# US 12,001,595 B2 · End-to-end encryption of logical storage devices in a Linux native multi-pathing environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,001,595 B2 - Document ID: US12001595B2 - Status: Granted - Kind: B2 - Application number: 17/541,381 - Filed: 2021-12-03 - Published: 2023-06-08 - Granted: 2024-06-04 - Earliest claimed: 2021-12-03 - Assignees: Dell Products L.P. - Applicants: Dell Products L.P. - Inventors: Sanjib Mallick; Gopinath Marappan; Kundan Kumar - Web page: https://patentgrep.com/patent/US12001595B2 ## CPC - G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) - G06F 3/0623: {in relation to content} - G06F 3/0635: {by changing the path, e.g. traffic rerouting, path reconfiguration} - G06F 3/0659: {Command handling arrangements, e.g. command buffers, queues, command scheduling} - G06F 3/067: {Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]} - G06F 3/0679: {Non-volatile semiconductor memory device, e.g. flash memory, one time programmable memory [OTP]} - G06F 3/0688: {Non-volatile semiconductor memory arrays} - G06F 21/602: {Providing cryptographic facilities or services} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An apparatus comprises at least one processing device comprising a processor coupled to a memory, with the at least one processing device being configured to provide at least a portion of an input-output (IO) stack for processing of IO operations in a host device for delivery to a storage system over selected ones of a plurality of paths through a network. The IO stack comprises at least a multi-path device overlying one or more logical storage devices. The at least one processing device is further configured to perform a check at each of one or more points in the IO stack to confirm that a given IO operation directed to a given device of the IO stack is received from an expected overlying device of the IO stack. The IO stack illustratively comprises an encryption device overlying the multi-path device, supporting end-to-end encryption for one or more logical storage devices. ## Claims ### Claim 1 An apparatus comprising: at least one processing device comprising a processor coupled to a memory; the at least one processing device being configured: to provide at least a portion of an input-output stack for processing of input-output operations in a host device for delivery to a storage system over selected ones of a plurality of paths through a network, the input-output stack comprising at least a multi-path device overlying one or more logical storage devices; and to perform a check at each of one or more points in the input-output stack to confirm that a given input-output operation directed to a given device of the input-output stack is received from an expected overlying device of the input-output stack; wherein the input-output stack comprises an encryption device overlying the multi-path device; and wherein the check performed at a given one of the one or more points in the input-output stack relates at least in part to the encryption device. ### Claim 2 (depends on 1) The apparatus of claim 1 wherein the at least one processing device comprises at least a portion of the host device. ### Claim 3 (depends on 1) The apparatus of claim 1 wherein said at least one processing device comprises a multi-path input-output driver of the host device, with the multi-path input-output driver of the host device being configured to control the delivery of the input-output operations to the storage system over the selected ones of the plurality of paths through the network. ### Claim 4 (depends on 3) The apparatus of claim 3 wherein the multi-path input-output driver of the host device comprises a device mapper multi-path input-output driver operating in a Linux native multi-pathing environment. ### Claim 5 (depends on 1) The apparatus of claim 1 wherein the at least one processing device is further configured to reject the given input-output operation responsive to the check at one of the points indicating that the given input-output operation was not received from the expected overlying device of the input-output stack. ### Claim 6 (depends on 1) The apparatus of claim 1 wherein the at least one processing device is further configured to pass the given input-output operation to an underlying device of the input-output stack responsive to the check at one of the points indicating that the given input-output operation was received from the expected overlying device of the input-output stack. ### Claim 7 (depends on 1) The apparatus of claim 1 wherein performing a check at each of one or more points in the input-output stack comprises performing a check to confirm that a given input-output operation directed to the multi-path device is received from the encryption device. ### Claim 8 (depends on 1) The apparatus of claim 1 wherein the input-output stack comprises a first check module inserted in the input-output stack between the encryption device and the multi-path device to perform a first check to determine if a given input-output operation directed to the multi-path device is received from the encryption device. ### Claim 9 (depends on 8) The apparatus of claim 8 wherein the input-output stack comprises a second check module inserted in the input-output stack between the multi-path device and the one or more logical storage devices to perform a second check to determine if a given input-output operation directed to at least one of the one or more logical storage devices is received from the multi-path device. ### Claim 10 (depends on 1) The apparatus of claim 1 wherein each of at least a subset of the devices of the input-output stack in processing a given input-output operation embeds into the given input-output operation a completion callback function of the given device prior to forwarding the given input-output operation to an underlying device of the input-output stack. ### Claim 11 (depends on 1) The apparatus of claim 1 wherein performing a check at