Preserving LBA information between layers of a storage I/O stack for LBA-dependent encryption

An apparatus comprising an encryption endpoint, the encryption endpoint including an interconnected processor, memory, encryption circuitry, and Input/Output (I/O) processing circuitry, the encryption endpoint being configured to:

• receive, via a storage I/O stack of a distributed computer system, the storage I/O stack having a key controller module (KCM):
• encryption metadata identifying an encryption key;
• and
• a set of region entries, each region entry of the set of region entries including:
• an identification of a region within a storage device of the system subject to encryption with the encryption key;
• and
• an identification of a correspondence between the region and a corresponding region on a logical volume (LV) managed by the KCM;
• subsequently, receive, via the storage I/O stack, a storage command to process a block on the storage device, the block having a first address on the storage device, the first address being located within a region identified by the set of region entries, the first address corresponding to a second address, the second address being located within the corresponding region of the LV;
• determine the second address within the LV;
• cryptographically process the block using an address-dependent cryptographic algorithm and the following inputs:
• data of the block;
• the determined second address;
• and
• the encryption key
• wherein cryptographically processing the block using the address-dependent cryptographic algorithm includes applying the address-dependent cryptographic algorithm to data of the block taking both the determined second address and the encryption key as parameters such that cryptographically processing blocks having the same data but different second addresses yields different results.

A method of passing encryption metadata for a logical volume (LV) between a key controller module (KCM) of a distributed computer system and an encryption endpoint (EE) of the system via a re-mapping intermediate layer (IL) of a storage Input/Output (I/O) stack of the system, the method comprising:

• receiving, at the re-mapping IL, from a higher-level layer in the storage I/O stack:
• encryption metadata identifying an encryption key;
• and
• a set of region entries, each region entry of the set of region entries including an identification of a region within a logical unit of storage (LU) of the system subject to encryption with the encryption key using an address-dependent cryptographic algorithm, the LU representing a portion of the LV;
• translating, at the re-mapping IL, the set of region entries to identify the encrypted regions of the LU on a device mapped to by the re-mapping IL;
• and
• sending, from the re-mapping IL to a lower-level layer in the storage I/O stack:
• the encryption metadata;
• the translated set of region entries;
• and
• an identification of a correspondence between each translated region on the device and a corresponding untranslated region on the LV;
• wherein the re-mapping IL is a virtualization module for virtualizing the LV across a plurality of devices.

A method comprising:

• receiving, at an encryption endpoint (EE) of a distributed computer system, via a storage Input/Output (I/O) stack of the system, the storage I/O stack having a key controller module (KCM):
• encryption metadata identifying an encryption key;
• and
• a set of region entries, each region entry of the set of region entries including:
• an identification of a region within a storage device of the system subject to encryption with the encryption key;
• and
• an identification of a correspondence between the region and a corresponding region on a logical volume (LV) managed by the KCM;
• subsequently, receiving, at the EE, via the storage I/O stack, a storage command to process a block on the storage device, the block having a first address on the storage device, the first address being located within a region identified by the set of region entries, the first address corresponding to a second address, the second address being located within the corresponding region of the LV;
• determining, at the EE, the second address within the LV;
• cryptographically processing, at the EE, the block using an address-dependent cryptographic algorithm and the following inputs:
• data of the block;
• the determined second address;
• and
• the encryption key;
• wherein:
• for each region entry of the set of region entries:
• the identification of the region includes:
• an address of an initial block of the region within the storage device;
• and
• a number of blocks in the region;
• and
• the identification of the correspondence between the region and the corresponding region on the LV includes a representation of an address of an initial block of the corresponding region within the LV;
• and
• the storage command to process the block on the storage device includes the first address within the storage device.