EFFICIENT REKEY IN A TRANSPARENT DECRYPTING STORAGE ARRAY

• US 20200134202A1
• Filed: 10/26/2018
• Published: 04/30/2020
• Est. Priority Date: 10/26/2018
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Pure Storage, Inc.
• Inventors: Sapuntzakis, Constantine P., Vijayasankar, Kiron, Frandzel, Yuval
• Granted Patent: US 11,113,409 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/402 Encrypted data
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method of efficient rekey in a transparent decrypting storage array includes receiving an instruction to rekey data on a storage array, wherein the instruction identifies first encryption information and second encryption information. The method further includes decrypting, by a processing device of a storage array controller, the data using the first encryption information to generate decrypted data. The method further includes encrypting the decrypted data using the second encryption information to generate encrypted data.

Claims

1. A method, comprising:

receiving an instruction to rekey data on a storage array, wherein the instruction identifies first encryption information and second encryption information;

decrypting, by a processing device of a storage array controller, the data using the first encryption information to generate decrypted data; and

encrypting the decrypted data using the second encryption information to generate encrypted data.

2. The method of claim 1, wherein the first encryption information comprises:

an identifier of;

a current key, a current encryption algorithm, and a current initialization vector scheme; and

wherein the second encryption information comprises;

an identifier of;

a desired key, a desired encryption algorithm, and a desired initialization vector scheme.

3. The method of claim 2, wherein the first encryption information further comprises:

a proof of possession of the current key; and

wherein the second encryption information further comprises;

a proof of possession of the desired key.

4. The method of claim 2, wherein the current key is the same as the desired key.

5. The method of claim 1, wherein the instruction further identifies a range of logical block addresses corresponding to the data.

6. The method of claim 1, wherein the rekey instruction is part of a Small Computer System Interface (SCSI), Non-Volatile Memory Express (NVMe), Presentational State Transfer (REST), or vStorage Application Programming Interface for Storage Awareness (VASA) instruction set.

7. The method of claim 1, further comprising:

before the instruction to rekey the data on the storage array is accepted, determining that the rekey instruction was sent from an application that is authorized to modify the data.

8. The method of claim 1, wherein the rekey instruction comprises an instruction to copy the data to a target location identified by the rekey instruction, further comprising:

copying the encrypted data to the target location.

9. The method of claim 1, further comprising:

writing metadata for an application associated with the data that instructs the processing device of the storage array controller to use the second encryption information for future write operations of the application.

10. A storage system comprising:

a storage array comprising one or more storage devices; and

a storage array controller coupled to the storage array, the storage array controller to;

receive an instruction to rekey data on the storage array, wherein the instruction identifies first encryption information and second encryption information;

decrypt the data using the first encryption information to generate decrypted data; and

encrypt the decrypted data using the second encryption information to generate encrypted data.

11. The storage system of claim 10, wherein the first encryption information comprises:

an identifier of;

a current key, a current encryption algorithm, and a current initialization vector scheme; and

wherein the second encryption information comprises;

an identifier of;

a desired key, a desired encryption algorithm, and a desired initialization vector scheme.

12. The storage system of claim 11, wherein the first encryption information further comprises:

a proof of possession of the current key; and

wherein the second encryption information further comprises;

a proof of possession of the desired key.

13. The storage system of claim 11, wherein the current key is the same as the desired key.

14. The storage system of claim 10, wherein the instruction further identifies a range of logical block addresses corresponding to the data.

15. The storage system of claim 10, wherein the rekey instruction is part of a Small Computer System Interface (SCSI), Non-Volatile Memory Express (NVMe), Presentational State Transfer (REST), or vStorage Application Programming Interface for Storage Awareness (VASA) instruction set.

16. The storage system of claim 10, the storage array controller further to:

before the instruction to rekey the data on the storage array is accepted, determine that the rekey instruction was sent from an application that is authorized to modify the data.

17. The storage system of claim 10, wherein the rekey instruction comprises an instruction to copy the data to a target location identified by the rekey instruction, and wherein the storage array controller is further to:

copy the encrypted data to the target location.

18. The storage system of claim 10, the storage array controller further to:

write metadata for an application associated with the data that instructs the processing device of the storage array controller to use the second encryption information for future write operations of the application.

19. A storage system comprising:

a storage array comprising one or more storage devices; and

a storage array controller coupled to the storage array, the storage array controller to;

receive an instruction to rekey data on the storage array to correspond to desired encryption information;

determine that the data on the storage array was decrypted using correct encryption information; and

based on the determining, modify metadata associated with the data on the storage array to correspond to the desired encryption information.

20. The storage system of claim 19, the storage array controller further to:

receive an instruction to read the data on the storage array;

encrypt the data using the desired encryption information to generate encrypted data; and

provide the encrypted data.