Emc IP Holding Company LLC

Emc Corporation

Dell Products Inc.

Other

Ems Ep Holding Company LLC

Arieh Don

Vinay G Rao

Sanjib Mallick

Ian Wigmore

Alexandr Veprinsky

Philip Derbeko

Stephen Smaldone

Michael J Scharland

Patrick Brian Riordan

Assaf Natanzon

Gabriel Benhanokh

Owen Martin

Subin George

Marik Marshak

Krishna Deepak Nuthakki

Felix Shvaiger

Alex Veprinsky

Anat Eyal

Scott Rowlands

Yaron Dar

Erik P Smith

Zvi Gabriel Benhanokh

Adnan Sahin

Jaeyoo Jung

Jehuda Shemer

Michael E Specht

Kenneth A Halligan

David Meiri

Anton Kucherov

Helen S Raizen

Tomer Shachar

Anestis Panidis

Natan Vishlitzky

Xiali He

David Joshua Brown

Elie Antoun Jreij

Saar Cohen

Ramesh Doddaiah

Sunil Kumar

Yevgeni Gehtman

Amit Pundalik Anchi

Philip E Tamer

Andrew Chanler

Maxim Balin

Dan Aharoni

Ajith Balakrishnan

Roy E Clark

Michael E Bappe

John T Fitzgerald

Hana Moreshet

Amnon Naamad

Deepak Vokaliga

Michael Ferrari

Mathieu Gagne

Gopinath Marappan

Owen Crowley

Ishay Kedem

Benjamin W Yoder

Malak Alshawabkeh

Dan Arnon

Erez Ofer

Peniel Charles

Randall Shain

Stephen Richard Ives

Harold Martin Sandstrom

Alesia Tringale

Ofer Michael

Igor Achkinazi

Prakash Venkatanarayanan

Philippe Armangau

Douglas Eric LeCrone

Ching-Yun Chao

Mark J Halstead

Haim Kopylovitz

Peng Wu

Rong Yu

Xiaoye Jiang

Eitan Bachmat

Hui Wang

Jonathan I Krasner

Thomas L Watson

Amihai Savir

Stav Sapir

Ron Arnan

Valerie Lotosh

Xiaomei Liu

Yechiel Yochai

Ning Wu

Kurumurthy Gokam

Jeremy O'Hare

Kundan Kumar

John Creed

Bhaskar Bora

Rimpesh Patel

Donald Mace

Hongliang Tang

Naor Radami

John W Bates

Benjamin Randolph

Michael D Barber

An identifier, such as a worldwide name, corresponding to a host computing device, or corresponding to a host bus adapter corresponding to the host computing device, may be transmitted to a storage array to configure the storage array to be accessed by the host computing device. The host may request a token from the array. The host may embed the token into a token block of a command message that is transmitted to the storage array requesting access to the array. Before performing an action corresponding to the command message, the storage array may verify that the token is a valid token and thus that the host computing device that transmitted the command message is a host computing device that has been authorized to access the storage array. If the storage array determines that the token is valid the storage array may perform an action corresponding to the command message.

Multi-factor security in fiber channel protocol

Methods, apparatus, and processor-readable storage media for implementing host-controlled service levels are provided herein. An example computer-implemented method includes obtaining, at a storage node of a storage system, information comprising one or more identifiers and one or more service levels that are assigned to virtual machines identified by the one or more identifiers; extracting one of the one or more identifiers from an input-output operation received at the storage node; identifying, based on the extracted identifier, the service level that is assigned to the virtual machine that initiated the input-output operation; and controlling storage resources allocated for one or more additional input-output operations from one or more of the virtual machines based at least in part on the identified service level.

Configuring storage resources based on service levels

Host-resident software such as a Multi-Path Input-Output (MPIO) driver generates notifications of scheduled host shutdowns and unscheduled host shutdowns. A storage node generates emergency snapshots of storage objects masked to the host server in response to receipt of an unscheduled shutdown notification. The storage node also generates emergency snapshots of storage objects masked to a host server in response to detection of a reboot sequence of the host server when a corresponding scheduled shutdown notification was not received beforehand.

Host anomaly snaps

Different management applications corresponding to different private computing systems that are untrusted with respect to each other reciprocally agree to store for each other replicated versions of logical volumes of storage arrays as backups. A management server corresponding to one or more storage arrays at a local one of the computing systems encrypts a volume to be backed up at the other remote computing system and transmits the encrypted version to the remote computing system. The remote computing system cannot modify or delete a portion of an array that has stored thereon the encrypted version of the logical volume without having a configuration-change key generated by the local management server, which may generate the configuration-change key to facilitate mirroring at the remote storage array a modification made to the local storage array.

Untrusted remote replication partnering

In a software-defined data storage system with a production node and local and remote storage nodes that replicate data generated by an application running on the production node, all filesystem metadata associated with remotely replicated devices is copied from the remote storage node to memory of the production node in response to establishment of a communication link between the production node and remote storage node. That metadata is maintained in the memory for as long as the link is active and used to generate multiple remote replication IOs. Local replication is implemented by reading only necessary metadata from the local storage node on a per-IO basis. The cached metadata is flushed from memory in response to loss of the communication link.

