Emc Corporation

Emc IP Holding Company LLC

Edith Epstein

Helen S Raizen

Michael E Bappe

Harold Martin Sandstrom

Cesareo Contreras

Atul Kabra

Tao Tao

Santhosh Venkatesh Kudva

Eric I West

Assaf Natanzon

Yechiel Yochai

Robert J Pellowski

Hitesh Trivedi

Deepak M Gaikwad

John S Harwood

Xunce Zhou

Arod Shatil

Alexander Elpaev

Stephen A Ludlum

Sathiyamoorthy Kothandan

A computer of a data processing system includes a software encryption engine and path circuitry that initially provides one or more paths for conveying data of storage I/O requests to and from a storage device, the paths including an encrypting path having a hardware encrypting component. According to a failover technique, in a first operating state, (a) the data of the storage I/O requests is conveyed via the encrypting path with encryption and decryption of the data being performed by the hardware encrypting component, and (b) monitoring is performed for occurrence of an event indicating that the hardware encrypting component has become unavailable for encrypting and decrypting the data of the storage I/O requests. Upon occurrence of the event, if the path circuitry provides a non-encrypting path for conveying the data of the storage I/O requests to and from the storage device, then operation is switched to a second operating state in which the data of the storage I/O requests is conveyed via the non-encrypting path and is encrypted and decrypted by the software encryption engine. A failback technique provides for reverting to hardware-assisted encryption under proper circumstances.

Data processing system having failover between hardware and software encryption of storage data

An improved technique for storing I/O metrics includes assigning metric values to data buckets held in kernel memory. Each data bucket covers a particular range of values of a respective metric and is configured as a counter, whose count is incremented each time the multipathing driver obtains or computes a metric value that falls within the range of the data bucket. Bucket counts can be read by an external program to obtain aggregate information about I/O metrics over time. The aggregate information can be fed back to the multipathing driver to enable improved selections of paths for conveying data to and from a storage array.

Acquisition and kernel memory storage of I/O metrics

A method performed in a device is provided. The method includes (a) receiving key identification information from a key controller module on an external host, (b) obtaining a key identified by the key identification information from an external key server, (c) decrypting encrypted data from an encrypted storage system using the key, and (d) processing the decrypted data. A corresponding computer program product is also provided.

Sharing encryption-related metadata between a host and an external intermediate device

Described are techniques for upgrading a driver. A driver is installed which includes an upgrade facility, a base driver and a first set of one or more driver extension modules for processing input/output operations for one or more devices. Processing is performed to upgrade the driver using the upgrade facility. The processing includes loading one or more upgrade modules associated with a second version of said driver and performing cutover processing for each of the one or more devices.

Techniques for non-disruptive upgrade

A system shares encryption-related metadata between layers of a storage I/O stack. Additionally, a detection mechanism ensures that certain layers within the storage I/O stack are present and cooperate with a particular protocol. Along these lines, functional components engage in an in-band communications protocol, such as a data encryption key (DEK) management protocol. The in-band communications protocol employs protocol commands and responses carried along the data path as contents of in-band transport messages and responses, such as special SCSI read commands and their responses. The protocol commands and responses include a handshake command and a handshake response used during an initial handshake operation. Each protocol command and response has a protocol signature field carrying one of distinct first and second signature values which are used to identify the presence of the protocol command or response in the transport messages and responses at different locations along the data path.

In-band detection mechanism for detecting intermediate layer in a storage I/O driver stack

A host in an encrypted data storage system sends encryption metadata associated with an encrypted logical volume (LV) from a key controller module to an encryption endpoint via a storage I/O stack. The encryption metadata identifies an encryption key and encrypted regions of the LV, and the sending results in establishment of one or more shared associations between the key controller module and the encryption endpoint which associates the encrypted LV with the encryption metadata for the encrypted LV. A data storage operation is performed on the encrypted LV by sending a data storage command from the key controller module to an encrypted region of the encryption endpoint via the storage I/O stack. The encryption endpoint uses the encryption metadata associated with the encrypted LV to cryptographically process data of the data storage operation.

