Emc Corporation

Mcafee, Inc.

Emc IP Holding Company LLC

Atul Kabra

Helen S Raizen

Michael E Bappe

Edith Epstein

Cesareo Contreras

John Douglas Teddy

Michael S Hughes

Assaf Natanzon

Harold Martin Sandstrom

Xunce Zhou

Alexander Elpaev

Michael Hughes

A request is received from a security tool, the request relating to an event involving data records in a storage device. An application programming interface (API) is used to interface with secure storage functionality of the storage device, the secure storage functionality enabling a set of secure storage operations. A security operation is caused to be performed at the storage device involving the data records based at least in part on the request. In one aspect, the set of secure storage operations can include a direct read operation, a direct write operation, a copy-on-write operation, and a save-attempted-write operation.

Secure disk access control

A computer of a data processing system includes a software encryption engine and path circuitry that initially provides one or more paths for conveying data of storage I/O requests to and from a storage device, the paths including an encrypting path having a hardware encrypting component. According to a failover technique, in a first operating state, (a) the data of the storage I/O requests is conveyed via the encrypting path with encryption and decryption of the data being performed by the hardware encrypting component, and (b) monitoring is performed for occurrence of an event indicating that the hardware encrypting component has become unavailable for encrypting and decrypting the data of the storage I/O requests. Upon occurrence of the event, if the path circuitry provides a non-encrypting path for conveying the data of the storage I/O requests to and from the storage device, then operation is switched to a second operating state in which the data of the storage I/O requests is conveyed via the non-encrypting path and is encrypted and decrypted by the software encryption engine. A failback technique provides for reverting to hardware-assisted encryption under proper circumstances.

Data processing system having failover between hardware and software encryption of storage data

A method performed in a device is provided. The method includes (a) receiving key identification information from a key controller module on an external host, (b) obtaining a key identified by the key identification information from an external key server, (c) decrypting encrypted data from an encrypted storage system using the key, and (d) processing the decrypted data. A corresponding computer program product is also provided.

Sharing encryption-related metadata between a host and an external intermediate device

A system shares encryption-related metadata between layers of a storage I/O stack. Additionally, a detection mechanism ensures that certain layers within the storage I/O stack are present and cooperate with a particular protocol. Along these lines, functional components engage in an in-band communications protocol, such as a data encryption key (DEK) management protocol. The in-band communications protocol employs protocol commands and responses carried along the data path as contents of in-band transport messages and responses, such as special SCSI read commands and their responses. The protocol commands and responses include a handshake command and a handshake response used during an initial handshake operation. Each protocol command and response has a protocol signature field carrying one of distinct first and second signature values which are used to identify the presence of the protocol command or response in the transport messages and responses at different locations along the data path.

In-band detection mechanism for detecting intermediate layer in a storage I/O driver stack

An encryption endpoint (EE) receives, via a storage I/O stack (having a key controller module (KCM)), encryption metadata identifying an encryption key and a set of region entries. Each region entry includes an identification of a region within a storage device subject to encryption with the encryption key and an identification of a correlation between the region and a corresponding region on a logical volume (LV) managed by the KCM. The EE receives, via the stack, a storage command to process a block having a first address on the storage device. It corresponds to a second address located within the corresponding region of the LV. The EE determines the second address within the LV and then cryptographically processes the block using an address-dependent cryptographic algorithm and (a) data of the block, (b) the determined second address, and (c) the encryption key.

Preserving LBA information between layers of a storage I/O stack for LBA-dependent encryption

A host in an encrypted data storage system sends encryption metadata associated with an encrypted logical volume (LV) from a key controller module to an encryption endpoint via a storage I/O stack. The encryption metadata identifies an encryption key and encrypted regions of the LV, and the sending results in establishment of one or more shared associations between the key controller module and the encryption endpoint which associates the encrypted LV with the encryption metadata for the encrypted LV. A data storage operation is performed on the encrypted LV by sending a data storage command from the key controller module to an encrypted region of the encryption endpoint via the storage I/O stack. The encryption endpoint uses the encryption metadata associated with the encrypted LV to cryptographically process data of the data storage operation.

Sharing encryption-related metadata between multiple layers in a storage I/O stack

An in-band protocol transport carries command-response protocol communications between first and second functional components of a storage input/output (I/O) interface stack, for example to control encryption-related processing of storage I/O commands. A storage read command used as a protocol transport message has protocol data in a read data buffer, and predetermined read address information, such as a prime-numbered starting block address and a small, odd-valued length value, unlikely to occur in normal (non-transport) storage read commands. The second functional component determines that the storage read command contains the predetermined read address information, indicating that the storage read command is a protocol transport message rather than a normal read. For greater confidence, it also determines that the protocol data in the read data buffer includes protocol identification data such as a protocol signature. The protocol data is used to control a processing action for subsequent normal storage I/O commands, such as encryption-related processing, and a protocol response is returned by creating and storing response data in the read data buffer and signaling completion of the storage read command to the first functional component.

Growing community of inventors

New Delhi, India

Atul Kabra