International Business Machines Corporation

Cecilia Carranza Lewis

Eric David Rossman

John C Dayka

Mark A Nelson

Wayne Erwin Rhoten

Eysha S Powers

David C Reed

Hong Min

Chen Zhao

Jaya Srikrishnan

Venkat K Balagurusamy

Michael J Jordan

Michael Koester

Jeffrey Allen Berger

Gerard Maclean Dearing

David L Levish

W James Kincaid

Samantha Jean Wareing

Sahil Dureja

Gayathiri Chandran

Thomas E Litty

Peter Hung Quach

Nicholas Ikaika Bostwick

A technique of data classification and data protection includes recording, in a lineage repository, dependence relationships between data objects and recording, in a classification repository, data classifications applicable to data objects. The data classifications each indicate a respective class of sensitive data to which data protection is to be applied. Based on receiving a classification job requesting classification of a first data object, a processor determines whether the lineage repository records a dependence relationship with a second data object. Based on determining that the lineage repository records a dependence relationship with the second data object, the processor associates in the classification repository at least a particular data classification applicable to the second data object with the first data object. The processor applies data protection applicable to the particular data classification to the first data object. In some cases, the processor may order application of classification models based on cost metrics.

Data protection utilizing efficient data classification

Provided are a computer program product, system, and method for using a machine learning module to rank technical solutions to user described technical problems to provide to a user. A solutions database is searched to determine a result set of answer files having keywords related to keywords of a technical problem in a user description. The result set of answer files, the user description of the technical problem, user profile information, and technical specifications of the computing system are provided as input to a machine learning module. The machine learning module outputs ranks of the answer files in the result set. A subset of answer files in the result set is selected based on ranks of the answer files in the result set and returned to the user.

Using a machine learning module to rank technical solutions to user described technical problems to provide to a user

A computer-implemented method according to one embodiment includes identifying a creation of a container within a system, selecting a security policy for the container, based on one or more attributes, identifying a key label associated with the security policy for the container, retrieving a data encryption key, utilizing the key label, and encrypting the container, utilizing the data encryption key. This may enable a highly granular level of automatic container-level security within the system that may be transparently implemented within the system, which may streamline container security and reduce an amount of stored data and processing necessary for implementing container security, and may thereby improve the performance of the system.

Implementing policy-based container-level encryption

Generating unique data encryption keys for a data set, by allocating a data set associated with a security policy, where the security policy specifies a key encryption key (KEK) label, retrieving the KEK label from the security policy, storing the KEK label as metadata of the data set, opening the data set for a first time write, generating a data encryption key (DEK), retrieving a KEK from a key store according to the KEK label, encrypting the DEK using the KEK, storing the encrypted DEK as metadata of the data set, and encrypting the data set using the DEK.

System generated data set encryption key

A computer-implemented method according to one embodiment includes identifying a first request from a user to access a container, determining whether the user has a first authorization to access the container, allowing the user to access the container, in response to determining that the user has the first authorization to access the container, identifying a second request from the user to access content within the container, where the content is encrypted, retrieving a key label associated with the container, determining whether the user has a second authorization to access the key label, retrieving a data encryption key, utilizing the key label, in response to determining that the user has the second authorization to access the key label, and allowing the user to access the content that is encrypted by performing one or more decryption actions, utilizing the data encryption key.

Implementing a separation of duties for container security

In one embodiment, a computer program product includes a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code being configured to: assign volume(s) to either a storage group or a reserve storage pool group, designate each of the volume(s) assigned to the storage group as a storage volume, designate each of the volume(s) assigned to the reserve storage pool group as a reserve storage volume, receive policy attributes for the storage group including a storage utilization goal and a default reserve storage pool assignment, monitor a storage utilization level for the storage group, detect when the storage utilization level for the storage group falls outside of the ideal storage utilization range, and adjust an available storage amount for the storage group to bring the storage utilization level within the ideal storage utilization range.

Dynamically managing available data storage within an automated data storage system

The present invention provides a system and method for dynamic management of buffers by the buffer manager for a hierarchical file system. A system according to the present invention includes a buffer pool which is comprised of both fixed and virtual storage. The buffer pool is logically partitioned into three states, fixed, pageable and released, wherein each of the plurality of buffers in the buffer pool exists in one of these states. The system further comprises the buffer manager, which dynamically manages the buffers in the system by moving them between these three states in a non-disruptive manner based on a comparison between the actual usage of fixed and virtual storage compared with target usage values for the fixed and virtual storage.

System and method for performing dynamic buffer management in an HFS (hierarchical file system DF/SMS)

Growing community of inventors

San Jose, CA, United States of America

Cecilia Carranza Lewis