Method for Verifying Correct Encryption Key Utilization

A machine-readable storage medium comprising instructions when loaded into a volatile memory and executed by a processor causing a machine to perform operations comprising:

• requesting a data encryption key, the request including one or more identifiers unique to an I/O operation;
• receiving a data encryption key attached with a first key use fingerprint,
• independently generating a second key use fingerprint in response to the one or more identifiers;
• comparing the first and the second key use fingerprints;
• if the first key use fingerprint matches the second key use fingerprint, using the data encryption key to encrypt the data to be sent.

A key management server in communication with a server for assisting in encrypting an I/O operation, the key management server adapted for:

• receiving a request for a data encryption key from the server, the request including one or more identifiers unique to the I/O operation;
• generating the data encryption key;
• creating a key use fingerprint in response to the one or more identifiers;
• associating the key use fingerprint with the data encryption key;
• encrypting the data encryption key;
• sending the encrypted data encryption key and the associated key use fingerprint to the server.

A machine-readable storage medium comprising instructions when loaded into a volatile memory and executed by a processor causing a machine to perform operations comprising:

• receiving a request for a data encryption key from the server, the request including one or more identifiers unique to an I/O operation;
• generating the data encryption key;
• creating a key use fingerprint in response to the one or more identifiers;
• associating the key use fingerprint with the data encryption key;
• encrypting the data encryption key;
• sending the encrypted data encryption key and the associated key use fingerprint to the server.

A server in communication with a key management server for encrypting data associated with an I/O operation, the server adapted for:

• sending to the key management server a request for a data encryption key, the request including one or more identifiers unique to the I/O operation;
• receiving from the key management server a data encryption key attached with a first key use fingerprint,
• independently generating a second key use fingerprint in response to the one or more identifier;
• comparing the first and the second key use fingerprint;
• if the first key use fingerprint matches the second key use fingerprint, using the data encryption key to encrypt the data.

A host bus adapter (HBA) in communication with a driver in a server, the HBA adapted for:

• receiving a command to execute an I/O operation, the command comprising target information identifying a target device associated with the I/O operation, data information identifying data to be sent to the target device in response to the I/O operation, and a key pointer identifying a location of a data encryption key in the server, the data encryption key associated with a first key use fingerprint;
• extracting the data encryption key and the first key use fingerprint from the location identified by the key pointer;
• creating a second key use fingerprint in response to the target information;
• determining whether the data encryption key is appropriate for the I/O operation by comparing the first key use fingerprint and the second key use fingerprint;
• and
• if the data encryption key is appropriate for the I/O operation, obtaining data from the server in response to the data information and encrypting the data using the extracted data encryption key.

A method for transmitting a data encryption key from a key management server to a key-requesting server, the method comprising:

• creating a key use fingerprint in response to one or more identifiers provided by the key-requesting server;
• appending the key use fingerprint to the data encryption key;
• wrapping the data encryption key and the key use fingerprint in a key blob using a key wrapping algorithm;
• and
• sending the key blob from the key management server to the key-requesting server.