Abstract:
In one aspect, a method to offload encryption processing in a storage area network (SAN) system includes determining whether a host is performing at a first performance level, offloading encryption processing at a processor if the host is not performing at a first performance level and performing encryption processing at the host if the host is performing at a first performance level.

Description:
BACKGROUND 
     Referring to  FIG. 1 , a conventional storage area network (SAN)  10  includes one or more hosts (e.g., a host  12 ) connected to one or more storage arrays (e.g., a storage array  16 ) by a channel (e.g., a fibre channel switch  14 , an IP switch for iSCSI and so forth). The host  12  accesses the storage area  16  by sending input/output (IO) transactions such as read commands to read data from the storage array or as write commands to write data to the storage array. When the host  12  sends data to be written to the storage array  16 , the storage array generally sends an acknowledgment message to the host that the data was successfully written to the storage array or sends an error message that an error has occurred. When the host  12  sends a request to read data from the storage array  16 , the storage array responds by providing the data to the host. In some situations, the data written to the storage array  16  is encrypted by the host  12  or the data read from the storage array is decrypted by the host. 
     SUMMARY 
     In one aspect, a method to offload encryption processing in a storage area network (SAN) system includes determining whether a host is performing at a first performance level, offloading encryption processing to a processor if the host is not performing at a first performance level and performing encryption processing at the host if the host is performing at a first performance level. 
     In another aspect, an apparatus to offload encryption processing in a storage area network (SAN) system includes circuitry configured to determine whether a host is performing at a first performance level, offload encryption processing to a processor if the host is not performing at a first performance level and perform encryption processing at the host if the host is performing at a first performance level. 
     In a further aspect, an article includes a machine-readable medium that stores executable instructions to offload encryption processing in a storage area network (SAN) system. The instructions cause a machine to determine whether a host is performing at a first performance level, offload encryption processing to a processor if the host is not performing at a first performance level and perform encryption processing at the host if the host is performing at a first performance level. 
    
    
     
       DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a simplified diagram of an example of a prior art storage area network. 
         FIG. 2  is a block diagram of an example of a storage-area network used in offloading encryption processing. 
         FIG. 3A  is a flowchart of a process to offload encryption performed at a host. 
         FIG. 3B  is a flowchart of a process to offload encryption performed at a processor. 
         FIG. 4A  is a flowchart of a process to offload encryption of an IO transaction performed at a host. 
         FIG. 4B  is a flowchart of a process to offload encryption of an IO transaction performed at a processor. 
         FIG. 5  is a block diagram of another example of a storage-area network used in offloading encryption processing. 
         FIG. 6  is a computer on which the processes of  FIGS. 3A ,  3 B,  4 A and  4 B may be implemented. 
     
    
    
