Information processing system and data transfer method
In an information processing system, a storage control server (storage control node) that has received a read request of data from a compute server (compute node) transmits the read request to a drive box. The drive box that has received the read request from the storage control server reads encrypted read target data corresponding to the read request from non-volatile storage media, decrypts the read target data with key data acquired at a predetermined timing, and then transmits the decrypted read target data to the compute server as a read request source.
1. An information processing system in which a drive box including one or more non-volatile storage media that store data and a storage control server that processes data input and output to and from the drive box are connected to each other via a network, wherein
the storage control server manages key data for encrypting and decrypting the data,
the drive box stores encrypted data and acquires the key data of the data at a predetermined timing,
the storage control server that has received a read request of data from a compute server transmits the read request to the drive box,
the drive box that has received the read request from the storage control server reads encrypted read target data corresponding to the read request from the non-volatile storage media, decrypts the read target data with the key data acquired at the predetermined timing, and then transmits the decrypted read target data to the compute server as a read request source.
2. The information processing system according to claim 1 , wherein
the storage control server that has received the read request from the compute server determines which of the drive box and the storage control server transmits the read target data to the compute server, and then transmits the read request to the drive box that stores the read target data, and
when the storage control server determines that the drive box transmits the read target data, the drive box that has received the read request reads the encrypted read target data, decrypts the encrypted read target data with the key data, and transmits the decrypted read target data to the compute server,
when the storage control server determines to transmit the read target data, the drive box that has received the read request reads the encrypted read target data and transmits the encrypted read target data to the storage control server, and the storage control server that has received the encrypted read target data decrypts the encrypted read target data with the key data and transmits the decrypted read target data to the compute server.
3. The information processing system according to claim 2 , wherein
the storage control server that has received a write request of data from the compute server encrypts write target data corresponding to the write request, with the key data, and transmits the encrypted write target data to the drive box, and
the drive box stores the encrypted write target data received from the storage control server, in the non-volatile storage medium.
4. The information processing system according to claim 1 , wherein
data is transmitted and received between the storage control server and the drive box via an encrypted communication path.
5. The information processing system according to claim 1 , wherein
the drive box further includes a volatile storage medium, and
the drive box stores a value of the key data managed by the storage control server, in the volatile storage medium.
6. The information processing system according to claim 1 , wherein
the storage control server stores a value of the key data and information indicating a state of availability of each of the non-volatile storage media in the drive box, in a volatile storage medium of the storage control server.
7. The information processing system according to claim 1 , wherein
the drive box acquires key data having the same value as the key data managed by the storage control server with time of booting as the predetermined timing.
8. The information processing system according to claim 1 , wherein
the drive box
acquires key data having the same value as the key data managed by the storage control server with, as the predetermined timing, a time when the storage control server receives the read request from the compute server, and
deletes the acquired key data from the drive box itself after responding to the read request.
9. The information processing system according to claim 1 , wherein
the storage control server determines a transmission source that transmits the read target data to the compute server in the read request, based on contents designated in the read request.
10. The information processing system according to claim 9 , wherein
when the transmission source is not designated in the read request, the storage control server determines the storage control server itself as the transmission source.
11. The information processing system according to claim 9 , wherein
when the read target data in the read request is stored in a cache memory of the storage control server, the storage control server itself reads the encrypted read target data from the cache memory, decrypts the read target data with the key data used in writing, and then transmits the decrypted read target data to the compute server, regardless of designation or setting regarding the transmission source.
12. The information processing system according to claim 1 , wherein
a transmission source that transmits the read target data in the read request to the compute server is set in advance for each of one or more storage spaces provided by the drive box, and
the storage control server determines the transmission source in the read request in accordance with the setting for the storage space in which the read target data in the read request is stored.
13. The information processing system according to claim 1 , wherein
the storage control server determines a transmission source that transmits the read target data in the read request to the compute server, based on processing loads of the storage control server and the drive box when the read request is received.
14. The information processing system according to claim 1 , further comprising:
a key management server that provides the key data,
wherein the storage control server acquires the key data from the key management server, and
the drive box acquires key data having the same value as the key data acquired by the storage control server, directly from the key management server or via the storage control server.
15. A data transfer method by an information processing system in which a drive box including one or more non-volatile storage media that store data and a storage control server that controls a storage space provided by the drive box are connected to each other via a network, the method comprising:
by the storage control server, managing key data for encrypting and decrypting the data;
by the drive box, storing encrypted data and acquiring the key data of the data at a predetermined timing;
by the storage control server that has received a read request of data from a compute server, transmitting the read request to the drive box; and
by the drive box that has received the read request from the storage control server, reading encrypted read target data corresponding to the read request from the non-volatile storage media, decrypting the read target data with the key data acquired at the predetermined timing, and then transmitting the decrypted read target data to the compute server as a read request source.