Emc IP Holding Company LLC

Emc Corporation

Greg Lazar

Radia Joy Perlman

Xuan Tang

Thomas N Dibb

Scott E Joyce

Andreas L Bauer

Bruce Rabe

Russell R Laporte

Sriram Krishnan

Neil F Schutzman

Naizhong Chiu

Kevin S Labonte

Anirudh Takkallapally

Sreenath Rajagopal

Feng Zhou

Xiaoyan Wei

Danny V Dhillon

Methods, apparatus, and processor-readable storage media for filtering security controls are provided herein. An example computer-implemented method includes obtaining information pertaining to a software project and a target market of the software project; and identifying, based on the obtained information, at least one security control to be implemented in the software project, from among a plurality of security controls, in order to satisfy at least a threshold level of security defined for the software project, wherein the threshold level of security is based at least in part on one or more security standards related to the target market.

Filtering security controls

An apparatus comprises a storage system, a key manager incorporated in or otherwise associated with the storage system, and an input-output controller coupled to the key manager and configured to control storage of data items in the storage system. The key manager is configured to determine a controller key accessible to the input-output controller and a plurality of data encryption keys utilizable by the input-output controller to encrypt the data items for storage in the storage system. A given one of the data items is encrypted using a particular one of the data encryption keys and has associated metadata that includes the particular data encryption key encrypted using the controller key. The metadata may comprise an inner wrapping of the particular data encryption key using the controller key and at least one outer wrapping of the inner wrapping using at least one additional key.

Storage system with controller key wrapping of data encryption key in metadata of stored data item

An apparatus comprises a storage system and a key manager incorporated in or otherwise associated with the storage system. The storage system comprises first storage of a first type and second storage of a second type with the first storage providing enhanced data protection relative to the second storage. The key manager is configured to maintain a master key hierarchy for the storage system. The master key hierarchy comprises a plurality of levels each including one or more master keys, with an uppermost level of the master key hierarchy comprising a root master key that is stored in the first storage and at least one lower level of the master key hierarchy comprising a plurality of master keys that are stored in the second storage under encryption by the root master key. Keys of a lowermost level of the master key hierarchy are associated with respective groups of data items.

Storage system with master key hierarchy configured for efficient shredding of stored encrypted data items

An apparatus comprises a storage system and a key manager incorporated in or otherwise associated with the storage system. The storage system is configured to store data items across a plurality of dimensions with each such dimension comprising a plurality of classes. The key manager is configured to assign class keys to respective ones of the classes of each of the dimensions. A given one of the data items associated with at least one of the classes in each of two or more of the dimensions is encrypted for storage in the storage system using a multidimensional key determined as a function of the class keys corresponding to respective ones of the classes with which that data item is associated. Such an arrangement allows all of the data items associated with a given one of the classes to be deleted by deleting the class key assigned to the given class.

Storage system configured for encryption of data items using multidimensional keys having corresponding class keys

Embodiments of the invention relate to a method for discovering a network address translation (NAT) network connection with a data storage system. The method includes establishing, by a client device, a network connection with the data storage system via a target network address associated with the data storage system, retrieving over the network connection, by the client device, a set of private network addresses associated with a set of storage processors of the data storage system, comparing, by the client device, each private network address of the set of private network addresses associated with the set of storage processors with the target network address, and when the target network address is absent from the set of private network addresses associated with the set of storage processors as a result of the comparison, detecting, the network connection as being configured as a NAT mode network connection with the data storage system.

Network address translation auto-discovery in data storage networks

Methods for initializing a storage system over a network are described. A server initialization utility operates on each of several storage processing units. A client initialization utility operates on a client computing device. The client initialization utility and server initialization utility communicate via a network coupled to the client computing device and the storage processing units. The client initialization utility is used to initialize parameters for each storage processing unit via communication with the corresponding server initialization utility. The client initialization utility is further used to discover array and storage processing identification information. The client and server initialization utilities communicate via exchange of UDP broadcast datagrams.

Storage system initialization utility

A technique, which involves participation by electronic circuitry of a data storage array, obtains configuration change information from host devices which are constructed and arranged to store data into and load data from the data storage array. In particular, the technique involves receiving a set of change notices from a set of host devices. Each change notice is received by the electronic circuitry of the data storage array when a respective host device of the set of host devices undergoes a configuration change. The technique further involves providing a set of requests from the electronic circuitry of the data storage array to the set of host devices based on the set of change notices. The technique further involves acquiring configuration change information from the set of host devices in response to the set of requests.

Growing community of inventors

Upton, MA, United States of America

Greg Lazar