End-to-end encryption of logical storage devices in a Linux native multi-pathing environment

An apparatus comprising:

• at least one processing device comprising a processor coupled to a memory;
• the at least one processing device being configured:
• to provide at least a portion of an input-output stack for processing of input-output operations in a host device for delivery to a storage system over selected ones of a plurality of paths through a network, the input-output stack comprising at least a multi-path device overlying one or more logical storage devices;
• and
• to perform a check at each of one or more points in the input-output stack to confirm that a given input-output operation directed to a given device of the input-output stack is received from an expected overlying device of the input-output stack;
• wherein performing a check at each of one or more points in the input-output stack comprises performing a check at each of the one or more points to confirm that the given input-output operation at that point has associated therewith a completion callback function of the expected overlying device.

A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code, when executed by at least one processing device comprising a processor coupled to a memory, causes the at least one processing device:

• to provide at least a portion of an input-output stack for processing of input-output operations in a host device for delivery to a storage system over selected ones of a plurality of paths through a network, the input-output stack comprising at least a multi-path device overlying one or more logical storage devices;
• and
• to perform a check at each of one or more points in the input-output stack to confirm that a given input-output operation directed to a given device of the input-output stack is received from an expected overlying device of the input-output stack;
• wherein the input-output stack comprises an encryption device overlying the multi-path device;
• and
• wherein the check performed at a given one of the one or more points in the input-output stack relates at least in part to the encryption device.

A method comprising:

• providing at least a portion of an input-output stack for processing of input-output operations in a host device for delivery to a storage system over selected ones of a plurality of paths through a network, the input-output stack comprising at least a multi-path device overlying one or more logical storage devices;
• and
• performing a check at each of one or more points in the input-output stack to confirm that a given input-output operation directed to a given device of the input-output stack is received from an expected overlying device of the input-output stack;
• wherein the input-output stack comprises an encryption device overlying the multi-path device;
• and
• wherein the check performed at a given one of the one or more points in the input-output stack relates at least in part to the encryption device.