining, via the key management service component, an encrypted encryption key based on the encryption key request comprises:
in response to the encryption key retrieving request, retrieving, via the key management service component, an encrypted encryption key corresponding to the encryption key retrieving request from a specified storage area of a system disk of the storage system.
6. The method of claim 3 , wherein obtaining, via the key management service component, an encrypted encryption key based on the encryption key request comprises:
in response to the encryption key updating request,
creating, via the key management service component, a new encrypted encryption key corresponding to the encryption key updating request;
deleting, from a specified storage area of a system disk of the storage system, an encrypted encryption key to be updated, which is corresponding to the encryption key updating request; and
storing the created new encrypted encryption key in the specified storage area of the system disk of the storage system.
7. The method of claim 3 , further comprising:
in response to the encryption key deleting request, deleting an encrypted encryption key corresponding to the encryption key deleting request from a specified area of a system disk of the storage system.
8. The method of claim 1 , wherein the identity information of the disk extent pool and the virtual disk object comprises: a number of the disk extent pool and an identity of the virtual disk object.
9. The method of claim 1 , wherein maintaining, in the storage management component, correspondence between the encrypted encryption key and a storage device comprises:
maintaining, in the storage management component, correspondence between the encrypted encryption key and the virtual disk object in the disk extent pool.
10. The computer program product of claim 1 , further comprising configuring the virtual disk object using a data structure having a first set of bits that represent a disk index of the virtual disk object in the disk extent pool, and a second set of bits that represent a number of the disk extent pool to which the virtual disk object belongs.
11. A computer program product having a non-transitory computer readable medium which stores a set of instructions for managing an encryption key in a storage system; the set of instructions, when carried out by computerized circuitry of the storage system, causing the computerized circuitry to perform a method of:
transmitting an encryption key request from a storage management component to a key management service component;
obtaining, via the key management service component, an encryption key encrypted by the key management service component based on the encryption key request;
providing the obtained encrypted encryption key to the storage management component;
maintaining, in the storage management component, correspondence between the encrypted encryption key and a storage device; and
registering, according to the correspondence, the encrypted encryption key corresponding to the storage device to an encryption hardware unit, such that the encryption hardware unit can decrypt the encrypted encryption key to obtain the encryption key corresponding to the storage device,
wherein the storage device corresponding to the encrypted encryption key comprises a physical disk which maps to a virtual disk object corresponding to the encrypted encryption key in a disk extent pool,
wherein the encryption key request conveys at least identity information of the disk extent pool and the virtual disk object associated with the request, and
wherein obtaining the encrypted encryption key based on the encryption key request includes accessing the encrypted encryption key from a mapping table indexed at least by the identity information of the disk extent pool and the virtual disk object.
12. An apparatus for managing an encryption key in a storage system, comprising:
a processor; and
a memory coupled to the processor and having instructions stored therein, which, when executed by the processor, cause the apparatus to perform acts of:
transmitting an encryption key request from a storage management component to a key management service component;
obtaining, via the key management service component, an encryption key encrypted by the key management service component based on the encryption key request;
providing the obtained encrypted encryption key to the storage management component;
maintaining, in the storage management component, correspondence between the encrypted encryption key and a storage device; and
registering, according to the correspondence, an encrypted encryption key corresponding to the storage device to an encryption hardware unit, such that the encryption hardware unit can decrypt the encrypted encryption key to obtain the encryption key corresponding to the storage device,
wherein the storage device corresponding to the encrypted encryption key comprises a physical disk which maps to a virtual disk object corresponding to the encrypted encryption key in a disk extent pool,
wherein the encryption key request conveys at least identity information of the disk extent pool and the virtual disk object associated with the request, and
wherein obtaining the encrypted encryption key based on the encryption key request includes accessing the encrypted encryption key from a mapping table indexed at least by the identity information of the disk extent pool and the virtual disk object.
13. The apparatus of claim 12 , wherein when the storage management component determines an input/output operation request for the storage device, the encryption hardware unit can encrypt or decrypt data corresponding to the input/output operation request by using the encryption key.
14. The apparatus of claim 12 , wherein a type of the encryption key request includes one or more of an encryption key creating request, an encryption key retrieving request, an encryption key updating request, and an encryption key deleting request.
15. The apparatus of claim 14 , wherein obtaining, via the key management service component, an encrypted encryption key based on the encryption key request comprises:
in response to the encryption key creating request, creating an encrypted encryption key corresponding to the encryption key creating request via the key management service component; and
storing the created encrypted encryption key in a specified storage area of a system disk of the storage system.
16. The apparatus of claim 14 , wherein obtaining, via the key management service component, an encrypted encryption key based on the encryption key request comprises:
in response to the encryption key retrieving request, retrieving, via the key management service component, an encrypted encryption key corresponding to the encryption key retrieving request from a specified storage area of a system disk of the storage system.
17. The apparatus of claim 14 , wherein obtaining, via the key management service component, an encrypted encryption key based on the encryption key request comprises:
in response to the encryption key updating request,
creating, via the key management service component, a new encrypted encryption key corresponding to the encryption key updating request,
deleting, from a specified storage area of a system disk of the storage system, an encrypted encryption key to be updated, which is corresponding to the encryption key updating request, and
storing the created new encrypted encryption key in the specified storage area of the system disk of the storage system.
18. The apparatus of claim 14 , wherein the instructions, when executed by the processor, further cause the apparatus to perform acts of:
in response to the encryption key deleting request, deleting an encrypted encryption key corresponding to the encryption key deleting request from a specified storage area of a system disk of the storage system.
19. The apparatus of claim 12 , wherein the identity information of the disk extent pool and the virtual disk object comprises: a number of the disk extent pool and an identity of the virtual disk object.
20. The apparatus of claim 12 , wherein maintaining, in the storage management component, correspondence between the encrypted encryption key and a storage device comprises:
maintaining, in the storage management component, correspondence between the encrypted encryption key and the virtual disk object in the disk extent pool.
21. The computer program product of claim 11 , wherein the disk extent pool to which the virtual disk object belongs is a pool that includes multiple virtual disk objects that implement a mapped RAID architecture.