Brocade Communications Systems, Inc.

Lintu Thomas

Christopher A Del Signore

Aseem Rastogi

Suresh Vobbilisetty

A key identifier for an encryption key repository is stored with customer data on a logical device. When the customer data is compressible, the key identifier is stored in space freed by compressing the customer data. When the customer data is not compressible, a portion of the customer data is copied to a key record in the key repository identified by the key identifier, and the key identifier overwrites the copied customer data.

Storage of keyID in customer data area

A gateway includes a Fibre Channel ('FC') port configured to couple to multiple FC targets, and an iSCSI port configured to couple to an iSCSI initiator. The iSCSI port is configured to facilitate communication between the FC targets and the iSCSI initiator, and proxy the multiple FC targets as a virtual iSCSI target. The iSCSI port is also configured to divide the Logical Unit Number ('LUN') range into a plurality of subdivided LUN ranges, and associate the FC targets with the subdivided LUN ranges.

Proxying multiple targets as a virtual target using identifier ranges

In embodiments according to the present invention an encryption switch is used to authorize access to LUNs from client VMs present in the cloud provider network. The encryption switch includes responder side software for an authentication protocol and an agent in the client VM includes the requestor side of the authentication protocol. The certificate of the client is securely provided to the encryption switch, which associates the client VM with the LUN. The client private key is securely provided to the client VM, which retains it only non-persistently. The client VM requests LUN access and performs an authentication handshake with the encryption switch. If successful the client VM than has access to the LUN. As the original certificate is linked to the client, if the client is itself a VM, should the client be moved to a different host, the certificate moves with it and LUN accessibility is maintained.

Storage access authentication mechanism

An encryption switch which is used in a cloud environment to secure data on the LUNs used by the clients. A client provides a certificate to the cloud service. The encryption switch develops a cloud crypto domain (CCD) as a secure area, with the data at rest on the LUNs encrypted. The encryption switch develops a master key for client use in the CCD, which is provided to the client encrypted by the client's public key. Data encryption keys (DEKs) are created for each LUN and provided to the client. The DEKs are stored in a key vault by the client for use if needed. The cloud service provisions a client VM to be used with the encrypted LUN and develops a nexus between the LUN and the client VM for the encryption switch to use in data operations. The client communicates through the client VM to access the LUN.

Growing community of inventors

Fremont, CA, United States of America

Lintu Thomas