SECURITY FOR RAID SYSTEMS

• US 20100031060A1
• Filed: 02/15/2008
• Published: 02/04/2010
• Est. Priority Date: 02/15/2008
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: CHEW, YEN HSIANG, Panda, Subhankar
• Granted Patent: US 8,209,551 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00

Abstract

Methods and apparatus for accessing a redundant array of independent drives (RAID) storage device are disclosed. In some embodiments file data is broken into multiple segments. A cryptographic operation is performed on one or more segments to generate encrypted segment(s). One or more parity syndrome is computed from the encrypted segment(s) and the unencrypted segment(s). The encrypted segment(s), the unencrypted segment(s) and the parity syndrome(s) are striped onto different individual drives. Since the cryptographic operation is not performed on all the segments, it may also be performed concurrently with computing of parity syndrome(s) from other unencrypted segments.

Claims

1. A machine implemented method for accessing a redundant array of independent drives (RAID) storage device, the method comprising:

segmenting a file data into a plurality of segments including at least a first unencrypted segment and a second unencrypted segment;

performing a cryptographic operation on the first unencrypted segment to generate a first encrypted segment;

computing a first parity syndrome for the first encrypted segment and at least the second unencrypted segment; and

striping the first encrypted segment and the second unencrypted segment on a first and a second drive respectively, the first drive being different from the second drive.

2. The method of claim 1, the computing of said first parity syndrome for the first encrypted segment and at least the second unencrypted segment comprising:

computing a second parity syndrome for the second unencrypted segment and at least a third unencrypted segment from the plurality of segments of the file data; and

computing said first parity syndrome for the first encrypted segment and the second parity syndrome.

3. The method of claim 2 wherein computing said second parity syndrome and performing the cryptographic operation on the first unencrypted segment are performed concurrently.

4. The method of claim 2, further comprising:

striping the third unencrypted segment and the first parity syndrome on a third and a fourth drive respectively, the third drive being different from the fourth drive and both being different from the first and the second drives.

5. The method of claim 1, further comprising:

computing a second parity syndrome for the first encrypted segment and at least the second unencrypted segment, wherein said second parity syndrome is a Reed-Solomon code.

6. The method of claim 5, further comprising:

striping the first parity syndrome and the second parity syndrome on a third and a fourth drive respectively, the third drive being different from the fourth drive and both being different from the first and the second drives.

7. The method of claim 1 wherein the file data is segmented into a plurality of segments, substantially all segments being 128-bit segments.

8. An article of manufacture to implement the method of claim 7, the article comprising a machine-accessible medium including data that, when accessed by a machine, cause the machine to implement the method of claim 7.

9. An apparatus comprising:

a RAID descriptor processing engine to segment a file data buffer into a plurality of segments including at least a first unencrypted segment and a second unencrypted segment and to direct memory access (DMA) transfer the plurality of segments from the file data buffer for processing;

a cryptographic unit to receive a DMA transfer of the first unencrypted segment by the RAID descriptor processing engine and to perform a cryptographic operation on the first unencrypted segment to generate a first encrypted segment;

a RAID processing engine to receive at least a DMA transfer of the second unencrypted segment by the RAID descriptor processing engine and to compute a first parity syndrome for the first encrypted segment and at least the second unencrypted segment; and

a destination storage having a plurality of drives including a first drive and a second drive different from the first drive, said RAID descriptor processing engine to stripe the first encrypted segment and the second unencrypted segment onto the first and the second drive respectively.

10. The apparatus of claim 9, said RAID processing engine to compute a second parity syndrome for the second unencrypted segment and at least a third unencrypted segment from the plurality of segments of the file data buffer and to compute said first parity syndrome for the first encrypted segment and the second parity syndrome.

11. The apparatus of claim 10 wherein computing said second parity syndrome and performing the cryptographic operation on the first unencrypted segment are performed concurrently.

12. The apparatus of claim 11, said RAID descriptor processing engine to stripe the third unencrypted segment and the first parity syndrome on a third and a fourth drive respectively, the third drive being different from the fourth drive and both being different from the first and the second drives.

13. The apparatus of claim 9, said RAID processing engine to compute a second parity syndrome for the first encrypted segment and at least the second unencrypted segment, wherein said second parity syndrome is a Reed-Solomon code.

14. The apparatus of claim 13, said RAID descriptor processing engine to stripe the first parity syndrome and the second parity syndrome on a third and a fourth drive respectively, the third drive being different from the fourth drive and both being different from the first and the second drives.

15. The apparatus of claim 9 wherein the file data is segmented into a plurality of segments, substantially all segments being 128-bit segments.

16. A RAID storage system comprising:

a plurality of distinct drives including a first drive, a second drive, a third drive and a fourth drive;

a RAID descriptor processing logic to segment a file data buffer into a plurality of segments including at least a first unencrypted segment A1, a second unencrypted segment A2 and a third unencrypted segment A3, and to transfer the plurality of segments from the file data buffer for processing;

a cryptographic logic to receive a transfer of the segment A1 by the RAID descriptor processing logic and to perform a cryptographic operation on the unencrypted segment A1 to generate a first encrypted segment A1′

;

a parity logic to receive transfers of the segment A2 and the segment A3 by the RAID descriptor processing logic, and to compute a first parity syndrome for the segment A2 and at least the segment A3 concurrent with said cryptographic operation on the segment A1, and to compute a second parity syndrome Ap′

from the encrypted segment A1′ and

the first parity syndrome; and

said RAID descriptor processing logic to stripe the segment A1′

, the segment A2,the segment A3 and the second parity syndrome Ap′

onto the first drive, the second drive, the third drive and the fourth drive, respectively.

17. The storage system of claim 16, said parity logic to compute a third parity syndrome for the segment A2 and at least the segment A3 concurrent with said cryptographic operation on the segment A1, and to compute a fourth parity syndrome Aq′

from the encrypted segment A1′ and

the third parity syndrome, wherein said fourth parity syndrome Aq′

is a Reed-Solomon code.

18. The storage system of claim 17, said RAID descriptor processing logic to stripe the fourth parity syndrome Aq′

onto a fifth drive of the plurality of distinct drives.