Encryption keys from storage systems
View Patent ↗In some examples, a storage system includes a controller to receive a request for a data encryption key from the host system, in response to the request, retrieve, from a key manager system, the data encryption key for the host system, and encrypt the data encryption key retrieved from the key manager system using a first key, to produce an encrypted data encryption key. The controller sends the encrypted data encryption key to the host system, and receives, from the host system, encrypted data encrypted using the data encryption key.
1. A storage system comprising:
a communication interface to communicate with a host system that is able to access data stored by the storage system; and
a controller to:
receive a request for a data encryption key from the host system over a network, the request comprising an identifier of the host system or an identifier of a storage object to be accessed;
in response to the request, retrieve, from a key manager system, the data encryption key for the host system, wherein the controller is to retrieve the data encryption key for the host system from the key manager system by sending, to the key manager system, a request including a key identifier that is based on the identifier of the host system or the identifier of the storage object to be accessed, and wherein the storage system is separate from each of the host system and the key manager system;
encrypt the data encryption key retrieved from the key manager system using a first key, to produce an encrypted data encryption key;
send the encrypted data encryption key to the host system; and
receive, from the host system, encrypted data encrypted using the data encryption key.
2. The storage system of claim 1 , wherein the encrypted data encryption key is sent to a network interface controller or a storage driver of the host system, and wherein the encrypted data received from the host system is encrypted by the network interface controller or the storage driver using the data encryption key.
3. The storage system of claim 1 , wherein the controller is to translate the identifier of the host system to the key identifier included in the request sent to the key manager system.
4. The storage system of claim 1 , wherein the controller is to translate the identifier of the storage object to the key identifier included in the request sent to the key manager system.
5. The storage system of claim 1 , wherein the controller is to look up the key identifier included in the request sent to the key manager system from the identifier of the host system or the identifier of the storage object.
6. The storage system of claim 1 , wherein the first key is from the host system and is a public key of the host system.
7. The storage system of claim 6 , wherein the encrypted data is encrypted using the data encryption key determined by the host system from the encrypted data encryption key by decrypting the encrypted data encryption key using a private key of the host system.
8. The storage system of claim 1 , wherein the data encryption key retrieved by the storage system from the key manager system is obtained by the key manager system by accessing a key repository that correlates key identifiers to corresponding data encryption keys, wherein the key identifier included in the request from the storage system to the key manager system correlates to the data encryption key in the key repository.
9. The storage system of claim 1 , wherein the controller is to:
receive, from the host system, information associated with the data encryption key as part of an access of data by the host system; and
decrypt encrypted data associated with a data service of the storage system in response to receiving the information associated with the data encryption key.
10. The storage system of claim 9 , wherein the information associated with the data encryption key comprises the key identifier of the data encryption key.
11. The storage system of claim 10 , wherein the controller does not decrypt the encrypted data associated with the data service if the host system does not provide the information associated with the data encryption key as part of the access of data by the host system.
12. The storage system of claim 9 , wherein the information associated with the data encryption key comprises the identifier of the host system.
13. The storage system of claim 1 , wherein the controller is to manage access of the data encryption key responsive to the request for the data encryption key based on whether the host system is authorized.
14. A method of a storage system comprising a hardware processor, comprising:
receiving, at the storage system, a first key from a host system;
receiving, at the storage system, a request for a data encryption key from the host system, the request comprising an identifier of the host system or an identifier of a storage object to be accessed by the host system;
in response to the request, sending, from the storage system over a network to a key manager system, a key identifier for the data encryption key, the key identifier being based on the identifier of the host system or the identifier of the storage object to be accessed, wherein the storage system is separate from each of the host system and the key manager system;
receiving, at the storage system over the network from the key manager system, the data encryption key obtained by the key manager system by accessing a key repository that correlates key identifiers to corresponding data encryption keys, wherein the key identifier sent from the storage system to the key manager system correlates to the data encryption key in the key repository;
encrypting, at the storage system, the data encryption key using the first key, to produce an encrypted data encryption key;
sending the encrypted data encryption key from the storage system to the host system; and
receiving, at the storage system from the host system, encrypted data encrypted using the data encryption key derived by the host system based on decrypting the encrypted data encryption key.
15. The method of claim 14 , wherein the first key is a public key.
16. The method of claim 15 , wherein the encrypted data is encrypted using the data encryption key derived by the host system based on decrypting the encrypted data encryption key with a private key.
17. The method of claim 14 , further comprising:
receiving, from the host system, information associated with the data encryption key as part of an access of data by the host system; and
decrypting, by the storage system, encrypted data associated with a data service of the storage system in response to receiving the information associated with the data encryption key.
18. A non-transitory machine-readable storage medium comprising instructions that upon execution cause a storage system to:
receive a public key from a host system;
receive, at the storage system, a request for a data encryption key from the host system, the request comprising an identifier of the host system or an identifier of a storage object to be accessed by the host system;
in response to the request, send, from the storage system over a network to a key manager system, a key identifier for the data encryption key, the key identifier being based on the identifier of the host system or the identifier of the storage object to be accessed by the storage system, wherein the storage system is separate from each of the host system and the key manager system;
receive, at the storage system over the network from the key manager system, the data encryption key obtained by the key manager system by accessing a key repository that correlates key identifiers to corresponding data encryption keys, wherein the key identifier sent from the storage system to the key manager system correlates to the data encryption key in the key repository;
encrypt the data encryption key using the public key, to produce an encrypted data encryption key;
send, from the storage system, the encrypted data encryption key to the host system;
receive, from the host system, encrypted data encrypted using the data encryption key derived by the host system based on decrypting the encrypted data encryption key using a private key of the host system; and
store the encrypted data in a storage medium of the storage system.
19. The non-transitory machine-readable storage medium of claim 18 , wherein the instructions upon execution cause the storage system to:
manage access of the data encryption key responsive to the request for the data encryption key based on whether the host system is authorized.