International Business Machines Corporation

Jacob Lee Sheppard

Kurt Allen Lovrien

Karl Allen Nielsen

Richard Anthony Ripberger

Igor Popov

Roger Gregory Hathorn

Ellen Joanne Grusy

Glen Alan Jaquette

David Ray Kahler

Rhea Reyes Frondozo

Todd Charles Sorenson

Larry Juarez

Michael P Vageline

Rashmi Chandra

Anjul Mathur

John R Flanagan

Peter Grimm Sutton

Robert Akira Kubo

Christopher J Colonna

Patricia G Driever

Richard Mark Sczepczenski

George Kuch

Herve G P Andre

Said Abdullah Ahmad

Tony Leung

Bernhard Laubli

Richard B Stelmach

Sean Patrick Riley

Glynis G Dsouza

A first node and a second node are configured in a storage system, wherein the first node and the second node are communicatively coupled to a key server. One or more nodes of a set comprising the first node and the second node initiate a process to generate an encryption key to be shared between the first node and the second node in the storage system. A request for the encryption key is transmitted to the key server, from the one or more nodes of the set comprising the first node and the second node, in response to securing a common lock that is available.

Prevention of race conditions in a dual-server storage system for generation of encryption key

Key management for encrypted data. A node, such as a storage device, obtains a shared key to be used in cryptographic operations. The obtaining includes using an identifier of another node, such as a host of the computing environment, and a unique identifier of the shared key to obtain the shared key. The obtained shared key is then used in one or more cryptographic operations.

Storage device key management for encrypted host data

Provided are a computer program product, system, and method for determining key server type and key server redundancy information to enable encryption. A first key server type for a first protocol is indicated in a key server type field in response to determining a current protocol used to communicate with the key server comprises the first protocol. A query information request is submitted to the key server to determine a key server type in response to determining that the current protocol comprises the second protocol. The second key server type indicated in the response to the query information request is indicated in the key server type field in response to the response indicating the second key server type. The first or second type of key server indicated in the key server type field is used to determine information to include in a key retrieval request.

Performing key server redundancy verification to verify a key is obtained from redundant key servers

Determining key server type and key server redundancy information to enable encryption

A method for improving I/O response times in a data replication environment is disclosed. In one embodiment, such a method includes receiving, at a primary storage system, a request to read data on the primary storage system. The method starts a timer upon receiving the request. In the event the data cannot be retrieved from the primary storage system by the time the timer expires, the method requests the data from a secondary storage system. In the event the primary storage system returns the data before the secondary storage system, the method returns data retrieved from the primary storage system to a host system. In the event the secondary storage system returns the data before the primary storage system, the method returns the data retrieved from the secondary storage system to the host system. A corresponding system and computer program product are also disclosed.

I/O response times in data replication environments

One general aspect of encryption key management by a data storage controller which communicates with asynchronous key servers is directed to issue a prepare for enable command to request an encryption key from an encryption key server. State machine logic transitions from an unconfigured state to a prepare for enable state in which key server mirror management logic receives from a key server a requested encryption key and caches the received key. In an enabling state, enablement logic verifies successful mirroring of the encryption key by a key server to another key server and activates the encryption key if key mirroring by key servers is verified. In an enabled state, data is encrypted using the verified, activated encryption key. Other features and aspects may be realized, depending upon the particular application.

Encryption key management in a data storage system communicating with asynchronous key servers

Access between a plurality of nodes of the computing environment is controlled by a key server. The key server receives from one node of the plurality of nodes, a request for a shared key, in which the shared key is created for a selected node pair. A determination is made by the key server as to whether the one node is a node of the selected node pair. In one example, the determining checks an alternate name of the one node to determine whether it matches an alternate name associated with the shared key. Based on determining the one node is a node of the selected node pair, the key server provides the shared key to the one node.

Controlling access between nodes by a key server

A director node of a plurality of nodes determines a plurality of data arrays, where the plurality of data arrays have been discovered at boot time. The director node determines global metadata information, based on reading boot sectors of at least one of the plurality of data arrays discovered at boot time. A determination is made from the global metadata information as to how many data arrays had been previously configured. In response to determining that the plurality of data arrays discovered at boot time is not equal in number to the previously configured data arrays, the director node determines that all configured data arrays have not been discovered.

Validation of storage arrays based on information stored in global metadata

A method for reducing stress on a RAID under rebuild is disclosed herein. In one embodiment, such a method includes performing the following actions while the RAID is undergoing a rebuild process: (1) redirect writes intended for the RAID to a temporary storage area located on a same primary storage system as the RAID, and (2) redirect reads intended for the RAID to a secondary storage system configured to store a copy of data in the RAID. The method is further configured to perform the following actions upon completing the rebuild process: (3) update the rebuilt RAID to reflect writes made to the temporary storage area during the rebuild process, and (4) redirect reads and writes to the rebuilt RAID. A corresponding system and computer program product are also disclosed.

Reducing stress on RAIDS under rebuild

A plurality of data arrays are coupled to a plurality of nodes via a plurality of adapters. The plurality of adapters discover the plurality of data arrays during startup, and information about the plurality of data arrays are communicated to corresponding local nodes of the plurality of nodes, wherein the local nodes broadcast the information to other nodes of plurality of nodes. A director node of the plurality of nodes determines which data arrays of the plurality of data arrays are a current set of global metadata arrays, based on the broadcasted information.

Global data establishment for storage arrays controlled by a plurality of nodes

Provided are a computer program product, system and method for a redundant key server encryption environment. A key server receives from at least one remote key server public keys associated with the at least one remote key server. The key server receives a request for an encryption key from a requesting device and generates the encryption key for use by the requesting device to unlock a storage. The key server generates a first wrapped encryption key by encrypting the encryption key with a requesting device public key, a second wrapped encryption key by encrypting the encryption key with a public key associated with the key server, and at least one additional wrapped encryption key by encrypting the encryption key with the at least one public key provided by the at least one remote key server. The key server transmits the generated keys to the requesting device.

Redundant key server encryption environment

Method, system, and computer program product embodiments for concurrent copy of system configuration global metadata in a data storage system are provided. In one exemplary embodiment, a global data rank is quiesced, followed by an unquiesce of the global data rank except for a global metadata area. The global metadata area is updated in memory, and then unquiesced. A current range of the global metadata area to be copied is quiesced. The current range of the global metadata area is copied from a source area to a target area. The current range is unquiesced. The steps of quiescing an additional current range, copying the range from a source area to a target area, and unquiescing the current range continue until the entire global metadata area has been copied.

Concurrent copy of system configuration global metadata

Provided are a computer program product, system and method for a redundant key server encryption environment. A key server transmits public keys associated with the key server and at least one device to at least one remote key server. The key server receives from the at least one remote key server public keys associated with the at least one remote key server. The key server receives a request for an encryption key from a requesting device comprising one of the at least one device and generates the encryption key for use by the requesting device to unlock a storage. The key server generates a first wrapped encryption key by encrypting the encryption key with a requesting device public key associated with the requesting device. The key server generates a second wrapped encryption key by encrypting the encryption key with a public key associated with the key server. At least one additional wrapped encryption key is generated for each of the at least one remote key server by encrypting the encryption key with the at least one public key provided by the at least one remote key server. The key server transmits the first, second and the at least one additional wrapped encryption key to the requesting device.

Growing community of inventors

Corona de Tucson, AZ, United States of America

Jacob Lee Sheppard