International Business Machines Corporation

George Kuch

Richard Mark Sczepczenski

Raymond Michael Higgs

Ralph Friedrich

Elizabeth A Moore

John R Flanagan

Johnathon R Pandich

Roger Gregory Hathorn

Christopher J Colonna

Patricia G Driever

Glen Alan Jaquette

Bruce H Ratcliff

Daniel Francis Casper

Jeffrey M Turner

Clinton E Bubb

Peter Grimm Sutton

Gerhard Banzhaf

Stefan Amann

Luke M Hopkins

Mahmoud Amin

Ying-Yeung Li

Dan Vangor

Daniel Hughes

Myron Wisniewski

Pascal R Bastien

Margaret Frances Kaelin Dubowsky

Anmar A Al Zubaydi

Gustav E Sittmann, Iii

Jerry Wayne Stevens

Louis William Ricci

Jacob Lee Sheppard

A path is secured from one node to another node of the computing environment. The one node obtains a first encryption key and a second encryption key. A shared key is obtained by the one node from a key server, and the shared key is used to encrypt a message. The encrypted message includes the first encryption key and the second encryption key. The encrypted message and an identifier of the shared key is sent from the one node to the other node, and a response message is received by the one node. The response message at least provides an indication that the other node received the encrypted message and obtained the shared key.

Securing a path at a selected node

A path for a node of a computing environment is secured. The securing includes obtaining, by the node, a message that includes an identifier of a shared key and an encrypted message. The node obtains the shared key from a key server and uses it to decrypt the encrypted message to obtain an encryption key and one or more parameters. A security parameters index to be associated with the encryption key and the one or more parameters is obtained. The node sends a response message to another node, the response message including the security parameters index.

Securing a path at a node

Aspects of the invention include receiving an error code describing a computer hardware or firmware error. A list of data items to be collected to assist in correcting the error is received. The contents of the list are selected based at least in part on the error code and are in priority order. The data items in the list are collected and a buffer to store the collected data items is selected. At least a subset of the collected data items to be written is transmitted to the buffer. All of the collected data items are transmitted to the buffer when the buffer is large enough to hold all of the data items in the list. A subset of the collected data items are transmitted to the buffer in priority order when the buffer is not large enough to hold all of the data in the list.

Dynamic logging and prioritization of error incident data

A path for a node of a computing environment is secured. The securing includes obtaining, by the node, a message that includes an identifier of a shared key and an encrypted message, the encrypted message including a first encryption key, a second encryption key, one or more first parameters and one or more second parameters. The node obtains the shared key from a key server and uses it to decrypt the encrypted message to obtain the first encryption key, the second encryption key, the one or more first parameters and the one or more second parameters. A second security parameters index, to be associated with the second encryption key and the one or more second parameters, is obtained. The node sends a response message to another node, the response message including the second security parameters index.

A path is secured from one node to another node of the computing environment. The one node obtains a first encryption key and one or more first parameters for transmission of data, and a second encryption key and one or more second parameters for reception of data. A shared key is obtained by the one node from a key server, and the shared key is used to encrypt a message. The encrypted message includes the first encryption key, the one or more first parameters, the second encryption key and the one or more second parameters. The encrypted message and an identifier of the shared key is sent from the one node to the other node, and a response message is received by the one node. The response message at least provides an indication that the other node received the encrypted message and obtained the shared key.

Authentication is performed on a plurality of links to be used to couple one node of the computing environment and another node of the computing environment. The performing authentication includes obtaining, by the other node from the one node via one link of the plurality of links, an identifier of a shared key maintained by a key server. The other node uses the identifier to obtain the shared key from the key server. An indication that the other node decrypted a message received from the one node using the shared key is sent from the other node via the one link. The sending the indication on one or more other links of the plurality of links is repeated for subsequent messages decrypted by the other node using the shared key previously obtained.

