International Business Machines Corporation

Other

U.S. Philips Corporation

Hewlett-packard Company

Certance LLC

Intrenational Business Machines Corporation

Glen Alan Jaquette

Paul Merrill Greco

Robert Allen Hutchins

Paul Merril Greco

Evangelos Stavros Eleftheriou

Leonard George Jesionowski

Brian Gerard Goodman

Kazuhiro Tsuruta

Nhan Xuan Bui

Sedat Oelcer

Roger Gregory Hathorn

Gregory Tad Kishi

John R Flanagan

James Mitchell Karp

Christopher J Colonna

Patricia G Driever

Richard Mark Sczepczenski

George Kuch

Roy Daron Cideciyan

Paul Joseph Seger

Mark Allan Taylor

David E Call

Judson A McDowell

Junichi Fukuda

Thomas Mittelholzer

Robert Allan Hutchins

Eiji Ogura

James Howard Eaton

Kirby Grant Dahman

Constantin Michael Melas

Diana Joyce Hellman

Arturo Avila Mojica

Mario Blaum

Danny Harnik

Shai Halevi

Shinobu Fujihara

Alan Robert Clark

Jens Jelitto

William James Scales

Brian Gerald Goodman

John Edward Kulakowski

Hirokazu Nakayama

John Alexander Koski

David Berman

Jacob Lee Sheppard

Scott Jeffrey Schaffer

Brian Harry Marcus

Lawrence D Tipton

Pantas Sutardja

Thomas R Albrecht

Giovanni Cherubini

Hiroshi Itagaki

Mark Delorman Schultz

Peter Grimm Sutton

Richard Anthony Ripberger

Rodney Jerome Means

Timothy James Hahn

James Arthur Fisher

David Ray Kahler

Toshiyuki Shiratori

Blair I Finkelstein

Hironobu Nagura

Steven Michael Wallace

Ara Sarkis Patapoutian

Daniel James Winarski

Steven Robert Hetzler

Charles John Camp

Keisuke Tanaka

Ernest Stewart Gale

Robert Beverley Basham

Reed Alan Hancock

Karl Arnold Belser

Terue Watanabe

Ernesto Esteban Marinero

Steven A Bade

Larry LeeRoy Tretter

Erika Dawson

John C Dayka

Jonathan James Ashley

Jerry E Hurst, Jr

William John Kabelac

Kevin Dale Butt

Alan A Fennema

Johannus Leopoldus Bakx

Robert Carl Barrett

Francis A Kampf

Hisato Matsuo

Wayne Erwin Rhoten

Anthony Juliana

Stephen J Hrinya

Morovat B Tayefeh

Richard Henry Guski

Oscar Conrad Strohacker

Paul Frederick Bartlett

Julian Lewkowicz

Michael L Taylor

Gregory Alyn Unruh

Roger Javier Justo

Aaron S Palazzolo

Wolfgang Mueller-Friedt

A device-implemented method, in accordance with one aspect of the present invention, includes receiving a command having an address field of predefined length. A first subset of bits in the address field identify an external key of a particular tenant, and a second subset of the bits in the address field corresponds to one of a plurality of type keys associated with different data types. The external key identified by the first subset of bits is retrieved. The type key corresponding to the second subset of bits is also retrieved. The tenant and type keys are combined to create a combined key for use in encrypting and/or decrypting data associated with the command.

Use of 'type' encryption keys with key per IO-enabled devices

Device-implemented methodology for enabling and/or performing crypto-erase via internal action and/or external action in a Key per IO-enabled system. In various approaches, crypto-erasure of the data stored in a Key per IO scheme is enabled by implementing an internal key, which is combined with an external key to generate a media encryption key, which is in turn used to encrypt/decrypt data. By restricting access to the internal key, destruction of the internal key and all media encryption key(s) created using the internal key, renders the data crypto-erased, and thus unrecoverable.

Crypto-erasure of data stored in a key per IO-enabled device via internal action

A computer-implemented method, according to one embodiment, includes: compressing an uncompressed instance of data to create a compressed instance of data. In response to determining that a size of the compressed instance of data is outside a predetermined range, the uncompressed instance of the data is encrypted utilizing wide-block encryption to create a ciphertext string. Moreover, a predetermined subset of the encrypted uncompressed instance of data in the ciphertext string is used to perform deduplication at a data storage server.

Using ciphertext to deduplicate data using wide-block encryption

Device-implemented methodology for enabling and/or performing crypto-erase via internal action and external action. In one illustrative aspect, a request to read data is received at a device configured to perform data operations on a storage medium, the data being stored on the storage medium in encrypted form. In one approach, a first key stored within the device is accessed. In another approach, a first key stored on and/or with the storage medium is retrieved. A second key is received from an external source. A media encryption key is generated using the first and second keys. The encrypted form of the data is read from the storage medium. The encrypted form of the data is decrypted using the media encryption key. The decrypted data is output. Methodology for writing encrypted data is also presented.

Crypto-erasure via internal and/or external action

A computer-implemented method according to one aspect includes creating an initialization vector, utilizing an instance of plaintext and a secret key; encrypting the instance of plaintext, utilizing the initialization vector, the secret key, and the instance of plaintext; combining the initialization vector and the encrypted instance of plaintext to create a ciphertext string; and outputting the ciphertext string.