     DETAILED DESCRIPTION 
     Described herein is an approach to offload encryption processing in a storage area network (SAN). While the description herein shows a single host and a single storage array for simplicity it is to be understood that the SAN may include multiple hosts and storage arrays and that any one (or more than one) of the hosts may offload encryption processing. While the description focuses on encryption processing it is understood that encryption processing includes decrypting data also. 
     Referring to  FIG. 2 , a storage area network (SAN)  20  is used in offload encryption. The SAN  20  includes a host  12 , a storage array  16  coupled together by a fibre channel switch  14  and a processor  22 . In one example, the processor  22  forms part of a data protection appliance (e.g., a data protection appliance  510  in  FIG. 5 ) used to duplicate data in the storage array  16 . In another example, the encryption processor is a dedicated offload encryption processor used for offload encryption processing. In other examples, the processor  22  may be any other processor in the SAN network including processors at other hosts (not shown). 
     The host  12  determines whether the host has a minimum processing bandwidth available to perform encryption processing. For example, the host  12  determines a utilization parameter value. If the utilization parameter value is less than a predetermined threshold value for the host  12 , the host performs the encryption processing. If the utilization parameter value is greater than a predetermined threshold value for the host  12 , the processor  22  performs the encryption processing. In one embodiment, a decision to offload encryption is made for each IO transaction. 
     In one embodiment, the processor  22  performs the encryption processing until it no longer has the bandwidth processing available to support encryption. For example, the processor  22  has a primary purpose of, for example, duplication processing and encryption processing is a secondary or lesser priority. If the processor  22  determines that a utilization parameter value at the processor  22  is greater than a predetermined threshold value for the processor  22 , the processor  22  sends encryption processing back to the host  12 . In another embodiment, the processor  22  performs encryption on an IO transaction. 
       FIG. 3A  shows offload encryption processing performed at the host  12  using a process  100 . The host  12  determines a performance parameter value for the host ( 102 ). For example, the performance parameter value for the host  12  is the processor utilization at the host. The host  12  determines whether the performance parameter value for the host is less than a predetermined threshold value ( 108 ). For example, the predetermined threshold value is a processor utilization value of 10% at the host  12 . If the performance parameter value for the host  12  is less than the predetermined threshold value, the host performs the encryption ( 110 ). If the performance parameter value for the host  12  is greater than or equal to the predetermined threshold value, encryption processing is offloaded to the processor  22  ( 112 ). 
       FIG. 3B  shows offload encryption processing performed at the processor  22  using a process  200 . The processor  22  determines a performance parameter value for the processor  22  ( 202 ). For example, the performance parameter value for the processor  22  is a processor utilization value for the processor  22 . The processor  22  determines whether the performance parameter value for the processor is less than a predetermined threshold value for the processor ( 208 ). For example, the predetermined threshold value for the processor is a processor utilization value of 95% at the processor  22 . If the performance parameter value for the processor  22  is less than the predetermined threshold value for the processor, the processor  22  performs the encryption ( 210 ). If the performance parameter value for the processor  22  is greater than or equal to the predetermined threshold value for the processor, encryption processing is returned to the host  12  ( 212 ). In another embodiment, encryption processing is returned to the host  12  when the host processor utilization falls below the predetermined threshold at the host 
     In other embodiments, the decision to offload encryption processing may be made for each IO transaction. For example,  FIG. 4A  show a process  300  performed at the host  12  and  FIG. 4B  shows a process  400  performed at the processor  22  for each IO transaction. Referring to  FIG. 4A , the host  12  receives an IO transaction requiring encryption processing ( 302 ). The host  12  determines a performance value at the host ( 306 ) and determines if the performance parameter is less than a threshold value ( 308 ). If the performance parameter is below the threshold value, the host  12  performs the encryption processing ( 310 ). If the performance value is more than the threshold value, the host  12  determines if there is a processor available for encryption processing ( 312 ). Even though, one processor, processor  22 , is shown in  FIG. 1 , for simplicity, there can be any number of processors available in the SAN  20  that may be used for offload encryption processing. If no processor is available, the host  12  performs the encryption processing on the IO transaction ( 310 ). If a processor is available, the host  12  sends the IO transaction to the processor  22  ( 318 ). The host  12  determines if the processor is busy ( 324 ). For example, if the processor  22  does not have the capacity it will return a message to the host  12  indicating it is busy (see processing block  420   FIG. 4B ). If encryption processing cannot be performed by the processor, the host  12  determines if another processor is available ( 326 ) and, if another processor is available, sends the IO transaction to the next processor available ( 328 ). 
     Referring to  FIG. 4B , the processor  12  receives a request for encryption processing from the host  12  ( 402 ) and determines whether the processor can perform encryption processing ( 408 ). If the processor  22  cannot perform the encryption processing, the processor  22  returns a message (e.g., a busy signal) to the host  12  indicating encryption processing cannot be performed ( 420 ). If the processor  22  can perform the encryption processing, the processor  22  performs the encryption processing ( 436 ) and returns the result of the IO transaction to the host  12  ( 442 ). For example, if the IO transaction is an encrypt and write command, the processor  22  encrypts the data and writes the encrypted data to the storage array  16  and the processor  22  returns a write result (e.g., a write success status) to the host  12 . If the IO transaction is a read and decrypt command, the processor  22  will read and decrypt the data and return the decrypted data to the host  12 . 