Efficient storage device handling in remote replication

An apparatus in an illustrative embodiment comprises at least one processing device that includes a processor coupled to a memory. The at least one processing device is configured to implement a centralized discovery controller for coupling to a host and to a storage system accessed by the host, with the centralized discovery controller being configured to receive from the host a congestion alert, and responsive to the received congestion alert, to send to the host and to one or more targets of the storage system corresponding congestion control messages. The congestion alert is illustratively received in the centralized discovery controller from a multi-path input-output (MPIO) driver of the host, where the MPIO driver controls delivery of IO operations from the host to the storage system over selected paths. The congestion control messages may comprise respective Asynchronous Event Notifications (AENs) associated with respective Asynchronous Event Requests (AERs).

Host multi-path layer with congestion mitigation through interaction with centralized discovery controller

Methods and systems for managing storage services provided by storage arrays are disclosed. The storage services may be managed by proactively identifying and remediating malicious activity that may impact the storage services. The malicious activity may be identified by monitoring activity of adapters used by host devices to communicate with the storage arrays. The activity may be monitored to identify patterns of reset commands that are likely to negatively impact storage services provided by the storage arrays.

Protecting storage arrays from load attacks

Methods and systems for offloading signature computations are disclosed. The signature computations may be offloaded from a storage array to a host. The host may use data processing units or graphical processing units to process the signature computations. In processing the signature computations by the host, the storage array may further process deduplication of the signatures, once they are received from the host. The host may require that the storage array support the distributed system and the deduplication procedure and meet a deduplication ratio specified by a criteria.

Data storage through offloading signature computations

A storage array is configured with an allowed process configuration. An allowed process may correspond to an application or process executed by a host computing system that may seek to access a volume of the storage array via a command descriptor block message or a corresponding block command message, which may comprise a data field and a metadata field. The host may embed a process identifier corresponding to a process seeking to access the storage array in the metadata field. The storage array may receive the block command message and determine whether the metadata field comprises a process identifier that is included in the allowed process configuration. If so, the storage array may perform the access command corresponding to the block command message. If not, the storage array may reject performing the access command. The storage array may report access commands that were performed or rejected.

Protecting data from unprivileged processes

In an active-active replication environment in which sequential read IOs are distributed across storage array ports and replicas, a first read data size controls selection of a different path to a currently targeted replica to distribute sequential reads across storage system ports and a second read data size controls when a different replica is selected to distribute the sequential reads across storage systems. The storage arrays that maintain the replicas are phase-coordinated to pre-fetch only sequential data that will be accessed in the near future from their local replica. For example, a first storage array prefetches sequential data from a first replica in chunks corresponding to the first data size until sequential data corresponding to the second data size has been prefetched, skips sequential addresses corresponding to the second data size, and prefetches sequential data corresponding to the first data size that is next in sequence relative to the skipped sequential addresses.

Enhancing array prefetch for sequential IOs in active-active remote replication

A storage array is configured to detect single points of failure (SPoFs) that could cause a host application to fail. Zoning information obtained from network switches is used with initiator-target login information to determine whether all host server HBA port initiators logged in to a storage object maintained by the storage array are from the same zone. If so, a path-based SPOF alert is generated. If all host server HBA port initiators logged in to the storage object are from the same HBA, then a NIC-based SPOF alert is generated. A masking view is used with the zoning information and initiator-target login information to determine whether all host server HBA port initiators logged in to the storage object are from the same host server. If so, a clustering-based, nodal SPOF alert is generated.

SAN single path point of failure detection

A migration management application may facilitate generating an image of a source cloud block drive formatted according to a first format. The management application may facilitate copying of the image to a target cloud block drive formatted according to a second format. Changes directed to the source drive during copying of the image may be stored to a first journal, which may be copied to the target drive. During copying of the first journal, changes directed to the source drive may be stored to one or more subsequent journals. Upon determining that a subsequent journal is smaller than a configured cutover criterion, the management application may pause, during a cutover period, directing of changes to the source drive. The management application may copy changes, directed to the source drive during the cutover period, to the target drive and may redirect user/data applications to operate with respect to the target drive.

Migrating data between heterogeneous cloud block devices

One or more aspects of the present disclosure relate to read-skew-based data theft mitigation. In embodiments, an input/output (IO) workload is received at a storage array. Further, access to a logical device can be controlled based on at least one read capacity skew forecast corresponding to the logical device.

Read skew based data theft mitigation

A disaster recovery site storage array causes an instance of a host application or selected executables running on a host server to validate changes to an asynchronously updated replica of a storage object. Snapshots of the replica are generated before and after each set of changes to the replica are received from a remote storage array. Validation is performed by mounting snapshots to the instance of the associated host application and causing the host application instance to validate the data. If a snapshot is determined to be invalid, then the replica to recovered with the most recent known-valid snapshot. Alternatively, if each set of changes is validated prior to being applied to the replica, invalid changes are not applied to the replica. Unvalidated snapshots may be accumulated and validated independently from application of sets of changes to the replica, thereby decoupling validation from replication.

Zero-trust remote replication

Methods and systems for securing data are disclosed. To secure data, signed tokens may be used to authenticate operations to be performed by storage arrays. The operations may modify data stored in the storage array and/or provide copies of stored data. The signed token may specify limits on the authority of various entities to invoke various functions of storage arrays, and include cryptographic data usable by the storage arrays to authenticate the tokens. By requiring that tokens be included with operations to be performed by storage arrays, the storage arrays may be less likely to perform undesired operations.

Storage array protection using signed token

Growing community of inventors

Newton, MA, United States of America

Arieh Don