International Business Machines Corporation

Amicus Therapeutics, Inc.

Mcdata Corporation

John R Flanagan

Daniel Francis Casper

Roger Gregory Hathorn

Matthew J Kalos

Catherine C Huang

Louis William Ricci

Harry M Yudenfriend

Christopher J Colonna

Patricia G Driever

Gustav E Sittmann, Iii

Dale Francis Riedy, Jr

Scott M Carlson

Ugochukwu Charles Njoku

Richard Mark Sczepczenski

Mooheng Zee

Mark P Bendyk

Clinton E Bubb

George Kuch

Glen Alan Jaquette

Giles R Frazier

Kenneth J Oakes

Robert J Dugan

Thomas Anthony Gregg

Elfrida Benjamin

Hung V Do

Joseph C Elliott

Brandon Alan Wustman

Kenneth Valenzano

Richie Khanna

Kenneth M Trowell

Xiaoyang Wu

John Crowley

Susan Kay Candelaria

Mikel William Welsh

Francis Gassert

Evan Rivera

Charles W Gainey, Jr

Peter Grimm Sutton

Raymond Michael Higgs

Jeffrey M Turner

John S Trotter

Elke G Nass

Craig A Bickelman

Robert P Jewett

Gustav E Sittmann

Paul S Frazer

David F Craddock

Alan Frederic Benner

Arthur James Stagg

Maurice Isrel

Balachandar Rajaraman

Jeffrey J Nelson

Alol Antony Crasta

Patrick Gerald Brown

Louis C Ricci

Gary R Flauaus

Dennis L Massey

Kimi A Cousins

Leonard J Dibella

Casimer M DeCusatis

Clint Alan Hardy

Brent Cameron Beardsley

Jeffrey Paul Kubala

Scott Brady Compton

Kenneth Wayne Boyd

Bret Wayne Holley

Frank William Brice

Gerhard Banzhaf

Matthew Richard Craig

Carl Alfred Bender

Eugene P Hefferon

Stefan Amann

Bjorn O Liencres

Jacob Lee Sheppard

Jeffrey William Palm

William Miller

Charles E Shapley

Bernhard Laubli

Gerald H Miracle

Peter L Potvin

Richard A Neuner

Gustav E Sittman, Iii

Roberto J Sanchez

Matthew L Kalos

Ughochukwu C Njoku

Louis W Rcci

Kate McCavitt

A host port is enabled for security. In response to a determination by the host port that authentication or security association negotiation with a storage port cannot be completed successfully, the host port determines whether an audit mode indicator has been enabled in a login response from the storage port. The host port preserves input/output (I/O) access to the storage port based on determining whether the audit mode indicator has been enabled in the login response from the storage port.

Maintenance of access for security enablement on a host system

A storage port receives a login request. The storage port configures an audit mode indicator as enabled in a login response to a host port to enter a security enabled mode to indicate to the host port that Input/Output (I/O) operations are to be transmitted from the host port to the storage port even if authentication or security association negotiation with the storage port cannot be completed successfully.

Maintenance of access for security enablement in a storage device

Aspects of the invention include channel key loading of a host bus adapter (HBA) based on a secure key exchange (SKE) authentication response by a responder node of a computing environment. A non-limiting example computer-implemented method includes receiving an authentication response message at an initiator channel on an initiator node from a responder channel on a responder node to establish a secure communication, the receiving at a local key manager (LKM) executing on the initiator node. A state check can be performed based on a security association of the initiator node and the responder node. An identifier of a selected encryption algorithm can be extracted from the authentication response message. The initiator channel can request to communicate with the responder channel based at least in part on a successful state check and the selected encryption algorithm.

Channel key loading in a computing environment

Aspects of the invention include initializing a local key manager (LKM) on a node of a computing environment. The node includes a plurality of channels. The LKM is configured to provide a secure data transfer between the node and an other node of the computing environment. A connection is established, by the LKM, between the LKM and an external key manager (EKM) that stores a shared key for the node and the other node. In response to establishing the connection, the LKM registers security capabilities of the plurality of channels. The security capabilities are used by the LKM to provide the secure data transfer between the node and the other node.

