Enablement and disablement of end-to-end efficient encryption with security chaining
Enabling End-to-End Efficient Encryption (E2EEE) with security chaining in an Information Handling System (IHS) network includes: a data source IHS writing metadata containing a key slot, in a trailer of a data block and sending an out-of-band signal to use the key slot; an IHS security chaining logic regenerates the signal to each next IHS E2EEE data connection segment interface; and an encryption configuration state machine of each interface setting a use slot and an active slot to the key slot, in response to the signal. Disabling E2EEE with security chaining includes: the data source IHS sending an out-of-band signal to not use a key slot; the IHS security chaining logic regenerating the signal to each next interface; and the state machine of each interface changing the state machine state to not use a key slot and to not set an active key slot, in response to the signal.
1. A method for managing end-to-end efficient encryption with security chaining in an information handling system network, the method comprising:
selectively enabling the end-to-end efficient encryption with the security chaining in an information handling system network by:
writing, by a data source information handling system, metadata containing a key slot, in a trailer of a data block;
sending, by the data source information handling system, an out-of-band signal to use the key slot;
regenerating, by an information handling system security chaining logic component, the out-of-band signal to use the key slot to each next information handling system end-to-end efficient encryption data connection segment interface;
setting, in an encryption configuration state machine of each data connection segment interface, and in response to the out-of-band signal to use the key slot, a use slot to the key slot and an active slot to the key slot;
selectively disabling the end-to-end efficient encryption with the security chaining in the information handling system network by:
sending, by the data source information handling system, an out-of-band signal to not use the key slot in the trailer of the data block, wherein the data block is encrypted;
regenerating, by the information handling system security chaining logic component, the out-of-band signal to not use the key slot to the each next information handling system data connection segment interface; and
changing, in the encryption configuration state machine of the each data connection segment interface, and in response to the out-of-band signal to not use the key slot, the encryption configuration state machine state to not use the key slot and to not set the active slot to the key slot, wherein encryption and/or decryption no longer applies to data input and output and the data block is unencrypted.
2. The method of claim 1 , wherein each information handling system security chaining logic component maintains the metadata unchanged.
3. The method of claim 1 , wherein each out-of-band signal is an end-to-end efficient encryption handshake signal.
4. The method of claim 1 , wherein setting the use slot to the key slot and the active slot to the key slot changes the use slot to the key slot and the active slot to the key slot in the encryption configuration state machine of each data connection segment.
5. The method of claim 1 , wherein each information handling system security chaining logic component enables setting of the use slot to the key slot and the active slot to the key slot in the encryption configuration state machine of each data connection segment, backward from a last data connection segment to a first data connection segment.
6. The method of claim 1 , wherein each information handling system security chaining logic component enables decrypting or encrypting a data volume, by each data connection segment interface, in an information handling system of a data connection segment, using a key encryption key and data encryption key in the key slot, forward from a first data connection segment to a last data connection segment.
7. The method of claim 1 , wherein the out-of-band signal to not use the key slot comprises an end-to-end efficient encryption handshake signal to use a zero key slot.
8. The method of claim 7 , wherein changing the encryption configuration state machine state to not use the key slot and to not set the active slot to the key slot comprises changing, in the encryption configuration state machine of each data connection segment interface, in response to the end-to-end efficient encryption handshake signal to use the zero key slot, the encryption configuration state machine state to use the zero key slot and change the active slot to a zero active slot.
9. The method of claim 1 , wherein each information handling system security chaining logic component enables changing the encryption configuration state machine state to not use the key slot and to not set the active slot to the key slot for each data connection segment, backward from a last data connection segment to a first data connection segment.
10. The method of claim 1 , further comprising:
encrypting, by the data source information handling system, a data volume using a key encryption key and data encryption key in the key slot; and
decrypting or encrypting the data volume, by each data connection segment interface, in an information handling system of a data connection segment, using the key encryption key and the data encryption key in the key slot.