International Business Machines Corporation

Patricia G Driever

John R Flanagan

Roger Gregory Hathorn

Christopher J Colonna

Jerry Wayne Stevens

Constantinos Kassimis

Richard Mark Sczepczenski

Gary Owen McAfee

Alexandra Winter

George Kuch

Glen Alan Jaquette

Harry M Yudenfriend

Louis William Ricci

Mooheng Zee

Dale Francis Riedy, Jr

Bruce H Ratcliff

Stephen R Valley

Richard P Tarcza

Angelo Macchiano

Mikel William Welsh

Kimberly Tekavec Bailey

Evan Rivera

Daniel Francis Casper

Scott Brady Compton

William Miller

Robert P Jewett

Peter Grimm Sutton

Gustav E Sittmann, Iii

Pasquale A Catalano

Jeffrey Alan Frey

Lap Thiet Huynh

Stephen Robert Guendert

Henry Joseph May

Daniel D Sentler

Ingo Adlung

Alol Antony Crasta

Friedemann Baitinger

Francis Gassert

Craig Donald Norberg

Dan Vangor

Ilene A Goldman

Michael J Shannon

Tracy D Butler

Matthew Hank Sabins

Leonard J Dibella

Dennis L Massey

Margaret Dubowsky

Beth Ann Peterson

Christoph Raisch

Scott M Carlson

Louis P Gomes

Catherine C Huang

John Richard Paveza

Michael James Becht

Jacob Lee Sheppard

Wayne Erwin Rhoten

Bernhard Laubli

Sudheer R Yelanduru

Bharath B Somayaji

Kenneth M Trowell

Paul S Frazer

A host port is enabled for security. In response to a determination by the host port that authentication or security association negotiation with a storage port cannot be completed successfully, the host port determines whether an audit mode indicator has been enabled in a login response from the storage port. The host port preserves input/output (I/O) access to the storage port based on determining whether the audit mode indicator has been enabled in the login response from the storage port.

Maintenance of access for security enablement on a host system

Embodiments herein describe techniques for establishing data constructs for a data device that enable communication between a host and a shared adapter. A shared adapter facilitates communication with one or more hosts coupled to a NIC. To do so, a host can establish the data device in each operating system that wishes to communicate with the shared adapter. This can include establishing data constructs such as storage block pages, queue indexes, and interrupt registers in the host memory. The host can then transmit a queue description record (QDR) to the shared adapter so the adapter can configure the queues and has the addresses of the data constructs in the host memory.

Data constructs for a shared network adapter

A storage port receives a login request. The storage port configures an audit mode indicator as enabled in a login response to a host port to enter a security enabled mode to indicate to the host port that Input/Output (I/O) operations are to be transmitted from the host port to the storage port even if authentication or security association negotiation with the storage port cannot be completed successfully.

Maintenance of access for security enablement in a storage device

The embodiments herein describe configuring a data device that enables communication between a host and a shared network adapter. The data device can include data connections between the host and the shared network adapter. The data device can have both control queues in a control plane and data queues in a data plane. The control queues can be activated first in order to issue control commands to configure the data plane in the shared network adapter.

Configuration of data connections between a host and a shared network adapter

Provided are a computer program product, system, and method for processing request directed through a channel subsystem to a storage server. In one embodiment, a pattern search request is embedded in a Device Command Word (DCW) which allows the storage server to do all or substantially all of the search and comparison work in response to as few as a single DCW from the host. In addition, I/O processing can be enhanced to use the target record of interest of a successful embedded pattern search request as the starting point for read/write I/O processing, all in response to as few as a single DCW. Still further, orientation rules can also be relaxed such that once a target record is found, any and all fields of the record can be accessed and utilized in execution of subsequent commands of the initial or subsequent DCWs of the chain.

