Emc Corporation

Emc IP Holding Company LLC

Cesareo Contreras

Helen S Raizen

Michael E Bappe

Edith Epstein

Atul Kabra

Xunce Zhou

Harold Martin Sandstrom

Assaf Natanzon

Ian Wigmore

Arieh Don

Matthew D Waxman

Prakash Venkatanarayanan

Cynthia Burns

Edward L Thigpen

Alexander Elpaev

Arich Don

A computer of a data processing system includes a software encryption engine and path circuitry that initially provides one or more paths for conveying data of storage I/O requests to and from a storage device, the paths including an encrypting path having a hardware encrypting component. According to a failover technique, in a first operating state, (a) the data of the storage I/O requests is conveyed via the encrypting path with encryption and decryption of the data being performed by the hardware encrypting component, and (b) monitoring is performed for occurrence of an event indicating that the hardware encrypting component has become unavailable for encrypting and decrypting the data of the storage I/O requests. Upon occurrence of the event, if the path circuitry provides a non-encrypting path for conveying the data of the storage I/O requests to and from the storage device, then operation is switched to a second operating state in which the data of the storage I/O requests is conveyed via the non-encrypting path and is encrypted and decrypted by the software encryption engine. A failback technique provides for reverting to hardware-assisted encryption under proper circumstances.

Data processing system having failover between hardware and software encryption of storage data

An improved technique migrating data from a source LUN (logical unit) to a target LUN manages control I/O's in a manner that depends on the current state of data migration and on whether the control I/O's specify that reservation information for a LUN is to be set or queried. Control I/O's specifying reservation settings during the different states of migration are treated the same way as data WRITEs during those respective states, and control I/O's specifying reservation queries during different migration states are treated the same way as data READs during those respective states.

Managing settings and queries in host-based data migration

A method performed in a device is provided. The method includes (a) receiving key identification information from a key controller module on an external host, (b) obtaining a key identified by the key identification information from an external key server, (c) decrypting encrypted data from an encrypted storage system using the key, and (d) processing the decrypted data. A corresponding computer program product is also provided.

Sharing encryption-related metadata between a host and an external intermediate device

A system shares encryption-related metadata between layers of a storage I/O stack. Additionally, a detection mechanism ensures that certain layers within the storage I/O stack are present and cooperate with a particular protocol. Along these lines, functional components engage in an in-band communications protocol, such as a data encryption key (DEK) management protocol. The in-band communications protocol employs protocol commands and responses carried along the data path as contents of in-band transport messages and responses, such as special SCSI read commands and their responses. The protocol commands and responses include a handshake command and a handshake response used during an initial handshake operation. Each protocol command and response has a protocol signature field carrying one of distinct first and second signature values which are used to identify the presence of the protocol command or response in the transport messages and responses at different locations along the data path.

In-band detection mechanism for detecting intermediate layer in a storage I/O driver stack

A method of performing data migration from a source storage device to a target storage device in a failover cluster includes use of a roll-forward flag to signal successful completion of a migration operation from a migration node to failover nodes of the cluster, reliably controlling host access to the target storage device to ensure that it is used only when it has been successfully synchronized to the source storage device and a commit operation has occurred that ensures that subsequent read and write operations are directed exclusively to the target storage device.

Non-disruptive storage device migration in failover cluster environment

A host in an encrypted data storage system sends encryption metadata associated with an encrypted logical volume (LV) from a key controller module to an encryption endpoint via a storage I/O stack. The encryption metadata identifies an encryption key and encrypted regions of the LV, and the sending results in establishment of one or more shared associations between the key controller module and the encryption endpoint which associates the encrypted LV with the encryption metadata for the encrypted LV. A data storage operation is performed on the encrypted LV by sending a data storage command from the key controller module to an encrypted region of the encryption endpoint via the storage I/O stack. The encryption endpoint uses the encryption metadata associated with the encrypted LV to cryptographically process data of the data storage operation.

Sharing encryption-related metadata between multiple layers in a storage I/O stack

Described are techniques for indicating a state associated with a device. A request is received over a path for information about a device. A response to the request is sent. The response indicates a state regarding the device on the path. The response has a response status of good and a payload of a varying size. The payload is truncated at a location prior to that at which a device identifier for the device is expected. In accordance with the response, a state regarding the device on the path is determined.

Techniques for indicating a passive state for a device

Techniques for indicating a passive path state for a device

An in-band protocol transport carries command-response protocol communications between first and second functional components of a storage input/output (I/O) interface stack, for example to control encryption-related processing of storage I/O commands. A storage read command used as a protocol transport message has protocol data in a read data buffer, and predetermined read address information, such as a prime-numbered starting block address and a small, odd-valued length value, unlikely to occur in normal (non-transport) storage read commands. The second functional component determines that the storage read command contains the predetermined read address information, indicating that the storage read command is a protocol transport message rather than a normal read. For greater confidence, it also determines that the protocol data in the read data buffer includes protocol identification data such as a protocol signature. The protocol data is used to control a processing action for subsequent normal storage I/O commands, such as encryption-related processing, and a protocol response is returned by creating and storing response data in the read data buffer and signaling completion of the storage read command to the first functional component.

In-band transport mechanism for carrying communications among functional components of a storage I/O interface stack

Methods and systems are disclosed that relate to making back-up data available to a host server. An exemplary method includes making primary and secondary data volumes accessible to a first server and presenting the primary data volume and the secondary data volume to the first server as a single virtual data volume. The secondary data volume is a copy of the primary data volume. The method further includes directing a server I/O request to the primary data volume if the primary data volume is accessible or to the secondary data volume if the primary data volume is not accessible and the secondary data volume is not reserved by a second server.

Methods and system for improving data and application availability in clusters

Systems and methods are provided for executing a vendor specific command in a storage area network including a plurality of data storage volumes and at least one host. In one embodiment, a system includes an intelligent multi-protocol switch (IMPS) and a storage and switch controller that is coupled to the IMPS. The IMPS receives a command from the at least one host. The command includes a command byte field storing a vendor specific service action. The storage and switch controller receives the command from the IMPS. A processor included in the storage and switch controller interprets the vendor specific service action and executes the command.

Growing community of inventors

Northbridge, MA, United States of America

Cesareo Contreras