Storage system with encrypted data storage device telemetry data
Systems and methods for encrypted storage device telemetry data are described. Storage device telemetry data may be collected for a telemetry message, such as a non-volatile memory express (NVMe) telemetry command, and encrypted using a first encryption key. The first encryption key may be encrypted using one or multiple second encryption keys and the encrypted first encryption key may be added to the telemetry message. A client system may receive the telemetry message, decrypt the encrypted first encryption key, and use the first encryption key to decrypt the encrypted storage device telemetry data.
1. A system, comprising:
a processor;
a memory;
an encryption engine, stored in the memory for execution by the processor, configured to:
receive storage device telemetry data;
determine, from the storage device telemetry data, a first data section and a second data section;
encrypt, using a first encryption key, the first data section of the storage device telemetry data;
encrypt, using a encryption key, the second data section of the storage device telemetry data; and
encrypt, using a third encryption key, the first encryption key and the second encryption key; and
a message handler, stored in the memory for execution by the processor, configured to:
format a telemetry message, wherein the telemetry message includes:
the encrypted first data section of the storage device telemetry data;
the encrypted second data section of the storage device telemetry data;
the encrypted first encryption key and the encrypted second encryption key; and
a table of contents configured to indicate encryption keys used to encrypt each data section of a plurality of data sections of the storage device telemetry data, including the first data section and the second data section; and
send the telemetry message to a first client system configured to decrypt:
the first encryption key from the encrypted first encryption key based on the third encryption key; and
the first data section of the storage device telemetry data from the encrypted first data section of the storage device telemetry data.
2. The system of claim 1 , wherein:
the encryption engine is further configured to encrypt, using a fourth encryption key, the first encryption key;
the telemetry message further includes the encrypted first encryption key based on the fourth encryption key; and
the message handler is further configured to send the telemetry message to a second client system configured to decrypt:
the first encryption key from the encrypted first encryption key based on the fourth encryption key; and
the first data section of the storage device telemetry data from the encrypted first data section of the storage device telemetry data.
3. The system of claim 1 , wherein:
the first encryption key is a symmetric key;
the third encryption key is a public key of a public-private key pair; and
the first client system includes a private encryption key for the public-private key pair of the third encryption key.
4. The system of claim 1 , further comprising a data storage device configured to:
periodically collect telemetry data sets; and
send each telemetry data set of a plurality of data sets to the encryption engine, wherein:
the encryption engine is further configured to encrypt each telemetry data set; and
the message handler is further configured to send each encrypted telemetry data set to the first client system.
5. The system of claim 4 , wherein:
the data storage device includes:
the processor;
the memory;
the encryption engine; and
the message handler;
the data storage device is further configured to generate a new first encryption key for each telemetry data set; and
the encryption engine is further configured to encrypt each telemetry data set using a different first encryption key.
6. The system of claim 5 , wherein:
the data storage device is further configured to use a non-volatile memory express (NVMe) storage protocol; and
the message handler is further configured to use an NVMe telemetry command to send the telemetry message.
7. The system of claim 1 , wherein
the encryption engine is further configured to encrypt the table of contents.
8. The system of claim 1 , wherein:
the telemetry message further includes a sub-header comprising vendor specific protocol requirements for the telemetry message; and
the encryption engine is further configured to encrypt the sub-header.
9. The system of claim 1 , further comprising the first client system, wherein the first client system comprises:
a client processor;
a client memory;
a telemetry data manager, stored in the client memory for execution by the client processor, configured to:
receive the telemetry message;
determine the encrypted first data section of the storage device telemetry data; and
determine the encrypted first encryption key based on the third encryption key; and
a decryption engine, stored in the client memory for execution by the client processor, configured to decrypt:
the first encryption key from the encrypted first encryption key based on the third encryption key; and
the first data section of the storage device telemetry data from the encrypted first data section of the storage device telemetry data.
10. The system of claim 9 , wherein:
the telemetry data manager is further configured to:
store a private encryption key from a public-private key pair for the third encryption key; and
display the first data section of the storage device telemetry data on a user interface;
the storage device telemetry data includes at least one data type selected from:
self-monitoring and reporting technology (SMART) data;
non-volatile memory express (NVMe) data logs;
dynamic storage device configuration data;
event data logs;
debug data;
firmware management data;
error data; and
workload data; and
the decryption engine is further configured to use the private encryption key to decrypt the first encryption key from the encrypted first encryption key.
