Emc Corporation

Emc IP Holding Company LLC

Gregory William Lazar

Andreas L Bauer

Sriram Krishnan

Brian R Gruttadauria

Scott E Joyce

Russell R Laporte

Xuan Tang

Walter T Dobberpuhl

Millard C Taylor, Iii

Charles W Kaufman

Thomas N Dibb

Naizhong Chiu

Yi Fang

Himabindu Tummala

Peter Puhov

Munish T Desai

Girish Sheelvant

Tianming Zhang

Natasha Gaurav

Deene A Dafoe

Mahadevan Vasudevan

Ping Zhang

Jingyan Zhao

Feng Zhou

Yidong Wang

Richard J Nordin

Stephen J Todd

William Duane

John S Harwood

Dmitry Nikolayevich Tylik

Thomas Earl Linnell

Mark A Parenti

Peter Cheng Chen

Nagasimha G Haravu

Ying Xie

Robert P Wierzbicki

Michael Lee Burriss

Donald Labaj

Neil F Schutzman

Kevin S Labonte

Christopher S Lacasse

Robert Andrew Ballantyne

Jackson Brandon Myers

Michael Zeldich

Robert W Griffin

Jochen F De Smet

Paula Emily McAdam

Walter O'Brien

Benjamin Kelley

Anthony Arous

Paul Malenfant

Meiling Ge

Seth B Horan

Weixing Wang

Weijing Song

Michael Hamel

Maurice Edward Valois

Naizhong Chiu Qui

Lee M McColgan

Grace L Heard

Xiongfei Chen

Gerald D Jones

Juhi Asthana

Charlie Kaufman

Mingjiang Shi

Purushottam B Sane

James Huang

Keith V Boland

Greg Mogavero

Prakash Chanderia

Ashwin Ramkrishna Tidke

Bryant C Martin

Ram Kailasanathan

Timothy M Meggison

Marco Abela

A method, computer program product, and computing system for receiving a selection of one or more secure snapshots to remove from a storage system. A snapshot deletion key may be received from the storage system. The selection of the one or more secure snapshots and the snapshot deletion key may be provided to a storage system support service. A snapshot deletion response may be received from the storage system support service. The snapshot deletion response and the selection of the one or more secure snapshots may be authenticated via the storage system. In response to authenticating the snapshot deletion response and the selection of the one or more secure snapshots, the one or more secure snapshots may be unlocked for deletion.

System and method for authorizing secure snapshot deletion

Techniques are directed to detecting an abnormal event while data storage equipment is in transit. Such techniques involve receiving a series of sensor signals from a set of sensors affixed to the data storage equipment. The series of sensor signals identifies a series of positional integrity measurements for the data storage equipment while the data storage equipment is in transit. Such techniques further involve performing a series of comparison operations that compares the series of positional integrity measurements to a set of range. Such techniques further involve, based on the series of comparison operations, providing an abnormal event signal in response to a particular positional integrity measurement falling outside a corresponding range of the set of ranges.

Detecting an abnormal event while data storage equipment is in transit

A technique for managing communications between a server and multiple clients includes configuring the server to support multiple sets of certificates for respective clients having respective root certificates. The technique further includes determining an indicator associated with a client root certificate during an initial handshake between a client and the server and providing the client with a server certificate associated with the indicator.

Managing trusted communications between server and clients

A method, computer program product, and computing system for coupling password-resetting content to an IT computing device. The password-resetting content is validated on the IT computing device. The password-resetting content is processed to reset one or more passwords associated with the IT computing device.

Password resetting system and method

A method, computer program product, and computer system for storing, by a computing device, a data encryption key in a keystore. A plurality of stable system values may be generated, wherein a threshold number of the plurality of stable system values is required to access the data encryption key from the keystore. The plurality of stable system values may be stored in different locations. More stable system values of the plurality of stable system values than the threshold number of the plurality of stable system values required to access the data encryption key from the keystore may be deleted.

System and method for shredding a forum of secrets

Techniques for synchronizing configuration information in a clustered storage environment. The techniques allow a system administrator or other user to make additions and/or updates to configuration information in one or more configuration files, which are automatically propagated for storage in multiple data storage appliances within a storage domain. By allowing a user to make changes to configuration files associated with a primary appliance within the storage domain, and automatically propagating the configuration files in a background process from the primary appliance to multiple secondary appliances within the storage domain, the user can more readily assure consistency of the configuration information, not only among the primary and secondary appliances within the storage domain, but also among previously unavailable or unreachable data storage appliance(s) that may be recovered and brought back on line within the storage domain.

Systems and methods of synchronizing configuration information in a clustered storage environment

Digital certificates for a set of multiple network services are maintained in a certificate store and managed through a single access point that provides access to the certificate store. The certificates are managed, at least in part by i) assigning one or more tags to each digital certificate in the set of digital certificates, one of the tags indicating a service in the set of services that uses the digital certificate to perform secure communications over the communication network, and ii) performing a set of certificate management operations through the single access point to the certificate store. At least one of the certificate management operations performed through the single access point selects a subset of the digital certificates from the set of digital certificates based at least in part on the tags assigned to the digital certificates.

