Reliable datacenter protection at scale
Methods and systems are disclosed for activating data encryption at rest in a storage device server in a cloud storage. In particular, an encryption orchestrator orchestrates activation processes through encryption controllers that controls policies and privileges to access data in storage device servers. To reduce a risk of a data loss and time loss in activations, the encryption controller pre-checks a storage device server for anomalies in configurations in network connectivity, encryption keys, and security certificates before starting the activation. Furthermore, the encryption controller performs a health-check of the storage device servers to detect anomalies that require restarting the storage device servers. The health-check reduces a risk of data loss when the storage device servers become unable restart itself. User interface tools may be provided to visually identify and manage encryption statuses and policies of the encryption controllers, the storage device servers, and data storage devices.
1. A computer-implemented method for activating encryption in a storage device server, the computer-implemented method comprising:
receiving a request to activate the encryption of the storage device server, wherein the storage device server includes a data storage device;
processing a pre-check of the storage device server, including testing prerequisites for a successful activation of data encryption at rest upon the storage device server;
encrypting data stored in the storage device server when the pre-check of the storage device server is successful;
monitoring an operating status of the storage device server when the data stored in the data storage device has been encrypted; and
periodically providing the operating status of the storage device server.
2. The computer-implemented method of claim 1 , wherein the pre-check further comprises reading and validating a server configuration of the storage device server, the server configuration including an encryption key and a decryption key for the storage device server.
3. The computer-implemented method of claim 1 , wherein the operating status of the storage device server comprises one or more of:
a network address of the storage device server,
a status of connectivity between the storage device server and a key server,
a security certificate of the storage device server, and
an access privilege of the storage device server.
4. The computer-implemented method of claim 1 , further comprising sending a status failure notification when the pre-check fails and denying the request to activate the encryption of the storage device server.
5. The computer-implemented method of claim 1 , wherein encrypting the data stored in the storage device server further comprises encrypting the data based on a host operating system of the storage device server, wherein the data storage device is attached to the storage device server.
6. The computer-implemented method of claim 1 , wherein encrypting the data stored in the storage device server is performed by a data encryption processor embedded in the data storage device.
7. The computer-implemented method of claim 1 , further comprising:
identifying an alternative data storage device when the pre-check of the storage device server fails;
processing an alternative pre-check of the alternative data storage device;
encrypting the data stored in the alternative data storage device when the alternative pre-check of the alternative data storage device is successful;
monitoring operations of the alternative data storage device when the data stored in the alternative data storage device has been encrypted; and
periodically providing the status of the alternative data storage device.
8. The computer-implemented method of claim 7 , the computer-implemented method further comprising:
evacuating the data from the data storage device; and
based on the alternative pre-check, restoring the data to the alternative data storage device after the encryption of the data stored in the alternative data storage device.
9. The computer-implemented method of claim 1 , the computer-implemented method further comprising:
receiving a list of a plurality of the storage device servers in a cloud storage system; and
iteratively activating the encryption in the plurality of the storage device servers.
10. The computer-implemented method of claim 9 , wherein providing the operating status of the storage device server further comprises:
generating a visual representation of the plurality of the storage device servers and the plurality of the data storage devices in the cloud storage system;
updating the visual representation of the operating status of the data storage device; and
generating the visual representation of iterative actions, the iterative actions including encrypting the data at rest in at least one of the plurality of the storage device servers.
11. The computer-implemented method of claim 1 , wherein the computer-implemented method is performed by an encryption controller.
12. The computer-implemented method of claim 1 , wherein the computer-implemented method is performed by an encryption orchestrator.
13. A cloud storage system with a data encryption at rest, the cloud storage system comprising:
a storage device server with at least one data storage device;
an encryption orchestrator comprising:
a first processor; and
a first memory storing a first set of computer-executable instructions, which, when executed, cause the first processor to:
provide a graphical representation of the storage device server with the at least one data storage device; and
transmit a command to activate data encryption in the storage device server; and
an encryption controller comprising:
a second processor; and
a second memory storing a second set of computer-executable instructions, which when executed, cause the second processor to:
receive a request to activate the data encryption in the storage device server;
perform a pre-check of the storage device server, including testing prerequisites for a successful activation of data encryption at rest upon the storage device server;
perform the data encryption in the storage device server when the pre-check of the storage device server is successful;
periodically monitor an operating status of the storage device server when the data encryption in the storage device server is successful; and
periodically provide the operating status of the storage device server to the encryption orchestrator.
14. The cloud storage system of claim 13 , wherein the encryption controller further comprises:
a key manager, wherein the key manager comprises encryption keys for the data encryption at rest on the storage device server; and
a policy manager, wherein the policy manager provides a set of policies of the data encryption in the storage device server.
15. The cloud storage system of claim 13 , wherein the encryption controller further comprises the second set of computer-executable instructions, which when executed, cause the second processor to:
evacuate data in the storage device server when the pre-check succeeds.
16. The cloud storage system of claim 15 , wherein the encryption controller further comprises the second set of the computer-executable instructions, which when executed, cause the second processor to:
receive a list of a plurality of the storage device servers; and
iteratively activate the encryption in the plurality of the storage device servers.
17. The cloud storage system of claim 15 , wherein the encryption orchestrator further comprises the first set of the computer-executable instructions, which when executed, cause the first processor to:
generate a first visual representation, wherein the first visual representation further comprises:
the storage device server; and
the at least one data storage device;
provide a second visual representation, wherein the second visual representation comprises the operating status of the at least one data storage device; and
generate a third visual representation, wherein the third visual representation comprises a set of iterative activations of the data encryption at rest in the storage device server.
18. A computer storage medium that stores computer-executable instructions for activation of a data encryption at rest in servers, the computer-executable instructions when executed by a processor, cause the processor to:
receive a first request to activate the data encryption at rest in a first server, wherein the first server comprises a first set of data storage devices;
perform a first pre-check of the first server, including testing prerequisites for a successful activation of data encryption at rest upon the first server;
encrypt the data stored in the first server when the first pre-check is successful;
monitor an operating status of the first server and the first set of the data storage devices connected to the first server when the data stored in the first server has been encrypted; and
periodically provide the operating status of the first server and the first set of the data storage devices.
19. The computer storage medium of claim 18 further comprising the computer-executable instructions, which when executed by the processor, cause the processor to:
receive a second request to activate the data encryption at rest in a second server, wherein the second server comprises a second set of the data storage devices;
perform a second pre-check of the second server and the second set of the data storage devices, wherein the second pre-check comprises validating at least one decryption key for data decryption in the second server; and
send an error message when the second pre-check is not successful.
20. The computer storage medium of claim 19 , further comprising the computer-executable instructions, which when executed by the processor, cause the processor to:
identify a third server with a third set of the data storage devices when the second pre-check of the second server is an error.