Implementing resilient deterministic encryption

A computer-implemented method according to one embodiment includes compressing an uncompressed instance of data to create a compressed instance of data; encrypting the compressed instance of data in response to determining that a size of the compressed instance of data is less than a predetermined threshold; creating a message authentication code (MAC) for the encrypted compressed instance of data; and adding a variable-length zero pad and the MAC to the encrypted compressed instance of data to create a formatted string.

Implementing opportunistic authentication of encrypted data

Encrypting data blocks by receiving blocks of compressed data, determining a size, in bytes, of the compressed data, appending a trailer to the compressed data, the trailer associated with the size in bytes of the compressed data, encrypting the compressed data and trailer, yielding encrypted data, where a header of the encrypted data comprises a number of complete encrypted data blocks, and providing the encrypted data to a user.

Secure encryption of partial blocks

A method for more efficiently utilizing storage space in a redundant array of independent disks (RAID) is disclosed. In one embodiment, such a method implements a RAID from multiple storage drives. The RAID utilizes data striping with distributed parity values to provide desired data protection/redundancy. The distributed parity values are placed on selected storage drives of the RAID in accordance with a designated parity rotation. The method further adaptively alters the parity rotation of the RAID to provide an increased concentration of parity values in certain storage drives of the RAID compared to other storage drives of the RAID. This parity rotation may be adapted based on residual storage capacity in each storage drive, consumed space in each storage drive, or the like. A corresponding system and computer program product are also disclosed.

Adaptive parity rotation for redundant arrays of independent disks

A computer-implemented method according to one aspect includes creating an initialization vector, utilizing an instance of plaintext and a secret key; encrypting the instance of plaintext, utilizing the initialization vector, the secret key, and the instance of plaintext; combining the initialization vector and the encrypted instance of plaintext to create a ciphertext string; and sending the ciphertext string to a storage device performing deduplication.

Provided are a computer program product, system, and method for merging multiple point-in-time copies into a merged point-in-time copy. A repository maintains a full copy of the source data and point-in-time copies at point-in-times of the source data. Each of the point-in-time copies have change information indicating changed data in the source data that changed between the point-in-time of the point-in-time copy and a subsequent point-in-time and changed point-in-time data comprising data in the source data as of the point-in-time of the point-in-time copy indicated in the change information as changed. At least two selected of the point-in-time copies in the repository are merged into a merged point-in-time copy by: forming merged change information in the merged point-in-time copy indicating changed data indicated in change information for the selected point-in-time copies; and forming merged changed data in the merged point-in-time copy from the changed data in the selected point-in-time copies.

Merging multiple point-in-time copies into a merged point-in-time copy

A computer-implemented method according to one embodiment includes compressing an uncompressed instance of data to create a compressed instance of data; encrypting the compressed instance of data utilizing wide-block encryption in response to determining that a size of the compressed instance of data is less than a predetermined threshold; and adding a zero pad to the encrypted compressed instance of data to create a ciphertext string.

Creating deterministic ciphertext using wide-block encryption

A path is secured from one node to another node of the computing environment. The one node obtains a first encryption key and a second encryption key. A shared key is obtained by the one node from a key server, and the shared key is used to encrypt a message. The encrypted message includes the first encryption key and the second encryption key. The encrypted message and an identifier of the shared key is sent from the one node to the other node, and a response message is received by the one node. The response message at least provides an indication that the other node received the encrypted message and obtained the shared key.

Securing a path at a selected node

A path for a node of a computing environment is secured. The securing includes obtaining, by the node, a message that includes an identifier of a shared key and an encrypted message. The node obtains the shared key from a key server and uses it to decrypt the encrypted message to obtain an encryption key and one or more parameters. A security parameters index to be associated with the encryption key and the one or more parameters is obtained. The node sends a response message to another node, the response message including the security parameters index.

Securing a path at a node

Provided are a computer program product, system, and method for creating a restore copy from a copy of a full copy of source data in a repository that is at a different point-in-time than a restore point-in-time of a restore request. A repository has a full copy of source data as of a full copy point-in-time and for each of a plurality of point-in-time copies at different point-in-times of the source data, change information indicating changed data in the source data that changed between the point-in-time of the point-in-time copy and a subsequent point-in-time, and changed point-in-time data comprising data in the source data as of the point-in-time of the point-in-time copy indicated in the change information as changed. A point-in-time copy of the full copy is created in response to a restore request and returned as a restore copy to the restore request.

Creating a restore copy from a copy of a full copy of source data in a repository that is at a different point-in-time than a restore point-in-time of a restore request

Provided are a computer program product, system, and method for using a repository having a full copy of source data and point-in-time information from point-in-time copies of the source data to restore the source data at different points-in-time. The source data is copied to a full copy in the repository. Point-in-time copies are initiated at different point-in-times of the source data. In response to completing each of the point-in-time copies, transmitting to the repository change information indicating changed data in the source data that changed between the point-in-time and the subsequent point-in-time and changed point-in-time data comprising data in the source data as of the point-in-time of the point-in-time copy. In response to a restore request having a restore time, applying the changed point-in-time data from at least one of the point-in-time copies to the data of the full copy to restore the full copy to the restore time.

Using a repository having a full copy of source data and point-in-time information from point-in-time copies of the source data to restore the source data at different points-in-time

Growing community of inventors

Tucson, AZ, United States of America

Glen Alan Jaquette