     Referring to  FIG. 5 , in one embodiment, a SAN  20 ′ includes the processor  22  and the host  12 . The host  12  includes a driver  510 , a graphical user interface (GUI)  512  and an encryption module  514 . The processor  22  forms part of a data protection appliance  520  used to duplicate data in the storage array  16 , for example, a data protection appliance found in patent application Ser. No. 11/536,160, filed on Sep. 28, 2006, assigned to the same assignee as this patent application and is incorporated herein in its entirety. 
     The driver  510  detects automatically the availability of encryption processors for offloading. In one example, the driver  510  detects the availability of encryption processors, and offloads data arriving to storage arrays selected by a user using the GUI  512 . After an IO transaction is detected by the driver  510 , the driver checks a performance parameter at the host  12 . The driver  510  determines based on the performance parameter whether to redirect the IO transaction to an offload encryption device (e.g., the processor  22 ) or perform encryption processing at the host  12  using the encryption module  514 . If the IO transaction is directed to the processor  22  for encryption processing, the processor  22  performs encryption processing on the data in the IO transaction writes the encrypted data to the storage array and returns an IO transaction status to the host  12 . If the host  12  performs the encryption processing, the driver  510  will send the IO transaction to the encryption module  514 . For example, the driver  510  receives the IO transactions before the encryption module  514  so that the driver  510  can direct them to the processor  22  for offload encryption processing or direct them to the encryption module  514 . If the processor  22  is unavailable, driver  510  can offload encryption processing to another processor (not shown). If all processors designated for offload encryption processing are unavailable, the IO transaction will flow directly to the encryption module  514  and encrypted by the host  12 . 
       FIG. 6  shows a computer  600 , which may be used to execute all or part of processes  100 ,  200 ,  300  or  400 . Computer  600  includes a processor  602 , a volatile memory  604  and a non-volatile memory  606  (e.g., hard disk). Non-volatile memory  606  includes an operating system  610 , data  612  including a threshold value  31  and a performance value  618 , and computer instructions  614  which are executed out of volatile memory  604  to perform processes  100 ,  200 ,  300  or  400  or portions of processes  100 ,  200 ,  300  or  400 . 
     The processes described herein (e.g., processes  100 ,  200 ,  300  and  400 ) are not limited to use with the hardware and software of  FIG. 6 ; it may find applicability in any computing or processing environment and with any type of machine or set of machines that is capable of running a computer program. The processes may be implemented in hardware, software, or a combination of the two. The processes may be implemented in computer programs executed on programmable computers/machines that each includes a processor, a storage medium or other article of manufacture that is readable by the processor (including volatile and non-volatile memory and/or storage elements), at least one input device, and one or more output devices. Program code may be applied to data entered using an input device to perform the processes and to generate output information. 
     The system may be implemented, at least in part, via a computer program product, (e.g., in a machine-readable storage device, for execution by, or to control the operation of, data processing apparatus (e.g., a programmable processor, a computer, or multiple computers)). Each such program may be implemented in a high level procedural or object-oriented programming language to communicate with a computer system. However, the programs may be implemented in assembly or machine language. The language may be a compiled or an interpreted language and it may be deployed in any form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment. A computer program may be deployed to be executed on one computer or on multiple computers at one site or distributed across multiple sites and interconnected by a communication network. A computer program may be stored on a storage medium or device (e.g., CD-ROM, hard disk, or magnetic diskette) that is readable by a general or special purpose programmable computer for configuring and operating the computer when the storage medium or device is read by the computer to perform the processes (e.g., process  100 ,  200 ,  300  or  300 ). The processes may also be implemented as a machine-readable storage medium, configured with a computer program, where upon execution, instructions in the computer program cause the computer to operate in accordance with the processes. 
     The processes described herein are not limited to the specific embodiments described herein. For example, the processes  100 ,  200 ,  300  and  400  are not limited to the specific processing order of the processing blocks in  FIGS. 3A ,  3 B,  4 A and  4 B. Rather, any of the processing blocks of  FIGS. 3A ,  3 B,  4 A and  4 B may be re-ordered, combined or removed, performed in parallel or in serial, as necessary, to achieve the results set forth above. 
     The system described herein is not limited to use with the hardware and software described above. The system may be implemented in digital electronic circuitry, or in computer hardware, firmware, software, or in combinations thereof. 
     Processing blocks in  FIGS. 3A ,  3 B,  4 A and  4 B may be performed by one or more programmable processors executing one or more computer programs to perform the functions of the system. All or part of the system may be implemented as, special purpose logic circuitry (e.g., an FPGA (field programmable gate array) and/or an ASIC (application-specific integrated circuit)). 
     Processors suitable for the execution of a computer program include, by way of example, both general and special purpose microprocessors, and any one or more processors of any kind of digital computer. Generally, a processor will receive instructions and data from a read-only memory or a random access memory or both. Elements of a computer include a processor for executing instructions and one or more memory devices for storing instructions and data. 
     Elements of different embodiments described herein may be combined to form other embodiments not specifically set forth above. Other embodiments not specifically described herein are also within the scope of the following claims.