Emc Corporation

Emc IP Holding Company LLC

Millard C Taylor, Iii

Gregory William Lazar

Peter Puhov

Xuan Tang

Thomas N Dibb

Naizhong Chiu

Stephen J Todd

Mark A Parenti

Mahadevan Vasudevan

Ankita A Pawar

Eric Scott Lewine

Benjamin Kelley

Naizhong Chiu Qui

Ruchika Mehresh

Obeahon O Okaiwele

Matthew Lenkeit

The techniques presented herein provide for verifying the integrity of an encryption key log file generated on a data storage system. Encryption key activity events associated with a storage system's back-end storage drives are identified. A unique signature is generated for each encryption key activity event. Each encryption key activity event and its corresponding signature are stored in an audit log file. An audit log hash file is generated using the contents of the audit log file. At an external location, the audit log file and the audit log hash file are retrieved from the storage system. The integrity of the retrieved audit log file is verified by generating a local audit log hash file and comparing the local audit log hash file to the retrieved audit log hash file and determining if the local audit log hash file matches the retrieved audit log hash file.

Method and apparatus for verifying system log integrity

The techniques presented herein provide for initializing and upgrading data encryption capability in a data storage system. The data storage system in initialized to encrypt data writes using a system wide encryption key. A request is received to upgrade the encryption functionality in the data storage system. A data slice is identified for encryption, wherein the data slice is stored in a RAID group in the data storage system. The data slice is pinned in a first cache memory of a first storage processor and persisted in a second cache memory of a second storage processor. The data slice encrypted and a write operation is initiated to write the encrypted data slice back to the RAID group. If the write operation was successful, the data slice is unpinned the first and second cache memory associated with the data slice is freed, else if the write operation was unsuccessful, the data slice is unpinned and the first and second cache memory associated with the data slice are flushed.

Managing system-wide encryption keys for data storage systems

The techniques presented herein provide for associating a data encryption lockbox backup with a data storage system. A first set of software system stable values (SSV) is derived from data storage system component values unique to the data storage system. A lockbox storing the first set of SSV and a set of encryption keys associated with a corresponding respective set of data storage system drives is created. Access to the lockbox requires providing a first minimum number of SSV that match corresponding SSV in the first set of SSV. A backup copy of the lockbox is created, wherein access to the backup copy requires providing a second minimum number of SSV that match corresponding SSV in the first set of SSV, wherein the minimum number of SSV is equal to a second match value. The backup copy of the lockbox is stored at a remote location.

Associating a data encryption keystore backup with a computer system

The subject disclosure is generally directed towards an automated mechanism in a computer network or system that controls resource access to any resource designated as needing multiparty authorization. In one aspect, a resource that needs multiparty authorization before access is allowed is identified, along with policy that specifies an authorizer (or multiple authorizers) for the resource. An access control list may contain metadata that indicates the need for multiparty authorization. Authorization may be provided via a token, which may be cached for future use.

Multiparty authorization for controlling resource access

Improved clustered storage systems make use of a software toggle switch stored in a shared persistent configuration database, which allows a peer node to be rebooted into a FIPS 140 mode defined by the switch and then to take over as master while the original master node reboots into the new FIPS 140 mode as defined by the switch. Advantageously, system availability is maintained as the nodes are rebooted sequentially while a master is always available. The persistent switch allows for synchronization, while also allowing persistence of state even in the event of a system crash.

Techniques for persistently toggling a FIPS-140 cryptographic mode of a clustered storage system

A method for use in facilitating Java communications is disclosed. A Java applet is caused to open a socket on a port number. A JSP having the port number is invoked. A hidden applet is generated, the hidden applet establishing a communication connection between the JSP and the Java applet by opening a socket connection on the same port number.

Method and system of facilitating Java communication

A method for use in managing object access is disclosed. A request is received at a reference monitor, wherein the request comprises an object type, an action associated with the object, credentials associated with a user, and access information. Template information is received at the reference monitor, wherein the template information specifies allowable access for the object using qualifiers for the object. For the user, determining at a management request engine whether to allow the action associated with the object based on the request and the template. Also disclosed is a system for use in managing object access.

Growing community of inventors

Chapel Hill, NC, United States of America

Millard C Taylor, Iii