Restricted command set management in a data storage system
An embodiment of restricted command set management permits a storage controller to execute commands of a restricted command set if authorized. A command determined to be within the restricted command set is encrypted by a host prior to sending the encrypted command to a storage controller for execution. The command may be encrypted using a key shared between the host and the storage controller. The shared key may be generated by the host and encrypted by the host using a public key of a public-private key maintained by the storage controller. The encrypted shared key may be decrypted by the storage controller using the private key of the public-private key maintained by the storage controller. Execution of commands of the restricted command set is prevented absent proper decryption of the commands sent by the host. Other features and aspects may be realized, depending upon the particular application.
1. A computer program product for use with a data storage system having a storage controller and at least one storage unit of a plurality of storage units controlled by the storage controller, wherein the storage controller has a processor, and wherein the computer program product comprises a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor of the storage controller to cause storage controller processor operations, the storage controller processor operations comprising:
controlling said plurality of storage units to perform Input/Output (I/O) operations requested by a host;
receiving a command from the host;
determining if the received command is within a restricted command set;
in response to said determining if the received command is within the restricted command set, selectively decrypting the received command; and
selectively executing a decrypted command;
wherein selectively decrypting the received command includes decrypting the received command if the received command is determined to be within the restricted command set and bypassing decrypting the received command if the received command is determined to be outside the restricted command set; and
wherein the host has a processor, and wherein the computer program product further comprises a further computer readable storage medium having further program instructions embodied therewith, the further program instructions executable by a processor of the host to cause host processor operations, the host processor operations comprising:
determining whether a command to be transmitted to a storage controller is within the restricted command set;
selectively encrypting the command to be transmitted to the storage controller, wherein selective encrypting the command includes encrypting the command if the command is within the restricted command set and bypassing encrypting the command if the command is outside the restricted command set;
transmitting an encrypted command within the restricted command set to the storage controller; and
transmitting an unencrypted command outside the restricted command set to the storage controller.
2. The computer program product of claim 1 wherein the storage controller processor operations further comprise:
checking integrity of received command decrypting using an integrity pass/fail test; and
wherein selectively executing the decrypted command includes executing the decrypted command if the decrypted command passes the integrity pass/fail test and blocking execution of the decrypted command if the decrypted command fails the integrity pass/fail test.
3. The computer program product of claim 1 , wherein the storage controller processor operations further comprise:
receiving an unencrypted command; and
selectively executing the received unencrypted command if the received unencrypted command is determined to be outside the restricted command set.
4. The computer program product of claim 1 wherein the host processor operations further comprise:
obtaining a public encryption/decryption key of a public-private encryption/decryption key pair for the storage controller;
obtaining a symmetric encryption/decryption key;
encrypting the symmetric encryption/decryption key using the public encryption/decryption key; and
transmitting the encrypted symmetric encryption/decryption key to the storage controller; and
wherein the storage controller processor operations further comprise:
receiving the encrypted symmetric encryption/decryption key; and
decrypting the symmetric encryption/decryption key using a private encryption/decryption key of the public-private encryption/decryption key pair for the storage controller.
5. The computer program product of claim 4 wherein the host encrypting the command includes encrypting the command using the symmetric encryption/decryption key and wherein the storage controller decrypting the received command includes decrypting the received command using the symmetric encryption/decryption key.
6. A method, comprising:
operations by a storage controller including:
controlling storage units to perform Input/Output (I/O) operations requested by a host;
receiving a command from the host;
determining if the received command is within a restricted command set;
in response to said determining if the received command is within the restricted command set, selectively decrypting the received command; and
selectively executing a decrypted command;
wherein selectively decrypting the received command includes decrypting the received command if the received command is determined to be within the restricted command set and bypassing decrypting the received command if the received command is determined to be outside the restricted command set; and
the method further comprising operations by a host including:
determining whether a command to be transmitted to a storage controller is within the restricted command set;
selectively encrypting the command to be transmitted to the storage controller, wherein selective encrypting the command includes encrypting the command if the command is within the restricted command set and bypassing encrypting the command if the command is outside the restricted command set;
transmitting an encrypted command within the restricted command set to the storage controller; and
transmitting an unencrypted command outside the restricted command set to the storage controller.
