Data encryption for directly connected host
A storage system may assign a different encryption key to each logical storage unit (LSU) of a storage system. For each LSU, the encryption key of the LSU may be shared only with host systems authorized to access data of the LSU. In response to a read request for a data portion received from a host application executing on the host system, encryption metadata for the data portion may be accessed. If it is determined from the encryption metadata that the data portion is encrypted, the data encryption metadata for the data portion may be further analyzed to determine the encryption key for the data portion. The data may be retrieved from the storage system, for example, by performance of a direct read operation. The retrieved data may be decrypted, and the decrypted data may be returned to the requesting application.
1. For a data storage network including a data storage system and a plurality of host systems having applications executing thereon, the execution of which results in data being stored on a plurality of physical storage devices of the data storage system, and wherein the data storage system includes a plurality of logical storage units having storage provisioned from the plurality of physical storage devices, a method comprising:
assigning a first unique encryption key of a plurality of unique encryption keys to a first of the plurality of logical storage units, wherein each of the plurality of logical storage units is assigned a different one of the plurality of unique encryption keys used to directly encrypt all data portions stored on said each logical storage unit in an encrypted form;
providing the first unique encryption key to one or more of the plurality of host systems, wherein each of the one or more host systems has an application executing thereon and is authorized to access the first logical storage unit, wherein said providing the first unique encryption key to one or more of the plurality of host systems further includes:
receiving, at the data storage system from a first of the plurality of host systems, a metadata read instruction requesting encryption metadata for the first logical storage unit, wherein the encryption metadata includes the first unique encryption key assigned to the first logical storage unit;
responsive to receiving the metadata read instruction from the first host system, the data storage system determining, using one or more data structures, that the first host system is authorized to access the first logical storage unit; and
responsive to the data storage system receiving the metadata read instruction from the first host system and the data storage system determining that the first host system is authorized to access the first logical storage unit, sending the encryption metadata including the first unique encryption key to the first host system;
refraining from providing the encryption metadata including the first unique encryption key to any of the plurality of host systems that are not authorized to access the first logical storage unit;
encrypting data portions of the first logical storage unit stored on one or more of the plurality of physical storage devices using the first unique encryption key; and
the first host system reading an encrypted version of a data portion of the first logical storage unit, wherein said reading further includes the first host system sending a data read instruction to a global memory or the one or more physical storage devices on an internal fabric independent of any director of the data storage system, wherein the first host system is directly connected to the internal fabric of the data storage system, and wherein the data read instruction and the metadata read instruction are two separate instructions sent from the first host system to the data storage system.
2. The method of claim 1 , wherein the data storage system determining that the first host system is authorized to access the first logical storage unit further comprises the data storage system:
accessing a data structure that associates logical storage units with host systems to determine whether the first host system is authorized to access the first logical storage unit.
3. The method of claim 1 , further comprising:
responsive to the first host system reading the encrypted version of the data portion from the data storage system, the host system decrypting the encrypted version using the first encryption key to produce an unencrypted version of the data portion.
4. The method of claim 3 , further comprising:
the first host system determining whether the data portion is encrypted from the encryption metadata.
5. The method of claim 3 , wherein the data storage system sets a flag within the encryption metadata for the data portion indicating that the data portion is stored on the data storage system in encrypted form.
6. For a data storage network including a data storage system and a plurality of host systems having applications executing thereon, the execution of which results in data being stored on a plurality of physical storage devices of the data storage system, and wherein the data storage system includes a plurality of logical storage units to having storage provisioned from the plurality of physical storage devices, a system comprising:
one or more processors; and
a memory comprising code thereon that, when executed, performs a method including:
assigning a first unique encryption key of a plurality of unique encryption keys to a first of the plurality of logical storage units, wherein each of the plurality of logical storage units is assigned a different one of the plurality of unique encryption keys used to directly encrypt all data portions stored on said each logical storage unit in an encrypted form;
providing the first unique encryption key to one or more of the plurality of host systems, wherein each of the one or more host systems has an application executing thereon and is authorized to access the first logical storage unit, wherein said providing the first unique encryption key to one or more of the plurality of host systems further includes:
receiving, at the data storage system from a first of the plurality of host systems, a metadata read instruction requesting encryption metadata for the first logical storage unit, wherein the encryption metadata includes the first unique encryption key assigned to the first logical storage unit;
responsive to receiving the metadata read instruction from the first host system, the data storage system determining, using one or more data structures, that the first host system is authorized to access the first logical storage unit; and
responsive to the data storage system receiving the metadata read instruction from the first host system and the data storage system determining that the first host system is authorized to access the first logical storage unit, sending the encryption metadata including the first unique encryption key to the first host system;
refraining from providing the encryption metadata including the first unique encryption key to any of the plurality of host systems that are not authorized to access the first logical storage unit;
encrypting data portions of the first logical storage unit stored on one or more of the plurality of physical storage devices using the first unique encryption key; and
the first host system reading an encrypted version of a data portion of the first logical storage unit, wherein said reading further includes the first host system sending a data read instruction to a global memory or the one or more physical storage devices on an internal fabric independent of any director of the data storage system, wherein the first host system is directly connected to the internal fabric of the data storage system, and wherein the data read instruction and the metadata read instruction are two separate instructions sent from the first host system to the data storage system.
