Brocade Communications Systems, Inc.

L Vincent M Isip

Richard A Walter

Subhojit Roy

Dennis Hideo Makishima

Daniel Y Chung

Daniel Ji Yong Park Chung

Shahe Hagop Krakirian

Naveen Maveli

Cirillo Lino Costantino

Subbaro Arumilli

Stephen D Elstad

The capability to encrypt or compress the traffic over network links, thus improving the security of the link on the performance of the links, and the capability to encrypt/decrypt data stored on the storage devices without requiring specialized hosts or storage devices. In a first embodiment, traffic to be routed over a selected link needing encryption and/or compression is routed to hardware which performs the encryption and/or compression and returned for transmission over the link. A complementary unit at the second end of the link routes the received frames to complementary hardware to perform the decryption and/or decompression. The recovered frames are then routed to the target device in a normal fashion. In a variation of this first embodiment the hardware is developed using an FPGA. This allows simple selection of the desired feature or features present in the switch. The switch can be easily configured to perform encryption, compression or both, allowing great flexibility to a system administrator. In a second embodiment frames can be encrypted by a switch and then provided to the storage device in this encrypted manner. The frames from the storage device are decrypted before provision to the requesting host. By performing the encryption and decryption in the switch, conventional hosts and storage devices can be utilized.

Method and apparatus for compression of data on storage units using devices inside a storage area network fabric

Method and apparatus for encryption of data on storage units using devices inside a storage area network fabric

Method and apparatus for encryption or compression devices inside a storage area network fabric

Placing virtualization agents in the switches which comprise the SAN fabric. Higher level virtualization management functions are provided in an external management server. Conventional HBAs can be utilized in the hosts and storage units. In a first embodiment, a series of HBAs are provided in the switch unit. The HBAs connect to bridge chips and memory controllers to place the frame information in dedicated memory. Routine translation of known destinations is done by the HBA, based on a virtualization table provided by a virtualization CPU. If a frame is not in the table, it is provided to the dedicated RAM. Analysis and manipulation of the frame headers is then done by the CPU, with a new entry being made in the HBA table and the modified frames then redirected by the HBA into the fabric. This can be done in either a standalone switch environment or in combination with other switching components located in a director level switch. In an alternative embodiment, specialized hardware scans incoming frames and detects the virtualized frames which need to be redirected. The redirection is then handled by translation of the frame header information by hardware table-based logic and the translated frames are then returned to the fabric. Handling of frames not in the table and setup of hardware tables is done by an onboard CPU.

Hardware-based translating virtualization switch

Growing community of inventors

Cupertino, CA, United States of America

L Vincent M Isip