Storage array data decryption
An aspect of the present disclosure relates to one or more data decryption techniques. In embodiments, an input/output operation (IO) stream including one or more encrypted IOs is received by a storage array. Each encrypted IO is assigned an encryption classification. Further, each encrypted IO is processed based on its assigned encryption classification.
1. A method comprising:
receiving an input/output operation (IO) stream including one or more encrypted IOs by a storage array;
monitoring each IO stream received by the storage array;
identifying one or more patterns related to one or more of the one or more encrypted IOs;
identifying the one or more of the patterns using a machine learning (ML) engine, wherein the ML engine is configured to perform a time-series pattern recognition technique on one or more of the one or more encrypted IOs;
generating one or more encrypted IO models based on one or more of the identified patterns;
assigning each encrypted IO with an encryption classification based on a predefined set of encryption levels correlating to data sensitivity and access frequency;
classifying one or more of the encrypted IOs based on one or more of the identified patterns; and
processing each encrypted IO based on its assigned encryption classification, wherein processing each encrypted IO includes:
determining whether to reclassify a subject encrypted IO based on an activity level of its target address space and a predefined activity threshold specific to the encryption classification,
comparing a service level (SL) response time requirement of the subject encrypted IO with a response time of the storage array, wherein the SL is adjusted based on the encryption classification,
determining whether one or more of the encrypted IO models includes a classification for the subject encrypted IO,
directly de-staging the encrypted IO and its related encrypted data to at least the storage array's cache memory or storage device when one of the encrypted IO models classifies the subject encrypted IO as being related to a hot data track,
assigning the subject encrypted IO with a default classification when none of the encrypted IO models includes a classification for the subject encrypted IO,
performing a data decryption technique on the subject encrypted IO when the subject encrypted IO is provided with the default classification,
performing the data decryption technique on the encrypted IO when one of the encrypted IO models classifies the subject encrypted IO as being related to a cold data track,
in response to identifying at least one hot data track becoming the cold data track, performing the data decryption technique on the subject encrypted IO, and
performing the data decryption technique on the subject encrypted IO when the activity level of its target address space is below the predefined activity threshold.
2. The method of claim 1 , wherein the classification defines an encrypted IO's related data track as the hot data track or the cold data track.
3. The method of claim 2 , wherein:
each hot data track defines a data track's address space having a frequency of address calls above a first threshold, and
each cold data track defines the data track's address spacing having a frequency of address calls below a second threshold.
4. The method of claim 3 , wherein the first threshold has a value that is either greater than or equivalent to the second threshold's value.
5. An apparatus including a memory and a processor configured to:
receive an input/output operation (IO) stream including one or more encrypted IOs by a storage array;
monitor each IO stream received by the storage array;
identify one or more patterns related to one or more of the one or more encrypted IOs;
identify the one or more of the patterns using a machine learning (ML) engine, wherein the ML engine is configured to perform a time-series pattern recognition technique on one or more of the one or more encrypted IOs;
generate one or more encrypted IO models based on one or more of the identified patterns;
assign each encrypted IO with an encryption classification based on a predefined set of encryption levels correlating to data sensitivity and access frequency;
classify one or more of the encrypted IOs based on one or more of the identified patterns; and
process each encrypted IO based on its assigned encryption classification, wherein processing each encrypted IO includes:
determining whether to reclassify a subject encrypted IO based on an activity level of its target address space and a predefined activity threshold specific to the encryption classification,
comparing a service level (SL) response time requirement of the subject encrypted IO with a response time of the storage array, wherein the SL is adjusted based on the encryption classification,
determining whether one or more of the encrypted IO models includes a classification for the subject encrypted IO,
directly de-staging the encrypted IO and its related encrypted data to at least the storage array's cache memory or storage device when one of the encrypted IO models classifies the subject encrypted IO as being related to a hot data track,
assigning the subject encrypted IO with a default classification when none of the encrypted IO models includes a classification for the subject encrypted IO,
performing a data decryption technique on the subject encrypted IO when the subject encrypted IO is provided with the default classification,
performing the data decryption technique on the encrypted IO when one of the encrypted IO models classifies the subject encrypted IO as being related to a cold data track,
in response to identifying at least one hot data track becoming the cold data track, performing the data decryption technique on the subject encrypted IO, and
performing the data decryption technique on the encrypted IO subject encrypted IO when the activity level of its target address space is below the predefined activity threshold.
6. The apparatus of claim 5 , wherein the classification defines an encrypted IO's related data track as the hot data track or the cold data track.
7. The apparatus of claim 6 , wherein:
each hot data track defines a data track's address space having a frequency of address calls above a first threshold, and
each cold data track defines the data track's address spacing having a frequency of address calls below a second threshold.
8. The apparatus of claim 7 , wherein the first threshold has a value that is either greater than or equivalent to the second threshold's value.