7. The system of claim 6 , wherein the data storage system determining that the first host system is authorized to access the first logical storage unit further comprises the data storage system:
accessing a data structure that associates logical storage units with host systems to determine whether the first host system is authorized to access the first logical storage unit.
8. The system of claim 6 , wherein the method further includes:
responsive to the first host system reading the encrypted version of the data portion from the data storage system, the host system decrypting the encrypted version using the first encryption key to produce an unencrypted version of the data portion.
9. The system of claim 8 , wherein the method further includes:
the first host system determining whether the data portion is encrypted from the encryption metadata.
10. The system of claim 8 , wherein the data storage system sets a flag within the encryption metadata for the data portion indicating that the data portion is stored on the data storage system in encrypted form.
11. For a data storage network including a data storage system and a plurality of host systems having applications executing thereon, the execution of which results in data being stored on a plurality of physical storage devices of the data storage system, and wherein the data storage system includes a plurality of logical storage units having storage provisioned from the plurality of physical storage devices, non-transitory computer-readable media having software stored thereon, the software comprising:
executable code that assigns a first unique encryption key of a plurality of unique encryption keys to a first of the plurality of logical storage units, wherein each of the plurality of logical storage units is assigned a different one of the plurality of unique encryption keys used to directly encrypt all data portions stored on said each logical storage unit in an encrypted form;
executable code that provides the first unique encryption key to one or more of the plurality of host systems, wherein each of the one or more host systems has an application executing thereon and is authorized to access the first logical storage unit, wherein the executable code that provides the first unique encryption key to one or more of the plurality of host systems further includes executable code that performs processing including:
receiving, at the data storage system from a first of the plurality of host systems, a metadata read instruction requesting first encryption metadata for the first logical storage unit, wherein the first encryption metadata includes the first unique encryption key assigned to the first logical storage unit;
responsive to receiving the metadata read instruction from the first host system, the data storage system determining that the first host system is authorized to access the first logical storage unit; and
responsive to the data storage system receiving the metadata read instruction from the first host system and the data storage system determining that the first host system is authorized to access the first logical storage unit, sending the first encryption metadata including the first unique encryption key to the first host system;
executable code that refrains from providing the encryption metadata including the first unique encryption key to any of the plurality of host systems that are not authorized to access the first logical storage unit;
executable code that encrypts data portions of the first logical storage unit stored on one or more of the plurality of physical storage devices using the first unique encryption key; and
executable code that causes the first host to read an encrypted version of a data portion of the first logical storage unit, wherein the executable code that causes the first host to read the encrypted version of the data portion of the first logical storage unit further includes executable code that performs processing including causing the first host system to send a data read instruction to a global memory or the one or more physical storage devices on an internal fabric independent of any director of the data storage system, wherein the first host system is directly connected to the internal fabric of the data storage system, and wherein the data read instruction and the metadata read instruction are two separate instructions sent from the first host system to the data storage system.
12. The non-transitory computer-readable media of claim 11 , wherein the data storage system determining that the first host system is authorized to access the first logical storage unit further comprises the data storage system accessing a data structure that associates logical storage units with host systems to determine whether the first host system is authorized to access the first logical storage unit.
13. The non-transitory computer-readable media of claim 11 , wherein the software further comprises:
executable code that controls the first host system to read the encrypted version of the data portion from the storage system; and
executable code that, responsive to the first host system reading the encrypted version of the data portion from the data storage system, controls and causes the host system decrypting the encrypted version using the first encryption key to produce an unencrypted version of the data portion.
14. The non-transitory computer-readable media of claim 13 , wherein the software further comprises:
executable code that controls the first host system to determine whether the data portion is encrypted from the encryption metadata, wherein the data storage system sets a flag within the encryption metadata for the data portion indicating that the data portion is stored on the data storage system in encrypted form.