Emc Corporation

Joshua A Rosenthol

Robert W Griffin

Daniel Vernon Bailey

John S Harwood

Thomas Earl Linnell

John T Fitzgerald

A technique provides hardware security module (HSM) operability which is performed in a computing device. The technique involves running, by processing circuitry of the computing device, a virtual machine monitor to provide a virtual machine environment. The technique further involves running, by the processing circuitry, a security module VM within the virtual machine environment. The security module VM is configured to perform HSM operations on behalf of a set of other VMs. The technique further involves imposing, by the processing circuitry, a requirement that all access between the security module VM and the set of other VMs occur through the virtual machine monitor to isolate and protect the security module VM against tampering.

Techniques for providing hardware security module operability

A computer-implemented technique processes a potentially sensitive item of data (e.g., data which may be either a credit card number or a token having a similar format). The technique involves, after the potentially sensitive item of data is properly received within a physical memory location, generating a token result which indicates whether the potentially sensitive item of data satisfies a valid-token requirement. The technique further involves preserving the potentially sensitive item of data in an unaltered form within the physical memory location when the token result indicates that the potentially sensitive item of data satisfies the valid-token requirement. The technique further involves replacing the potentially sensitive item of data within the physical memory location with a token when the token result indicates that the potentially sensitive item of data does not satisfy the valid-token requirement.

Automated detection of defined input values and transformation to tokens

An improved technique for granting access to a complex datum maps a single user token representing a user onto a set of data group tokens, each data group token providing access to a data group stored on a storage medium. The improved technique combines the centralization of the complex datum while providing the security of tokenization and will lower the risk of a rogue third party gaining unauthorized access to the user's records stored across the data groups.

Tokenization of multiple-field records

A technique of imposing access control policies is presented. The technique comprises receiving a token which is associated with a datum by a tokenization server. The technique also includes generating an access control result based on at least a portion of the token. The technique further includes imposing a first access control policy which includes refraining from sending an access request to the tokenization server when the access control result has a first value and a second access control policy which includes sending an access request to the tokenization server, the access request being constructed and arranged to request access to the datum when the access control result has a second value which is different from the first value.

Techniques of imposing access control policies

A key management server in a storage area network (SAN) provides encryption keys for source and destination storage objects and also associates destination storage objects with source storage objects. When a source object is to be replicated, a replication facility in a storage system of a new destination object requests the key management server to associate the destination object with the source object and assign the data encryption key of the source object or a new data encryption key to the destination object. For recovery of the source object, a replication facility in the storage system of the source object obtains information from the key management server about the replica associated with the source object for replicating data from the destination object back to the source object.

Automation of coordination of encryption keys in a SAN based environment where an encryption engine, device management, and key management are not co-located

A technique of protecting a datum within a set of sensitive data is presented. In this technique, the datum includes a first set of bits satisfying a first set of constraints, and a computer receives the set of sensitive data from an authorized client. The technique involves producing a token corresponding to the datum, the token including a second set of bits distinct from the first set of bits, the second set of bits satisfying a second set of constraints, the second set of constraints being a superset of the first set of constraints. The technique further involves storing the datum and the corresponding token. The technique further involves sending the token to the authorized client, the authorized client enabled to perform, using the second set of bits, a verification that the token satisfies the second set of constraints, the verification being performed apart from the database.

Growing community of inventors

Centreville, VA, United States of America

Joshua A Rosenthol