Abstract: Rekeying an Information Handling System (IHS) network End-to-End Efficient Encryption (E2EEE) with security chaining includes locking an encrypted data volume, preventing reading of, and writing to, the encrypted data volume by applications. A data source IHS may request a new key from a key management system and write new metadata in a trailer of the encrypted data block using a different key slot than a currently used and active metadata key slot, wherein the different key slot is updated with the with the new key. The data source IHS then sends an out-of-data signal to change the use key slot from the currently used key slot to the different key slot. Thereafter, the data source IHS unlocks the encrypted data volume, enabling writing and/or reading user data by the data source IHS and encryption and decryption in all IHS E2EEE data connection segment interfaces.

Abstract: Enabling End-to-End Efficient Encryption (E2EEE) with security chaining in an Information Handling System (IHS) network includes: a data source IHS writing metadata containing a key slot, in a trailer of a data block and sending an out-of-band signal to use the key slot; an IHS security chaining logic regenerates the signal to each next IHS E2EEE data connection segment interface; and an encryption configuration state machine of each interface setting a use slot and an active slot to the key slot, in response to the signal. Disabling E2EEE with security chaining includes: the data source IHS sending an out-of-band signal to not use a key slot; the IHS security chaining logic regenerating the signal to each next interface; and the state machine of each interface changing the state machine state to not use a key slot and to not set an active key slot, in response to the signal.

Abstract: In end-to-end efficient encryption with security chaining a data source Information Handling System (IHS) encrypts a data volume, generates and updates metadata in a trailer of the data volume, and generates and updates out-of-band handshake signals indicating an encryption key use slot in the metadata. Data connection segments each include a left-bound interface of one IHS and a right-bound interface of another. Each interface performs synchronous data volume write-encrypt and read-decrypt functions on the data volume in an IHS, perform in-band encryption metadata processing, process out-of-band control signals, and execute an encryption configuration state machine, which uses the metadata and control signals as input to direct write-encrypt and read-decrypt functions on the data volume in the segment.

Abstract: A storage system may assign a different encryption key to each logical storage unit (LSU) of a storage system. For each LSU, the encryption key of the LSU may be shared only with host systems authorized to access data of the LSU. In response to a read request for a data portion received from a host application executing on the host system, encryption metadata for the data portion may be accessed. If it is determined from the encryption metadata that the data portion is encrypted, the data encryption metadata for the data portion may be further analyzed to determine the encryption key for the data portion. The data may be retrieved from the storage system, for example, by performance of a direct read operation. The retrieved data may be decrypted, and the decrypted data may be returned to the requesting application.

Abstract: Techniques for performing configuration may include: determining an initial distribution of logical devices among disk adapters, wherein the initial distribution assigns each logical device a designated disk adapter as a primary active disk adapter servicing I/Os directed to the logical device, wherein the logical devices have storage provisioned from a RAID group including physical storage devices, wherein the disk adapters concurrently issue I/Os to each of the physical storage devices; detecting a configuration change; and responsive to detecting a configuration change, performing first processing. The first processing may include determining, in accordance with the configuration change, a redistribution of the logical devices among the disk adapters; and draining pending I/Os. The configuration change may include adding or removing a logical device provisioned from the RAID group.

Abstract: A storage system may assign a different encryption key to each logical storage unit (LSU) of a storage system. For each LSU, the encryption key of the LSU may be shared only with host systems authorized to access data of the LSU. In response to a read request for a data portion received from a host application executing on the host system, encryption metadata for the data portion may be accessed. If it is determined from the encryption metadata that the data portion is encrypted, the data encryption metadata for the data portion may be further analyzed to determine the encryption key for the data portion. The data may be retrieved from the storage system, for example, by performance of a direct read operation. The retrieved data may be decrypted, and the decrypted data may be returned to the requesting application.

Abstract: Techniques for processing I/O operations may include performing DMA (direct memory access) operations between a data storage system, one or more physical storage devices, and a hardware component that communicate over at least one bus using a DMA-based protocol, such as NVMe (Non-Volatile Memory Express). The hardware device may perform encryption and decryption processing of data that is, respectively, stored to, and read from, physical non-volatile storage. The hardware device may optionally perform other processing for other data-related operations such as any of data validation and integrity checking, data deduplication, data compression, and data decompression. When performing DMA transfers, multiple descriptors, such as SGLs (scatter gather lists) or PRPs (physical region pages), for multiple data portions having logically contiguous consecutive logical addresses may be combined into a single descriptor sent in a single DMA operation.

Abstract: Techniques for processing I/O operations may include performing DMA (direct memory access) operations between a data storage system, one or more physical storage devices, and a hardware component that communicate over at least one bus using a DMA-based protocol, such as NVMe (Non-Volatile Memory Express). The hardware device may perform encryption and decryption processing of data that is, respectively, stored to, and read from, physical non-volatile storage. The hardware device may optionally perform other processing for other data-related operations such as any of data validation and integrity checking, data deduplication, data compression, and data decompression. When performing DMA transfers, multiple descriptors, such as SGLs (scatter gather lists) or PRPs (physical region pages), for multiple data portions having logically contiguous consecutive logical addresses may be combined into a single descriptor sent in a single DMA operation.

Abstract: Techniques for performing configuration may include: determining an initial distribution of logical devices among disk adapters, wherein the initial distribution assigns each logical device a designated disk adapter as a primary active disk adapter servicing I/Os directed to the logical device, wherein the logical devices have storage provisioned from a RAID group including physical storage devices, wherein the disk adapters concurrently issue I/Os to each of the physical storage devices; detecting a configuration change; and responsive to detecting a configuration change, performing first processing. The first processing may include determining, in accordance with the configuration change, a redistribution of the logical devices among the disk adapters; and draining pending I/Os. The configuration change may include adding or removing a logical device provisioned from the RAID group.