Method and apparatus for performing encryption of data at rest at a port of a network device

In a network device having a plurality of ports, a method of decrypting data, comprising:

• receiving by one of the plurality of ports a command frame, the command frame being a read command frame including a source identifier and a destination identifier, the source identifier identifying a host and the destination identifier identifying a storage medium;
• transmitting by the one of the plurality of ports the command frame to the destination identifier;
• receiving a frame including data by the one of the plurality of ports, the frame having a header including a source address and a destination address, wherein the source address identifies a storage medium and the destination address identifies a host;
• obtaining the data from the frame by the one of the plurality of ports;
• decrypting the data by the one of the plurality of ports to generate decrypted data;
• generating a modified frame including the decrypted data by the one of the plurality of ports;
• and
• transmitting the modified frame including the decrypted data by the one of the plurality of ports to the destination address;
• receiving a credit from the storage medium;
• and
• transmitting the credit to the host when the modified frame is generated and transmitted;
• wherein obtaining, decrypting, and generating are performed by logic dedicated to the one of the plurality of ports such that decryption is automatically performed on a per-port basis.

A network device having a plurality of ports, the network device being adapted for encrypting data, comprising:

• means for receiving by a processor of one of the plurality of ports a command frame, the command frame being a write command frame including a source identifier and a destination identifier, the source identifier identifying a host and the destination identifier identifying a storage medium;
• means for transmitting by the processor of the one of the plurality of ports the command frame to the destination identifier;
• means for receiving a frame including data by the processor of the one of the plurality of ports, the frame having a header including a source address and a destination address, wherein the source address identifies the host and the destination address identifies the storage medium;
• means for obtaining the data from the frame by the processor of the one of the plurality of ports;
• means for encrypting the data by the processor of one of the plurality of ports to generate encrypted data;
• means for generating a modified frame including the encrypted data by the processor of the one of the plurality of ports;
• and
• means for transmitting the modified frame including the encrypted data by the processor of the one of the plurality of ports to the destination address such that encryption is automatically performed on a per-port basis;
• means for receiving a credit from the storage medium;
• and
• means for transmitting the credit to the host when the modified frame is generated and transmitted.

A network device having a plurality of ports, the network device being adapted for decrypting data, comprising:

• a plurality of ports;
• wherein one or more of the plurality of ports each includes a separate, dedicated processor that is configured for performing the following steps:
• receiving a command frame, the command frame being a write command frame including a source identifier and a destination identifier, the source identifier identifying a host and the destination identifier identifying a storage medium;
• transmitting the command frame to the destination identifier;
• receiving a frame including data, the frame having a header including a source address and a destination address, wherein the source address identifies the host and the destination address identifies the storage medium;
• obtaining the data from the frame;
• encrypting the data to generate encrypted data;
• generating a modified frame including the encrypted data;
• transmitting the modified frame including the encrypted data to the destination address, thereby performing encryption on a per-port basis
• receiving a credit from the storage medium;
• and
• transmitting the credit to the host when the modified frame is generated and transmitted.

An apparatus, comprising:

• a plurality of ports;
• wherein one or more of the plurality of ports each includes a separate, dedicated processor that is dedicated to one of the plurality of ports, the dedicated processor being configured for performing the following steps:
• receiving by one of the plurality of ports a command frame, the command frame being a write command frame including a source identifier and a destination identifier, the source identifier identifying a host and the destination identifier identifying a storage medium;
• transmitting by the one of the plurality of ports the command frame to the destination identifier;
• obtaining by the one of the plurality of ports data from a frame received by the one of the plurality of ports, the frame having a header including a source address and a destination address, wherein the source address identifies the host and the destination address identifies the storage medium;
• encrypting the data by the one of the plurality of ports to generate encrypted data;
• generating a modified frame including the encrypted data by the one of the plurality of ports;
• transmitting the modified frame including the encrypted data by the one of the plurality of ports to the destination address;
• receiving a credit from the storage medium;
• and
• transmitting the credit to the host when the modified frame is generated and transmitted.