Shared key processing by a storage device to secure links

Authentication is performed on a plurality of links coupling one node of the computing environment and another node of the computing environment. The performing authentication includes obtaining by the one node a shared key from a key server coupled to the one node and another node of the computing environment. A message encrypted with the shared key is sent from the one node to the other node via one link of the plurality of links. An indication that the other node decrypted the message using the shared key obtained by the other node is received from the other node via the one link. The sending and the receiving are repeated on one or more other links of the plurality of links using the shared key previously obtained.

Securing a storage network using key server authentication

Aspects of the invention include receiving an error code describing a computer hardware or firmware error. A list of data items to be collected to assist in correcting the error is built. The contents of the list are selected based at least in part on the error code and are in priority order. The data items in the list are collected and a buffer to store the collected data items is selected. At least a subset of the collected data items to be written is transmitted to the buffer. All of the collected data items are transmitted to the buffer when the buffer is large enough to hold all of the data items in the list. A subset of the collected data items are transmitted to the buffer in priority order when the buffer is not large enough to hold all of the data in the list.

A shared key, used by one node and another node of a computing environment in authentication of one or more links coupling the one node and the other node, is determined to be within an expiration range. Based on determining the shared key is within the expiration range, re-authentication of at least one link is automatically initiated. The automatically initiating re-authentication includes obtaining, by the one node, a new shared key from a key server, sending a message encrypted with the new shared key from the one node to the other node via one link of the one or more links, and receiving by the one node via the one link an indication that the other node decrypted the message using the new shared key.

Automatic re-authentication of links using a key server

Authentication is performed on a plurality of links of a computing environment. One node requests generation of a shared key by a key server coupled to the one node. The one node obtains the shared key and an identifier of the shared key and sends the identifier from the one node to another node. A message encrypted with the shared key is sent from the one node to the other node via one link of the plurality of links. The one node receives via the one link an indication that the other node decrypted the encrypted message using the shared key obtained by the other node. The sending the encrypted message and the receiving the indication that the other node decrypted the encrypted message are repeated on one or more other links of the plurality of links using the shared key previously obtained.

Shared key processing by a host to secure links

Access between a plurality of nodes of the computing environment is controlled by a key server. The key server receives from one node of the plurality of nodes, a request for a shared key, in which the shared key is created for a selected node pair. A determination is made by the key server as to whether the one node is a node of the selected node pair. In one example, the determining checks an alternate name of the one node to determine whether it matches an alternate name associated with the shared key. Based on determining the one node is a node of the selected node pair, the key server provides the shared key to the one node.

Controlling access between nodes by a key server

An aspect of obtaining optical signal health data in a SAN includes receiving, by a computer processor, a request for data corresponding to current operational characteristics of elements of a storage area network to which a host system computer has access. A further aspect includes instantiating, by the computer processor, a virtual host bus adapter interface on the host system computer, transmitting, via the virtual host bus adapter interface, the request to the elements in the portion of the storage area network, aggregating data received from each of the elements, and displaying the aggregated data via the computer processor.

Obtaining optical signal health data in a storage area network

A control component of a computing environment activates a virtual adapter hosted on a physical adapter of a host system of the computing environment. The virtual adapter is for use by a guest of the host system in performing data input and output. The activating activates the virtual adapter absent involvement of the guest. Based on activating the virtual adapter, the control component obtains configuration information of the activated virtual adapter from the physical adapter, the configuration information generated based on the activating. The control component ascertains a configuration of the activated virtual adapter based on the obtained configuration information.

Ascertaining configuration of a virtual adapter in a computing environment

An aspect of validating vHBA fabric zoning in a SAN includes receiving, by a computer processor, a request for data corresponding to zones in a storage area network to which an initiator in a host system computer has access; instantiating, by the computer processor, a virtual host bus adapter interface on the host system computer; and transmitting, via the virtual host bus adapter interface, the request to a fabric controller in the storage area network. An aspect also includes receiving a current active zone set from the fabric controller; parsing the current active zone set for the initiator; identifying, from the parsing, each of the zones in the current active zone set to which the initiator is indicated; and displaying the identified zones via the computer processor.

Growing community of inventors

Poughkeepsie, NY, United States of America

George Kuch