Data encryption for directly connected host

For a data storage network including a data storage system and a plurality of host systems having applications executing thereon, the execution of which results in data being stored on a plurality of physical storage devices of the data storage system, and wherein the data storage system includes a plurality of logical storage units to having storage provisioned from the plurality of physical storage devices, a system comprising:

• one or more processors;
• and
• a memory comprising code thereon that, when executed, performs a method including:
• assigning a first unique encryption key of a plurality of unique encryption keys to a first of the plurality of logical storage units, wherein each of the plurality of logical storage units is assigned a different one of the plurality of unique encryption keys used to directly encrypt all data portions stored on said each logical storage unit in an encrypted form;
• providing the first unique encryption key to one or more of the plurality of host systems, wherein each of the one or more host systems has an application executing thereon and is authorized to access the first logical storage unit, wherein said providing the first unique encryption key to one or more of the plurality of host systems further includes:
• receiving, at the data storage system from a first of the plurality of host systems, a metadata read instruction requesting encryption metadata for the first logical storage unit, wherein the encryption metadata includes the first unique encryption key assigned to the first logical storage unit;
• responsive to receiving the metadata read instruction from the first host system, the data storage system determining, using one or more data structures, that the first host system is authorized to access the first logical storage unit;
• and
• responsive to the data storage system receiving the metadata read instruction from the first host system and the data storage system determining that the first host system is authorized to access the first logical storage unit, sending the encryption metadata including the first unique encryption key to the first host system;
• refraining from providing the encryption metadata including the first unique encryption key to any of the plurality of host systems that are not authorized to access the first logical storage unit;
• encrypting data portions of the first logical storage unit stored on one or more of the plurality of physical storage devices using the first unique encryption key;
• and
• the first host system reading an encrypted version of a data portion of the first logical storage unit, wherein said reading further includes the first host system sending a data read instruction to a global memory or the one or more physical storage devices on an internal fabric independent of any director of the data storage system, wherein the first host system is directly connected to the internal fabric of the data storage system, and wherein the data read instruction and the metadata read instruction are two separate instructions sent from the first host system to the data storage system.

For a data storage network including a data storage system and a plurality of host systems having applications executing thereon, the execution of which results in data being stored on a plurality of physical storage devices of the data storage system, and wherein the data storage system includes a plurality of logical storage units having storage provisioned from the plurality of physical storage devices, non-transitory computer-readable media having software stored thereon, the software comprising:

• executable code that assigns a first unique encryption key of a plurality of unique encryption keys to a first of the plurality of logical storage units, wherein each of the plurality of logical storage units is assigned a different one of the plurality of unique encryption keys used to directly encrypt all data portions stored on said each logical storage unit in an encrypted form;
• executable code that provides the first unique encryption key to one or more of the plurality of host systems, wherein each of the one or more host systems has an application executing thereon and is authorized to access the first logical storage unit, wherein the executable code that provides the first unique encryption key to one or more of the plurality of host systems further includes executable code that performs processing including:
• receiving, at the data storage system from a first of the plurality of host systems, a metadata read instruction requesting first encryption metadata for the first logical storage unit, wherein the first encryption metadata includes the first unique encryption key assigned to the first logical storage unit;
• responsive to receiving the metadata read instruction from the first host system, the data storage system determining that the first host system is authorized to access the first logical storage unit;
• and
• responsive to the data storage system receiving the metadata read instruction from the first host system and the data storage system determining that the first host system is authorized to access the first logical storage unit, sending the first encryption metadata including the first unique encryption key to the first host system;
• executable code that refrains from providing the encryption metadata including the first unique encryption key to any of the plurality of host systems that are not authorized to access the first logical storage unit;
• executable code that encrypts data portions of the first logical storage unit stored on one or more of the plurality of physical storage devices using the first unique encryption key;
• and
• executable code that causes the first host to read an encrypted version of a data portion of the first logical storage unit, wherein the executable code that causes the first host to read the encrypted version of the data portion of the first logical storage unit further includes executable code that performs processing including causing the first host system to send a data read instruction to a global memory or the one or more physical storage devices on an internal fabric independent of any director of the data storage system, wherein the first host system is directly connected to the internal fabric of the data storage system, and wherein the data read instruction and the metadata read instruction are two separate instructions sent from the first host system to the data storage system.