Initializing a local key manager for providing secure data transfer in a computing environment

A path is secured from one node to another node of the computing environment. The one node obtains a first encryption key and a second encryption key. A shared key is obtained by the one node from a key server, and the shared key is used to encrypt a message. The encrypted message includes the first encryption key and the second encryption key. The encrypted message and an identifier of the shared key is sent from the one node to the other node, and a response message is received by the one node. The response message at least provides an indication that the other node received the encrypted message and obtained the shared key.

Securing a path at a selected node

Aspects of the invention include receiving a request from an initiator channel on an initiator node to initiate a secure communication with a responder channel on a responder node. The receiving is at a local key manager (LKM) executing on the initiator node. A security association is created at the LKM between the initiator node and the responder node. An identifier of a shared key assigned for communication between the initiator node and the responder node is obtained, and a message requesting initialization of the secure communication between the initiator channel and the responder channel is built. The message includes the identifier of the shared key. The message is sent to the initiator channel.

Generation of a request to initiate a secure data transfer in a computing environment

A path for a node of a computing environment is secured. The securing includes obtaining, by the node, a message that includes an identifier of a shared key and an encrypted message. The node obtains the shared key from a key server and uses it to decrypt the encrypted message to obtain an encryption key and one or more parameters. A security parameters index to be associated with the encryption key and the one or more parameters is obtained. The node sends a response message to another node, the response message including the security parameters index.

Securing a path at a node

Aspects of the invention include generation of a secure key exchange (SKE) authentication response by a responder node of a computing environment. A computer-implemented method includes receiving an authentication request message at a responder channel on the responder node from an initiator channel on an initiator node to establish a secure communication, the receiving at a local key manager (LKM) executing on the responder node. A state check is performed based on a security association of the initiator node and the responder node. A validation of the authentication request message is performed. A proposal list of the authentication request message is checked. An authentication response message is built based at least in part on a successful state check, a successful validation, and selecting an encryption algorithm from the proposal list. The authentication response message is sent from the LKM to the responder channel.

Generation of a secure key exchange authentication response in a computing environment

Provided are a computer program product, system, and method embodiments for reverting from a new security association to a previous security association in response to an error during a rekey operation. The responder maintains a first security association with the initiator having a first key to use to encrypt and decrypt messages transmitted with the initiator. The responder receives a message from the initiator for a rekey operation to establish a second security association with the initiator using a second key. The responder queues Input/Output (I/O) for transmission using the second key after completing the rekey operation. After activating the second security association, the responder receives a revert message from the initiator to revert back to using the first security association and first key in response to a failure of the rekey operation.

Reverting from a new security association to a previous security association in response to an error during a rekey operation

The present application provides for compositions comprising high concentrations of acid a-glucosidase in combination with an active site-specific chaperone for the acid &#x3b1;-glucosidase, and methods for treating Pompe disease in a subject in need thereof, that includes a method of administering to the subject such compositions. The present application also provides methods for increasing the in vitro and in vivo stability of an acid &#x3b1;-glucosidase enzyme formulation.

High concentration alpha-glucosidase compositions for the treatment of Pompe disease

In response to receiving a login request message with a security indicator enabled for security, a storage port establishes a security association by transmitting a response indicating a login accept with the security indicator enabled for security. In response to establishing the security association, the storage port modifies a protocol behavior for transmitting and receiving information units.

Control of information units for encryption

Provided are a computer program product, system, and method embodiments for reverting from a new security association to a previous security association in response to an error during a rekey operation. An initiator maintains a first security association with the responder having a first key to use to encrypt and decrypt data transmitted with the responder. The initiator initiates a rekey operation to establish a second security association with the responder using a second key. The initiator detects a failure of the rekey operation after the responder started using the second key for transmissions. A revert message is sent to the responder to revert back to using the first security association and first key in response to detecting the failure of the rekey operation.

Provided are a computer program product, system and method embodiments for secure communication between an initiator and a responder over a network. The responder receives, from the initiator, a security association initialization message to establish a security association with the responder including key material used to generate a key for the security association. The responder receives an authentication message from the initiator to program the responder to establish authentication between the responder and the initiator after establishing the security association. The responder sends an authentication message response to the initiator to establish authentication with the responder in response to the authentication message. The responder sends an authentication done message to the initiator after sending the authentication message response to cause the initiator to activate using the security association and the key to encrypt and decrypt communication between the responder and initiator.

Establishing a security association and authentication to secure communication between an initiator and a responder

Growing community of inventors

Poughkeepsie, NY, United States of America

John R Flanagan