Method for securing data storage in a storage area network
AssigneeSanrad, Ltd.
InventorYaron Klein
Life of this patent
Estimating the term…
Abstract
Disclosed is a device and method for securing stored data in an IP based storage area network (SAN), where the physical storage media is located in an unprotected site. The connection between the client and the unprotected site is established over a public or private IP network preferably by means of an iSCSI protocol. According to the present invention a data block to be saved in a remote site is encrypted at the initiator host using a private encryption key and an encrypt key. The private encryption key is saved in a key management table which is shared among other hosts that may access the encrypted data block.
Claims43
A method for securing data by performing block level encryption, comprising:
- receiving at a host a write small computer system interface (SCSI) command, said write SCSI command including at least a data block and a location in a storage device into where said block is to be written to;
- encrypting at the host said data block using a private encryption key, wherein the encrypted data block is transmitted from said host to a storage device over a distributed storage network;
- saving said private encryption key associated with said data block in a key management table (KMT);
- and,
- distributing said private encryption key to other hosts having an access to the encrypted data block.
A computer executable code for securing data by performing block level encryption, said code comprising:
- receiving at a host a write small computer system interface (SCSI) command, said write SCSI command including at least a data block and a location in a storage device into where said block is to be written to;
- encrypting at the host said data block using a private encryption key, wherein the encrypted data block is transmitted from said host to a storage device over a distributed storage network;
- saving said private encryption key associated with said data block in a key management table (KMT);
- and,
- distributing said private encryption key to other hosts having an access to the encrypted data block.
A method for securing data by performing block level decryption of previously encrypted data blocks, said comprising:
- receiving at a host a read small computer system interface (SCSI) command, said read SCSI command including at least an address of an encrypted data block to be read from a storage device;
- retrieving said encrypted data block from said storage device;
- sending said encrypted data block to said host, wherein said encrypted data block is transmitted from said storage device to said host over a distributed storage network;
- retrieving from a keys management table (KMT) a private encryption key associated with said encrypted data block;
- and,
- decrypting at the host said encrypted data block using said private encryption key.
A computer executable code for securing data by performing block level decryption of previously encrypted data blocks, said code comprising:
- receiving at a host a read small computer system interface (SCSI) command, said read SCSI command including at least an address of an encrypted data block to be read from a storage device;
- retrieving said encrypted data block from said storage device;
- sending said encrypted data block to said host, wherein said encrypted data block is transmitted from said storage device to said host over a distributed storage network;
- retrieving from a keys management table (KMT) a private encryption key associated with said encrypted data block;
- and,
- decrypting at the host said encrypted data block using said private encryption key.
A method for securing data by performing data shuffling, comprising:
- a) receiving at a host a write small computer system interface (SCSI) command together with a data block and an original location indicating the destination of said data block;
- b) applying at the host a mapping function for the purpose of determining a new location for said data block;
- and,
- c) writing said data block to said new location.
A computer executable code for securing data by performing data shuffling, said code comprising:
- receiving at a host a write small computer system interface (SCSI) command together with a data block and an original location indicating the where to save said data block;
- applying at the host a mapping function for the purpose of determining a new location for said data block;
- and,
- writing said data block to its said new location.
A host computer for the purpose of securing data by performing block level encryption, said host computer comprising at least:
- an encryption engine;
- a decryption engine;
- a host initiator;
- a connection to a network, the network being coupled to at least a storage gateway;
- means for receiving a write small computer system interface (SCSI) command from the host initiator, said write SCSI command including at least a data block and a location in a storage device into where said block is to be written to;
- means for saving a private encryption key associated with said data block in a key management table (KMT);
- and,
- means for distributing said private encryption key to other hosts having an access to said data block.
Dependencies are inferred from the claim text.