Pattern search request embedded in a transport mode command word for a channel subsystem in a storage system

A path is secured from one node to another node of the computing environment. The one node obtains a first encryption key and a second encryption key. A shared key is obtained by the one node from a key server, and the shared key is used to encrypt a message. The encrypted message includes the first encryption key and the second encryption key. The encrypted message and an identifier of the shared key is sent from the one node to the other node, and a response message is received by the one node. The response message at least provides an indication that the other node received the encrypted message and obtained the shared key.

Securing a path at a selected node

A path for a node of a computing environment is secured. The securing includes obtaining, by the node, a message that includes an identifier of a shared key and an encrypted message. The node obtains the shared key from a key server and uses it to decrypt the encrypted message to obtain an encryption key and one or more parameters. A security parameters index to be associated with the encryption key and the one or more parameters is obtained. The node sends a response message to another node, the response message including the security parameters index.

Securing a path at a node

Techniques for inter-switch link (ISL) identification and monitoring are described herein. An aspect includes sending a query fabric path command to a switch, the query fabric path command including an origin address and a destination address. Another aspect includes receiving a query fabric path response from the switch based on the query fabric path command, the query fabric path response including a plurality of port identifiers. Another aspect includes monitoring a plurality of ports, each of the plurality of ports corresponding to a respective port identifier of the plurality of port identifiers in the query fabric path response.

Inter-switch link identification and monitoring

Provided are a computer program product, system, and method embodiments for reverting from a new security association to a previous security association in response to an error during a rekey operation. The responder maintains a first security association with the initiator having a first key to use to encrypt and decrypt messages transmitted with the initiator. The responder receives a message from the initiator for a rekey operation to establish a second security association with the initiator using a second key. The responder queues Input/Output (I/O) for transmission using the second key after completing the rekey operation. After activating the second security association, the responder receives a revert message from the initiator to revert back to using the first security association and first key in response to a failure of the rekey operation.

Reverting from a new security association to a previous security association in response to an error during a rekey operation

In response to receiving a login request message with a security indicator enabled for security, a storage port establishes a security association by transmitting a response indicating a login accept with the security indicator enabled for security. In response to establishing the security association, the storage port modifies a protocol behavior for transmitting and receiving information units.

Control of information units for encryption

Provided are a computer program product, system, and method embodiments for reverting from a new security association to a previous security association in response to an error during a rekey operation. An initiator maintains a first security association with the responder having a first key to use to encrypt and decrypt data transmitted with the responder. The initiator initiates a rekey operation to establish a second security association with the responder using a second key. The initiator detects a failure of the rekey operation after the responder started using the second key for transmissions. A revert message is sent to the responder to revert back to using the first security association and first key in response to detecting the failure of the rekey operation.

Provided are a computer program product, system and method embodiments for secure communication between an initiator and a responder over a network. The responder receives, from the initiator, a security association initialization message to establish a security association with the responder including key material used to generate a key for the security association. The responder receives an authentication message from the initiator to program the responder to establish authentication between the responder and the initiator after establishing the security association. The responder sends an authentication message response to the initiator to establish authentication with the responder in response to the authentication message. The responder sends an authentication done message to the initiator after sending the authentication message response to cause the initiator to activate using the security association and the key to encrypt and decrypt communication between the responder and initiator.

Establishing a security association and authentication to secure communication between an initiator and a responder

Provided are a computer program product, system and method embodiments for secure communication between an initiator and a responder over a network. The initiator sends a security association initialization message to the responder to establish a security association including key material used to generate a key for the security association. In response to receiving a security association initialization response to accept the security association, the initiator sends an authentication message to the responder to establish authentication between the responder and the initiator. In response to receiving an authentication message response to the authentication message, the initiator is programmed with the security association. An authentication done message is received from the responder after receiving the authentication message response. The initiator activates the security association to use the key to secure communication between the responder and initiator in response to receiving the authentication done message.

Growing community of inventors

Poughkeepsie, NY, United States of America

Patricia G Driever