A somewhat apocryphal account on the 'Net describes how the design of the Space Shuttle is in part dependent on the typical dimensions of a horse’s hind end.

The chain of connections centers on rail gauge standards, tracing them back to Roman chariot specs - pretty much determined by the size of the horse - and forward to the size and shape of the solid boosters for the shuttle, which had to travel by rail and through a railroad tunnel. The lesson here: Sometimes an old technology puts a chokepoint into even the most sophisticated new systems.

In the maelstrom of virtualization sweeping through the data center - in the network, SAN and servers - there has been a chokepoint: the host bus adapter (HBA) that connects a physical server to the storage network.

Although the HBA can be shared by virtual systems, to the SAN all the virtual servers still appear to be using the same HBA. This hampers the use of some encryption tools in conjunction with virtualization. If the encryption depends on the unique identity of the server on the storage network, the virtual servers' lack of such a unique identity is a deal killer.

One way to avoid the limitations this introduces is to use a virtualize-able technology, like the data network, instead; virtual servers can appear unique on the data network, despite sharing a NIC. Using the data network for storage mostly means using NAS, which is not always acceptable for performance reasons, or talking to an array via iSCSI, which many enterprises are still reluctant to commit to.

Another approach is to use a blade system that handles the virtualization, like those of IBM or HP. But if non-blade servers are what you need to work with, and the SAN is where you need to be, the real solution - currently being pioneered by companies like Qlogic, Emulex and VMware - is of course to create and integrate a virtualization layer for the HBA. Doing so allows the rest of the storage infrastructure to treat virtual servers as completely separate entities. This in turn clears the roadblocks to various encryption tools and supports better compartmentalization of storage.

Of course, removing the chokepoint of the HBA still leaves in place some of the same problems with key management that we discussed a few weeks back; the HBA was not the only thing standing in the way of wider deployment of storage encryption. Although the HBA (is that “horse’s butt adapter?”) is now being virtualized, there are certainly other obstacles lurking in the infrastructure. (If you’ve got any that are vexing you, drop me a note!)