11. A computer-implemented method, comprising:
collecting storage device telemetry data;
determining, from the storage device telemetry data, a first data section and a second data section;
encrypting, using a first encryption key, the first data section of the storage device telemetry data;
encrypting, using a second encryption key, the second data section of the storage device telemetry data;
encrypting, using a third encryption key, the first encryption key and the second encryption key;
formatting a telemetry message, wherein the telemetry message includes:
the encrypted first data section of the storage device telemetry data;
the encrypted second data section of the storage device telemetry data;
the encrypted first encryption key and the encrypted second encryption key; and
a table of contents configured to indicate encryption keys used to encrypt each data section of a plurality of data sections of the storage device telemetry data, including the first data section and the second data section;
sending the telemetry message to a first client system;
receiving, by the first client system, the telemetry message;
decrypting, by the first client system, the first encryption key from the encrypted first encryption key based on the third encryption key; and
decrypting, by the first client system, the first data section of the storage device telemetry data from the encrypted first data section of the storage device telemetry data.
12. The computer-implemented method of claim 11 , further comprising:
encrypting, using a fourth encryption key, the first encryption key, wherein the telemetry message further includes the encrypted first encryption key based on the fourth encryption key;
sending the telemetry message to a second client system;
decrypting, by the second client system, the first encryption key from the encrypted first encryption key based on the fourth encryption key; and
decrypting, by the second client system, the first data section of the storage device telemetry data from the encrypted first data section of the storage device telemetry data.
13. The computer-implemented method of claim 11 , further comprising:
determining, by the first client system, a private encryption key for a public-private key pair of the third encryption key, wherein:
decrypting the first encryption key from the encrypted first encryption key uses the private encryption key;
the first encryption key is a symmetric key; and
the third encryption key is a public key of the public-private key pair.
14. The computer-implemented method of claim 11 , further comprising:
periodically collecting telemetry data sets;
encrypting each telemetry data set;
sending each encrypted telemetry data set to the first client system; and
decrypting, by the first client system, each encrypted telemetry data set.
15. The computer-implemented method of claim 14 , further comprising:
generating a new first encryption key for each telemetry data set; and
encrypting each telemetry data set using a different first encryption key.
16. The computer-implemented method of claim 11 , wherein:
collecting the storage device telemetry data includes collecting the storage device telemetry data from a storage device configured to use a non-volatile memory express (NVMe) storage protocol; and
sending the telemetry message includes using an NVMe telemetry command.
17. The computer-implemented method of claim 11 , further comprising:
encrypting the table of contents in the telemetry message.
18. The computer-implemented method of claim 17 , further comprising:
encrypting a sub-header of telemetry message, wherein the telemetry message further includes the sub-header comprising vendor specific protocol requirements for the telemetry message.
19. The computer-implemented method of claim 11 , further comprising:
storing, in the first client system, a private encryption key from a public-private key pair for the third encryption key, wherein decrypting the encrypted first encryption key includes using the private encryption key; and
storing, in a data storage device, a public encryption key from the public-private key pair for the third encryption key, wherein encrypting the first encryption key includes using the public encryption key.
20. A storage system, comprising:
a data storage device comprising:
a storage device controller including a controller processor and a controller memory; and
a storage medium;
a client system comprising:
a client processor; and
a client memory;
means for collecting, from the data storage device, storage device telemetry data;
means for determining, from the storage device telemetry data, a first data section and a second data section;
means for encrypting, using a first encryption key, the first data section of the storage device telemetry data;
means for encrypting, using a second encryption key, the second data section of the storage device telemetry data;
means for encrypting, using a third encryption key, the first encryption key and the second encryption key;
means for formatting a telemetry message, wherein the telemetry message includes:
the encrypted first data section of the storage device telemetry data;
the encrypted second data section of the storage device telemetry data;
the encrypted first encryption key and the encrypted second encryption key; and
a table of contents configured to indicate encryption keys used to encrypt each data section of a plurality of data sections of the storage device telemetry data, including the first data section and the second data section;
means for sending the telemetry message to the client system;
means for receiving, by the client system, the telemetry message;
means for decrypting, by the client system, the first encryption key from the encrypted first encryption key based on the third encryption key;
means for decrypting, by the client system, the first data section of the storage device telemetry data from the encrypted first data section of the storage device telemetry data; and
means for displaying, by the client system, the first data section of the storage device telemetry data on a user interface.