Systems and methods for minimizing boot time when using a unique key encryption key per storage resource in secure enterprise key management provisioning
In accordance with embodiments of the present disclosure, a key management utility may be configured to, during boot of an information handling system, prioritize retrieval of key encryption keys of bootable storage resources of a plurality of storage resources over retrieval of key encryption keys of non-bootable storage resources of the plurality of storage resources and prioritize decryption of media encryption keys of bootable storage resources of the plurality of storage resources using their corresponding key encryption keys over decryption of media encryption keys of non-bootable storage resources of the plurality of storage resources using their corresponding key encryption keys.
1. An information handling system comprising:
a processor;
a plurality of storage resources communicatively coupled to the processor, each storage resource having a media encryption key for encrypting data written to such storage resource and decrypted data read from such storage resource, wherein such media encryption key is encrypted by a corresponding key encryption key, such that a unique key encryption key exists for each of the plurality of storage resources;
a storage controller communicatively coupled to the processor and the plurality of storage resources and configured to manage one or more functions of the plurality of storage resources; and
a management controller communicatively coupled to the processor and configured to, during boot of the information handling system and in concert with the storage controller, prioritize retrieval of key encryption keys of bootable storage resources of the plurality of storage resources over retrieval of key encryption keys of non-bootable storage resources of the plurality of storage resources and prioritize decryption of media encryption keys of bootable storage resources of the plurality of storage resources using their corresponding key encryption keys over decryption of media encryption keys of non-bootable storage resources of the plurality of storage resources using their corresponding key encryption keys.
2. The information handling system of claim 1 , wherein the management controller is further configured to:
retrieve unique identifiers associated with the bootable storage resources; and
based on such unique identifiers, prioritize retrieval of key encryption keys of bootable storage resources over retrieval of key encryption keys of non-bootable storage resources.
3. The information handling system of claim 2 , wherein the management controller is configured to retrieve key encryption keys of the plurality of storage resources from a key management server communicatively coupled to the management controller via a network.
4. The information handling system of claim 2 , wherein the management controller is further configured to, based on such unique identifiers, prioritize transmission of key encryption keys of bootable storage resources to the storage controller over retrieval of key encryption keys of non-bootable storage resources.
5. The information handling system of claim 4 , wherein the storage controller is configured to prioritize decryption of media encryption keys of bootable storage resources over decryption of media encryption keys of non-bootable storage resources based on an order of receipt of key encryption keys from the management controller.
6. The information handling system of claim 2 , wherein the management controller is configured to retrieve the unique identifiers associated with the bootable storage resources from a boot list of unique identifiers created during factory provisioning of the information handling system.
7. The information handling system of claim 2 , wherein the management controller is configured to retrieve the unique identifiers associated with the bootable storage resources from a boot list of unique identifiers created during intended end use of the information handling system.
8. A management controller configured for management of an information handling system comprising a processor, a plurality of storage resources communicatively coupled to the processor, each storage resource having a media encryption key for encrypting data written to such storage resource and decrypted data read from such storage resource, wherein such media encryption key is encrypted by a corresponding key encryption key, such that a unique key encryption key exists for each of the plurality of storage resources, the management controller comprising:
a communication interface for communicatively coupling to a storage controller communicatively coupled to the processor and the plurality of storage resources and configured to manage one or more functions of the plurality of storage resources; and
a key management utility configured to, during boot of the information handling system and in concert with the storage controller, prioritize retrieval of key encryption keys of bootable storage resources of the plurality of storage resources over retrieval of key encryption keys of non-bootable storage resources of the plurality of storage resources and prioritize decryption of media encryption keys of bootable storage resources of the plurality of storage resources using their corresponding key encryption keys over decryption of media encryption keys of non-bootable storage resources of the plurality of storage resources using their corresponding key encryption keys.
9. The management controller of claim 8 , wherein the key management utility is further configured to:
retrieve unique identifiers associated with the bootable storage resources; and
based on such unique identifiers, prioritize retrieval of key encryption keys of bootable storage resources over retrieval of key encryption keys of non-bootable storage resources.
10. The management controller of claim 9 , wherein the key management utility is configured to retrieve key encryption keys of the plurality of storage resources from a key management server communicatively coupled to the management controller via a network.
11. The management controller of claim 9 , wherein the key management utility is further configured to, based on such unique identifiers, prioritize transmission of key encryption keys of bootable storage resources to the storage controller over retrieval of key encryption keys of non-bootable storage resources.
12. The management controller of claim 11 , wherein the storage controller is configured to prioritize decryption of media encryption keys of bootable storage resources over decryption of media encryption keys of non-bootable storage resources based on an order of receipt of key encryption keys from the management controller.
13. The management controller of claim 9 , wherein the key management utility is configured to retrieve the unique identifiers associated with the bootable storage resources from a boot list of unique identifiers created during factory provisioning of the information handling system.
14. The management controller of claim 9 , wherein the key management utility is configured to retrieve the unique identifiers associated with the bootable storage resources from a boot list of unique identifiers created during intended end use of the information handling system.
15. A method for use in an information handling system comprising a processor, and a plurality of storage resources communicatively coupled to the processor, each storage resource having a media encryption key for encrypting data written to such storage resource and decrypted data read from such storage resource, wherein such media encryption key is encrypted by a corresponding key encryption key, such that a unique key encryption key exists for each of the plurality of storage resources, the method comprising, during boot of the information handling system:
identifying bootable storage resources of the plurality of storage resources;
prioritizing retrieval of key encryption keys of bootable storage resources of the plurality of storage resources over retrieval of key encryption keys of non-bootable storage resources of the plurality of storage resources; and
prioritizing decryption of media encryption keys of bootable storage resources of the plurality of storage resources using their corresponding key encryption keys over decryption of media encryption keys of non-bootable storage resources of the plurality of storage resources using their corresponding key encryption keys.
16. The method of claim 15 , further comprising:
retrieving unique identifiers associated with the bootable storage resources in order to identify the bootable storage resources; and
based on such unique identifiers, prioritizing retrieval of key encryption keys of bootable storage resources over retrieval of key encryption keys of non-bootable storage resources.
17. The method of claim 16 , further comprising retrieving key encryption keys of the plurality of storage resources from a key management server communicatively coupled to the management controller via a network.
18. The method of claim 16 , further comprising, based on such unique identifiers, prioritizing transmission of key encryption keys of bootable storage resources to a storage controller for managing the plurality of storage resources over retrieval of key encryption keys of non-bootable storage resources.
19. The method of claim 18 , wherein the storage controller is configured to prioritize decryption of media encryption keys of bootable storage resources over decryption of media encryption keys of non-bootable storage resources based on an order of receipt of key encryption keys from the management controller.
20. The method of claim 16 , further comprising retrieving the unique identifiers associated with the bootable storage resources from a boot list of unique identifiers created during factory provisioning of the information handling system.
21. The method of claim 16 , further comprising retrieving the unique identifiers associated with the bootable storage resources from a boot list of unique identifiers created during intended end use of the information handling system.