each of one or more points in the input-output stack comprises: performing a first check at a first point in the input-output stack to confirm that a given input-output operation directed to the multi-path device includes a first completion callback function of the encryption device; and performing a second check at a second point different than the first point in the input-output stack to confirm that the given input-output operation directed to at least one of the one or more logical storage devices includes a second completion callback function of the multi-path device. ### Claim 12 An apparatus comprising: at least one processing device comprising a processor coupled to a memory; the at least one processing device being configured: to provide at least a portion of an input-output stack for processing of input-output operations in a host device for delivery to a storage system over selected ones of a plurality of paths through a network, the input-output stack comprising at least a multi-path device overlying one or more logical storage devices; and to perform a check at each of one or more points in the input-output stack to confirm that a given input-output operation directed to a given device of the input-output stack is received from an expected overlying device of the input-output stack; wherein performing a check at each of one or more points in the input-output stack comprises performing a check at each of the one or more points to confirm that the given input-output operation at that point has associated therewith a completion callback function of the expected overlying device. ### Claim 13 (depends on 12) The apparatus of claim 12 wherein absence of the completion callback function of the expected overlying device indicates that the given input-output operation has bypassed the expected overlying device. ### Claim 14 A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code, when executed by at least one processing device comprising a processor coupled to a memory, causes the at least one processing device: to provide at least a portion of an input-output stack for processing of input-output operations in a host device for delivery to a storage system over selected ones of a plurality of paths through a network, the input-output stack comprising at least a multi-path device overlying one or more logical storage devices; and to perform a check at each of one or more points in the input-output stack to confirm that a given input-output operation directed to a given device of the input-output stack is received from an expected overlying device of the input-output stack; wherein the input-output stack comprises an encryption device overlying the multi-path device; and wherein the check performed at a given one of the one or more points in the input-output stack relates at least in part to the encryption device. ### Claim 15 (depends on 14) The computer program product of claim 14 wherein performing a check at each of one or more points in the input-output stack comprises performing a check to confirm that a given input-output operation directed to the multi-path device is received from the encryption device. ### Claim 16 (depends on 14) The computer program product of claim 14 wherein the input-output stack further comprises: a first check module inserted in the input-output stack between the encryption device and the multi-path device to perform a first check to determine if a given input-output operation directed to the multi-path device is received from the encryption device; and a second check module inserted in the input-output stack between the multi-path device and the one or more logical storage devices to perform a second check to determine if a given input-output operation directed to at least one of the one or more logical storage devices is received from the multi-path device. ### Claim 17 A method comprising: providing at least a portion of an input-output stack for processing of input-output operations in a host device for delivery to a storage system over selected ones of a plurality of paths through a network, the input-output stack comprising at least a multi-path device overlying one or more logical storage devices; and performing a check at each of one or more points in the input-output stack to confirm that a given input-output operation directed to a given device of the input-output stack is received from an expected overlying device of the input-output stack; wherein the input-output stack comprises an encryption device overlying the multi-path device; and wherein the check performed at a given one of the one or more points in the input-output stack relates at least in part to the encryption device. ### Claim 18 (depends on 17) The method of claim 17 wherein performing a check at each of one or more points in the input-output stack comprises performing a check to confirm that a given input-output operation directed to the multi-path device is received from the encryption device. ### Claim 19 (depends on 17) The method of claim 17 wherein the input-output stack further comprises: a first check module inserted in the input-output stack between the encryption device and the multi-path device to perform a first check to determine if a given input-output operation directed to the multi-path device is received from the encryption device; and a second check module inserted in the input-output stack between the multi-path device and the one or more logical storage devices to perform a second check to determine if a given input-output operation directed to at least one of the one or more logical storage devices is received from the multi-path device. ### Claim 20 (depends on 17) The method of claim 17 wherein performing a check at each of one or more points in the input-output stack comprises performing a check at each of the one or more points to confirm that the given input-output operation at that point has associated therewith a completion callback function of the expected overlying device.