Emulex Corporation

Avago Technologies General IP (singapore) Pte. Ltd.

Emulex Design & Manufacturing Corporation

Larry Dean Hofer

John Sui-kei Tang

David C Lawson

Qiang Liu

An authentication service to authenticate access requests over a Fiber Channel (FC) network is provided. An authentication request is generated by a client and is sent over the FC network to a server. The request can be a native FC message, such as a CT message. For example, authentication software can generate the native FC message. In another example, authentication software can send a UDP or TCP authentication request, and an application program interface (API) can translate the request into a native FC message, such as a CT message, and send the message over the FC network. In another example, the authentication request can be sent as an encapsulated IP over FC message. For example, an authentication client can communicate using UDP or TCP messages, and an HBA can encapsulate the messages as IP over FC and send the encapsulated messages over the FC network.

Client/server authentication over Fibre channel

Methods and systems are provided for verifying use of encryption keys. A request for verification information may be sent by a network element (e.g., server), with the request comprising combination of one or more identifiers, the combination associated with a particular I/O operation. The request may be sent to another element, which may be a centralized encryption management element (e.g., management server). In response to the request, key use verification information generated for the particular I/O operation may be received, and may be used thereafter in validating a corresponding encryption key, which may be used during data encryption or decryption, based on the received key use verification information and locally generated verification information associated with the particular I/O operation. The one or more identifiers include at least one of a target identifier, a LUN identifier, and a LBA range identifier.

Method for verifying correct encryption key utilization

Embodiments of the invention are directed to automatically populating a database of names and secrets in an authentication server by sending one or more lists of one or more names and secrets by a network management software to an authentication server. Furthermore, some embodiments provide that the lists being sent are encrypted and/or embedded in otherwise inconspicuous files.

Secure configuration of authentication servers

A method for sending encrypted data in response to a request for an I/O operation. The method includes the steps of requesting a data encryption key, the request including one or more identifiers unique to the I/O operation; receiving a data encryption key attached with a first key use fingerprint, independently generating a second key use fingerprint in response to the one or more identifiers; comparing the first and the second key use fingerprints; and if the first key use fingerprint matches the second key use fingerprint, using the data encryption key to encrypt the data to be sent. In one embodiment, the one or more identifiers include at least one of a target identifier, a LUN identifier, and a LBA range identifier.

Growing community of inventors

Costa Mesa, CA, United States of America

Larry Dean Hofer