Sharing encryption-related metadata between multiple layers in a storage I/O stack

Methods and systems are disclosed that relate to selecting a path for sending an I/O request from a host to a data storage subsystem from among a plurality of paths from the host to the subsystem. An exemplary method includes identifying a limitation on the traffic level for the plurality of paths, tracking a first metric corresponding to the limitation on the traffic level for each path, and transmitting a first I/O request having an urgency level other than the highest urgency level by one of the plurality of paths whose first metric does not exceed its limitation on the traffic level.

Methods and systems for dynamic division of path capacity

A method is provided for providing an operating system (OS) independent input/output (I/O) filter driver capable of encrypting at least a portion of a logical unit (LUN), the method comprising the unordered steps of: providing an I/O filter driver component to an I/O stack for a host in communication with the LUN; determining, based at least in part on at least one of OS requirements and an arrangement of data on the LUN, at least one region in the LUN that contains data that is used below the I/O filter driver in an I/O stack on the host; and performing at least one of a read and a write of the one or more regions while keeping the one or more regions in plaintext, while permitting other regions of the LUN to be at least one of encrypted and decrypted.

Systems and methods for selective encryption of operating system metadata for host-based encryption of data at rest on a logical unit

An in-band protocol transport carries command-response protocol communications between first and second functional components of a storage input/output (I/O) interface stack, for example to control encryption-related processing of storage I/O commands. A storage read command used as a protocol transport message has protocol data in a read data buffer, and predetermined read address information, such as a prime-numbered starting block address and a small, odd-valued length value, unlikely to occur in normal (non-transport) storage read commands. The second functional component determines that the storage read command contains the predetermined read address information, indicating that the storage read command is a protocol transport message rather than a normal read. For greater confidence, it also determines that the protocol data in the read data buffer includes protocol identification data such as a protocol signature. The protocol data is used to control a processing action for subsequent normal storage I/O commands, such as encryption-related processing, and a protocol response is returned by creating and storing response data in the read data buffer and signaling completion of the storage read command to the first functional component.

In-band transport mechanism for carrying communications among functional components of a storage I/O interface stack

Methods and apparatus for non-disruptive upgrade by redirecting I/O operations. With this arrangement, a driver upgrade does not require restarting an application. In one embodiment, a method includes installing on a computer a legacy upgrade module in a kernel having a legacy driver with first and second loadable extensions for handling input/output operations for applications to and from devices, retrieving and storing static configuration data from the legacy driver, transferring the stored static configuration data to a new driver, obtaining runtime device configuration data from the devices and transferring the runtime device configuration data to the new driver, and filtering device input/output operations such that prior to cutover input/output operations are directed by the LUM through device stacks for the legacy driver and after cutover input/output operations are directed to the new driver.

Methods and apparatus for non-disruptive upgrade by redirecting I/O operations

Mechanisms and techniques allow a host computer system to control caching operations within a data storage system. In a typical implementation, the system of the invention operates within a host computer system to intercept requests for access to data stored within a data storage system that originate from applications, programs or other processes that perform (e.g., execute) on the host computer system or another computer system. Once intercepted, the host computer can examine such a request for access to data to determine if the request matches any prefetch criteria defined within a prefetch database provided by the system of the invention. As an example, prefetch criteria defined in a prefetch database can specify various requestors (e.g., applications, programs, processes, users, or the like) that can access data (e.g., specific files, databases, volumes, data types or the like) stored within the data storage system according to various data access techniques (e.g., filesystems command such as open, read, write, seek and so forth). If a request for access to data matches prefetch criteria, the host computer configured with the invention determines prefetch information for related data related to data specified in the request based on the matching prefetch criteria. The prefetch information indicates the manner (e.g., amount, permanence, etc.) in which related data is to be cached in the data storage system. The host computer also obtains storage information for the related data that indicates the location of the related data stored within the data storage system. Using the prefetch information and the storage information, the invention generates one or more prefetch commands which indicate what related data is to be cached within the data storage system and from what storage locations within the data storage system that related data is to be obtained. The prefetch command is then transmitted to the data storage system to cause the data storage system to cache the related data.

Growing community of inventors

Arlington, MA, United States of America

Edith Epstein