Sridhar Balasubramanian and Frederick Knight, NetApp, Inc.
The Key Per IO (KPIO) proposal is a joint initiative between NVMe and TCG to define a new KPIO Security Subsystem Class (SSC) under TCG Opal SSC.
Self-Encrypting Drives (SED) perform continuous encryption on user accessible data based on contiguous LBA ranges per namespace. This is done at interface speeds using a small number of keys generated/held in NVM by the storage device.
KPIO will allow large numbers of encryption keys to be managed and securely downloaded into the NVM subsystem. Encryption of user data then occurs on a per command basis (each command may use a different key). This provides a finer granularity of data encryption that enables a granular encryption scheme in order to support the following use cases:
- Easier support of European Union’s General Data Protection Regulations’ (GDPR) “Right to be forgotten”
- Easier support of data erasure when data is spread over many disks (e.g., RAID/Erasure Coded)
- Easier support of data erasure of data that is mixed with other data needing to be preserved
- Assigning an encryption key to a single sensitive file or a host object
The talk will include a brief introduction to architectural differences between traditional SED and the KPIO SSC, followed by an overview of the proposed KPIO SSC standard, and subtle features of the KPIO SSC.
The talk will conclude by summarizing current state of the standardization proposal with NVMe and TCG WG's.
Sridhar Balasubramanian, NetApp, Inc.
Sridhar is currently working as Principal Security Architect within Product Security Group @ NetApp. With over 25 years in software industry, Sridhar is inventor/co-inventor for 16 US Patents and published 7 Conference papers till date. Sridhar's area of expertise includes Storage and Information Security, Security Assurance, Secure Software Development Lifecycle, Secure Protocols, and Storage Management. Sridhar holds a Master's degrees in Physics and Electrical Engineering
Frederick Knight, NetApp, Inc.
Frederick Knight is a Principal Standards Technologist at NetApp Inc. Fred has over 40 years of experience in the computer and storage industry. He currently represents NetApp in several National and International Storage Standards bodies and industry associations, including T10 (SCSI), T11 (Fibre Channel), T13 (ATA), IETF (iSCSI), SNIA, and JEDEC. He was the chair of the SNIA Hypervisor Storage Interfaces working group, the primary author of the SNIA HSI White Paper, the author of the new IETF iSCSI update RFC, and the editor for the T10 SES-3 standard. He is also the editor for the SCSI Architecture Model (SAM-6) and the Convenor for the ISO/IEC JTC-1/SC25/WG4 international committee (which oversees the international standardization of T10/T11/T13 documents). Fred has received several NetApp awards for excellence and innovation as well as the INCITS Technical Excellence Award for his contributions to both T10 and T11 and the INCITS Merit Award for his longstanding contributions to the international work of INCITS.
He is also the developer of the first native FCoE target device in the industry. At NetApp, he contributes to technology and product strategy and serves as a consulting engineer to product groups across the company. Prior to joining NetApp, Fred was a Consulting Engineer with Digital Equipment Corporation, Compaq, and HP where he worked on clustered operating system and I/O subsystem design.
Open Access Media
USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.
author = {Sridhar Balasubramanian and Frederick Knight},
title = {Key Per {IO} Security Subsystem Class for {NVM} Express Storage Devices},
year = {2020},
address = {Santa Clara, CA},
publisher = {USENIX Association},
month = feb
}