Dell Products Inc.

Emc IP Holding Company LLC

Efi Levi

Arieh Don

Lior Benisty

Boris Giterman

Ching-Yun Chao

Maxim Balin

An identifier, such as a worldwide name, corresponding to a host computing device, or corresponding to a host bus adapter corresponding to the host computing device, may be transmitted to a storage array to configure the storage array to be accessed by the host computing device. The host may request a token from the array. The host may embed the token into a token block of a command message that is transmitted to the storage array requesting access to the array. Before performing an action corresponding to the command message, the storage array may verify that the token is a valid token and thus that the host computing device that transmitted the command message is a host computing device that has been authorized to access the storage array. If the storage array determines that the token is valid the storage array may perform an action corresponding to the command message.

Multi-factor security in fiber channel protocol

Different management applications corresponding to different private computing systems that are untrusted with respect to each other reciprocally agree to store for each other replicated versions of logical volumes of storage arrays as backups. A management server corresponding to one or more storage arrays at a local one of the computing systems encrypts a volume to be backed up at the other remote computing system and transmits the encrypted version to the remote computing system. The remote computing system cannot modify or delete a portion of an array that has stored thereon the encrypted version of the logical volume without having a configuration-change key generated by the local management server, which may generate the configuration-change key to facilitate mirroring at the remote storage array a modification made to the local storage array.

Untrusted remote replication partnering

Methods and systems for managing storage services provided by storage arrays are disclosed. The storage services may be managed by proactively identifying and remediating malicious activity that may impact the storage services. The malicious activity may be identified by monitoring activity of adapters used by host devices to communicate with the storage arrays. The activity may be monitored to identify patterns of reset commands that are likely to negatively impact storage services provided by the storage arrays.

Protecting storage arrays from load attacks

Methods and systems for managing operation of endpoint devices are disclosed. To manage the operation of endpoint devices, clusters of endpoint devices may be established. The members of the cluster may utilize synchronized data across the cluster to provide various computer implemented services. To synchronize the synchronized data, updates made to local copies of the synchronized data may be distributed to maintain synchronization of other copies of the synchronized data. By doing so, different members of the cluster may have access to synchronized data.

Distribution of data in clusters of devices

A storage array is configured with an allowed process configuration. An allowed process may correspond to an application or process executed by a host computing system that may seek to access a volume of the storage array via a command descriptor block message or a corresponding block command message, which may comprise a data field and a metadata field. The host may embed a process identifier corresponding to a process seeking to access the storage array in the metadata field. The storage array may receive the block command message and determine whether the metadata field comprises a process identifier that is included in the allowed process configuration. If so, the storage array may perform the access command corresponding to the block command message. If not, the storage array may reject performing the access command. The storage array may report access commands that were performed or rejected.

Protecting data from unprivileged processes

Methods and systems for securing data are disclosed. To secure data, signed tokens may be used to authenticate operations to be performed by storage arrays. The operations may modify data stored in the storage array and/or provide copies of stored data. The signed token may specify limits on the authority of various entities to invoke various functions of storage arrays, and include cryptographic data usable by the storage arrays to authenticate the tokens. By requiring that tokens be included with operations to be performed by storage arrays, the storage arrays may be less likely to perform undesired operations.

Storage array protection using signed token

Methods and systems for managing data storage are disclosed. The storage of data may be managed by implementing a framework for checking whether payloads requested for storage have been modified prior to storage. The checks may be performed using integrity verification data that is based on corresponding payloads. The payloads and integrity verification data may be generated by an application, and both may be directed to storage. Once received, the storage may perform the checks using the integrity verification data.

System and method for managing data storage to identify undesired data modification

An apparatus comprises at least one processing device that is configured to control delivery of input-output operations from a host device to a storage system over selected ones of a plurality of paths through a network. The at least one processing device is further configured to generate a plurality of authentication tokens over time utilizing seed information of the host device, and for each of one or more of the input-output operations, to incorporate a particular one of the authentication tokens into the input-output operation, to send the input-output operation to the storage system, and to receive an indication from the storage system, responsive to the input-output operation sent to the storage system, as to whether or not the authentication token incorporated into the input-output operation matches a corresponding authentication token generated by the storage system. The at least one processing device illustratively comprises at least a portion of the host device.

Growing community of inventors

Beer Sheva, Israel

Efi Levi