Extensible unified multi-service certificate and certificate revocation list management

A technique is directed to transporting data storage equipment. The technique involves electronically activating monitoring circuitry which is co-located with the data storage equipment. The technique further involves, after the monitoring circuitry is electronically activated, receiving location data from the monitoring circuitry while the data storage equipment is en route from a first ground location to a second ground location. The technique further involves, based on the location data, performing a set of location evaluation operations to determine whether the data storage equipment is on course along a predefined route between the first ground location and the second ground location.

Electronically monitoring data storage equipment while the data storage equipment is in transit

In response to determining that an encryption operation request includes no indication of a cryptographic key, an encryption service module performs an encryption operation using a current cryptographic key retrieved by the encryption service module, and creates and stores an encrypted data object that includes the resulting ciphertext and a key identifier that uniquely identifies the cryptographic key and the associated cryptographic algorithm used to perform the encryption. A subsequent decryption operation request to the encryption service module that indicates the encrypted data object is processed by retrieving the cryptographic key and identifying the associated cryptographic using the key identifier contained in the encrypted data object. The encrypted data object may also include an initialization vector used to generate the ciphertext contained in the encrypted data object, as well as an integrity check value generated across the ciphertext and initialization vector.

Data encrypting system with encryption service module and supporting infrastructure for transparently providing encryption services to encryption service consumer processes across encryption service state changes

The techniques presented herein provide for verifying the integrity of an encryption key log file generated on a data storage system. Encryption key activity events associated with a storage system's back-end storage drives are identified. A unique signature is generated for each encryption key activity event. Each encryption key activity event and its corresponding signature are stored in an audit log file. An audit log hash file is generated using the contents of the audit log file. At an external location, the audit log file and the audit log hash file are retrieved from the storage system. The integrity of the retrieved audit log file is verified by generating a local audit log hash file and comparing the local audit log hash file to the retrieved audit log hash file and determining if the local audit log hash file matches the retrieved audit log hash file.

Method and apparatus for verifying system log integrity

One embodiment is directed to a technique which secures data on a set of storage drives of a data storage system. The technique involves encrypting data from a first tenant using a first tenant key to form first tenant encrypted data and storing the first tenant encrypted data on the set of storage drives. The technique further involves encrypting data from a second tenant using a second tenant key to form second tenant encrypted data and storing the second tenant encrypted data on the set of storage drives, the first tenant being different from the second tenant, and the first tenant key and the second tenant key being per tenant keys which are different from each other. The technique further involves destroying the first tenant key to prevent the first tenant encrypted data stored on the set of storage drives from being decrypted while maintaining the second tenant key to enable decryption of the second tenant encrypted data stored on the set of storage drives.

Securing data using per tenant encryption keys

An installation image of a virtual storage appliance (VSA) is protected by initiating VSA installation from an archive image establishing a pre-installation operating state. The archive image includes an installation image with a lockbox storing a first key for accessing the installation image. The lockbox is encrypted using a second key derived from a stable system value (SSV), such as data for device partitioning, obtainable from an execution environment in the pre-installation operating state. During installation, the SSV is obtained and used in decrypting the lockbox to retrieve the first key and use the installation image to install the VSA. The VSA is installed in a manner establishing a post-installation operating in which the SSV is no longer obtainable from the execution environment, e.g., due to changing the device partition information. An SSV obtained from the partition information post-installation does not yield the key for decrypting the lockbox, protecting the installed image.

Secured virtual storage appliance installation image

The techniques presented herein provide for initializing and upgrading data encryption capability in a data storage system. The data storage system in initialized to encrypt data writes using a system wide encryption key. A request is received to upgrade the encryption functionality in the data storage system. A data slice is identified for encryption, wherein the data slice is stored in a RAID group in the data storage system. The data slice is pinned in a first cache memory of a first storage processor and persisted in a second cache memory of a second storage processor. The data slice encrypted and a write operation is initiated to write the encrypted data slice back to the RAID group. If the write operation was successful, the data slice is unpinned the first and second cache memory associated with the data slice is freed, else if the write operation was unsuccessful, the data slice is unpinned and the first and second cache memory associated with the data slice are flushed.

Managing system-wide encryption keys for data storage systems

The techniques presented herein provide for associating a data encryption lockbox backup with a data storage system. A first set of software system stable values (SSV) is derived from data storage system component values unique to the data storage system. A lockbox storing the first set of SSV and a set of encryption keys associated with a corresponding respective set of data storage system drives is created. Access to the lockbox requires providing a first minimum number of SSV that match corresponding SSV in the first set of SSV. A backup copy of the lockbox is created, wherein access to the backup copy requires providing a second minimum number of SSV that match corresponding SSV in the first set of SSV, wherein the minimum number of SSV is equal to a second match value. The backup copy of the lockbox is stored at a remote location.

Associating a data encryption keystore backup with a computer system

A technique supplies a high security password. The technique involves receiving, by processing circuitry, a series of randomly generated values from random number generator circuitry. The technique further involves deriving, by the processing circuitry, an initial character string from the series of randomly generated values, each character of the initial character string being an element of a first collection of characters which includes lowercase letters and numbers. The technique further involves providing, by the processing circuitry and as the high security password, a modified character string based on (i) the initial character string and (ii) inclusion of at least one element of a second collection of characters which is mutually exclusive of the first collection of characters.

Providing a high security password from an initial character string of lowercase letter and numbers, and inclusion of one or more other characters

Growing community of inventors

Upton, MA, United States of America

Gregory William Lazar