7. The method of claim 6 further comprising:
further operations by the storage controller including:
checking integrity of received command decrypting using an integrity pass/fail test; and
wherein selectively executing the decrypted command includes executing the decrypted command if the decrypted command passes the integrity pass/fail test and blocking execution of the decrypted command if the decrypted command fails the integrity pass/fail test.
8. The method of claim 6 , further comprising:
further operations by the storage controller including:
receiving an unencrypted command; and
selectively executing the received unencrypted command if the received unencrypted command is determined to be outside the restricted command set.
9. The method of claim 6 further comprising:
further operations by a host including:
obtaining a public encryption/decryption key of a public-private encryption/decryption key pair for the storage controller;
obtaining a symmetric encryption/decryption key;
encrypting the symmetric encryption/decryption key using the public encryption/decryption key; and
transmitting the encrypted symmetric encryption/decryption key to the storage controller; and
the storage controller:
receiving the encrypted symmetric encryption/decryption key; and
decrypting the symmetric encryption/decryption key using a private encryption/decryption key of the public-private encryption/decryption key pair for the storage controller.
10. The method of claim 9
wherein the host encrypting the command includes encrypting the command using the symmetric encryption/decryption key and wherein the storage controller decrypting the received command includes decrypting the received command using the symmetric encryption/decryption key.
11. A system, comprising:
host having a processor;
a storage controller having a processor and at least one storage unit of a plurality of storage units controlled by the storage controller; and
a computer program product comprising a computer readable storage medium having program instructions embodied therewith, a portion of the program instructions executable by a processor of the storage controller to cause storage controller processor operations, and a portion of the program instructions executable by a processor of the host to cause host processor operations, the storage controller processor operations comprising:
controlling said plurality of storage units to perform Input/Output (I/O) operations requested by the host;
receiving a command from the host;
determining if the received command is within a restricted command set;
in response to said determining if the received command is within the restricted command set, selectively decrypting the received command; and
selectively executing a decrypted command;
wherein selectively decrypting the received command includes decrypting the received command if the received command is determined to be within the restricted command set and bypassing decrypting the received command if the received command is determined to be outside the restricted command set; and
wherein the host has a processor, and wherein the system further comprises a further computer readable storage medium having further program instructions embodied therewith, the further program instructions executable by a processor of the host to cause host processor operations, the host processor operations comprising:
determining whether a command to be transmitted to a storage controller is within the restricted command set;
selectively encrypting the command to be transmitted to the storage controller, wherein selective encrypting the command includes encrypting the command if the command is within the restricted command set and bypassing encrypting the command if the command is outside the restricted command set;
transmitting an encrypted command within the restricted command set to the storage controller; and
transmitting an unencrypted command outside the restricted command set to the storage controller.
12. The system of claim 11 wherein the storage controller processor operations further comprise:
checking integrity of received command decrypting using an integrity pass/fail test; and
wherein selectively executing the decrypted command includes executing the decrypted command if the decrypted command passes the integrity pass/fail test and blocking execution of the decrypted command if the decrypted command fails the integrity pass/fail test.
13. The system of claim 11 , wherein the storage controller processor operations further comprise:
receiving an unencrypted command; and
selectively executing the received unencrypted command if the received unencrypted command is determined to be outside the restricted command set.
14. The system of claim 11 wherein the host processor operations further comprise:
obtaining a public encryption/decryption key of a public-private encryption/decryption key pair for the storage controller;
obtaining a symmetric encryption/decryption key;
encrypting the symmetric encryption/decryption key using the public encryption/decryption key; and
transmitting the encrypted symmetric encryption/decryption key to the storage controller; and
wherein the storage controller processor operations further comprise:
receiving the encrypted symmetric encryption/decryption key; and
decrypting the symmetric encryption/decryption key using a private encryption/decryption key of the public-private encryption/decryption key pair for the storage controller.
15. The system of claim 14 wherein the host encrypting the command includes encrypting the command using the symmetric encryption/decryption key and wherein the storage controller decrypting the received command includes decrypting the received command using the symmetric encryption/decryption key.