Emc IP Holding Company LLC

Dell Products Inc.

Seema G Pai

Stephen Richard Ives

Lejin Du

Ningdong Li

Oleksandr Babiychuk

Alykhan Nathoo

Michael E Specht

John T Fitzgerald

Joann J Kent

Scott Rowlands

Evgeny Malkevich

Edward S Robins

Kevin Granlund

Roii Raz

Barak Bejerano

Arieh Don

Ian Wigmore

Malak Alshawabkeh

James Marriot Guyer

Gabriel Benhanokh

Kunxiu Gao

Alesia Tringale

Peng Yin

Jiahui Wang

Dale R Elliott

Sunil Gumaste

Abhilash Sanap

Ravish Sachdeva

Pankaj Soni

Christopher Monti

Daohong Wang

Li Lang

Daniel J Rodrigues

Krishnamoorthy Anantharaman

ShashiKiran Talanki Ramanathagupta

Rekeying an Information Handling System (IHS) network End-to-End Efficient Encryption (E2EEE) with security chaining includes locking an encrypted data volume, preventing reading of, and writing to, the encrypted data volume by applications. A data source IHS may request a new key from a key management system and write new metadata in a trailer of the encrypted data block using a different key slot than a currently used and active metadata key slot, wherein the different key slot is updated with the with the new key. The data source IHS then sends an out-of-data signal to change the use key slot from the currently used key slot to the different key slot. Thereafter, the data source IHS unlocks the encrypted data volume, enabling writing and/or reading user data by the data source IHS and encryption and decryption in all IHS E2EEE data connection segment interfaces.

Rekeying end-to-end efficient encryption with security chaining

Enabling End-to-End Efficient Encryption (E2EEE) with security chaining in an Information Handling System (IHS) network includes: a data source IHS writing metadata containing a key slot, in a trailer of a data block and sending an out-of-band signal to use the key slot; an IHS security chaining logic regenerates the signal to each next IHS E2EEE data connection segment interface; and an encryption configuration state machine of each interface setting a use slot and an active slot to the key slot, in response to the signal. Disabling E2EEE with security chaining includes: the data source IHS sending an out-of-band signal to not use a key slot; the IHS security chaining logic regenerating the signal to each next interface; and the state machine of each interface changing the state machine state to not use a key slot and to not set an active key slot, in response to the signal.

Enablement and disablement of end-to-end efficient encryption with security chaining

In end-to-end efficient encryption with security chaining a data source Information Handling System (IHS) encrypts a data volume, generates and updates metadata in a trailer of the data volume, and generates and updates out-of-band handshake signals indicating an encryption key use slot in the metadata. Data connection segments each include a left-bound interface of one IHS and a right-bound interface of another. Each interface performs synchronous data volume write-encrypt and read-decrypt functions on the data volume in an IHS, perform in-band encryption metadata processing, process out-of-band control signals, and execute an encryption configuration state machine, which uses the metadata and control signals as input to direct write-encrypt and read-decrypt functions on the data volume in the segment. Security chaining logic in each IHS relays between the left and right-bound interfaces, synchronizes and regenerates the control signals for each segment, and coordinates the state machines for the up-stream and down-stream segments.

End-to-end efficient encryption with security chaining

Aspects of the present disclosure relate to detecting and correcting a storage array's drive sectors to prevent data loss. In embodiments, a storage array's telemetry information is monitored. Further, one or more state or operational metrics of the storage array's storage drives are measured. Additionally, each storage drive is scrubbed based on each drive's relative scrubbing priority defined by the telemetry information and each storage drive's state or operation metrics.

Storage media scrubber

A storage system may assign a different encryption key to each logical storage unit (LSU) of a storage system. For each LSU, the encryption key of the LSU may be shared only with host systems authorized to access data of the LSU. In response to a read request for a data portion received from a host application executing on the host system, encryption metadata for the data portion may be accessed. If it is determined from the encryption metadata that the data portion is encrypted, the data encryption metadata for the data portion may be further analyzed to determine the encryption key for the data portion. The data may be retrieved from the storage system, for example, by performance of a direct read operation. The retrieved data may be decrypted, and the decrypted data may be returned to the requesting application.

Data encryption for directly connected host

Techniques for performing configuration may include: determining an initial distribution of logical devices among disk adapters, wherein the initial distribution assigns each logical device a designated disk adapter as a primary active disk adapter servicing I/Os directed to the logical device, wherein the logical devices have storage provisioned from a RAID group including physical storage devices, wherein the disk adapters concurrently issue I/Os to each of the physical storage devices; detecting a configuration change; and responsive to detecting a configuration change, performing first processing. The first processing may include determining, in accordance with the configuration change, a redistribution of the logical devices among the disk adapters; and draining pending I/Os. The configuration change may include adding or removing a logical device provisioned from the RAID group. Performing a first operation on a storage device of the RAID group may include synchronous draining of I/Os of the storage device.

Techniques for multiple directors concurrently servicing I/Os directed to same physical storage devices

Techniques for processing I/O operations may include performing DMA (direct memory access) operations between a data storage system, one or more physical storage devices, and a hardware component that communicate over at least one bus using a DMA-based protocol, such as NVMe (Non-Volatile Memory Express). The hardware device may perform encryption and decryption processing of data that is, respectively, stored to, and read from, physical non-volatile storage. The hardware device may optionally perform other processing for other data-related operations such as any of data validation and integrity checking, data deduplication, data compression, and data decompression. When performing DMA transfers, multiple descriptors, such as SGLs (scatter gather lists) or PRPs (physical region pages), for multiple data portions having logically contiguous consecutive logical addresses may be combined into a single descriptor sent in a single DMA operation.

Data encryption and decryption techniques

Selective use of a software path and hardware path help to provide fine-grained T10-PI support while maintaining IO operation efficiency for single IO read/write commands transferring multiple data segments. NVMe hardware capability (i.e. the hardware path) is always utilized for CPU-intensive CRC verification. NVMe hardware capability is utilized for application tag and reference tag verification whenever possible. Software running on a computing node (i.e. the software path) is used for application tag and reference tag verification and replacement when those functions cannot be implemented by the NVMe hardware.

Software-assisted fine-grained data protection for non-volatile memory storage devices

A distributed network of storage elements (DNSE) is provided in which the physical capacity of each drive is split into a set of equal sized logical splits which are individually protected within the DNSE using separate RAID groups. To reduce restoration latency, members of the RAID groups having a member in common on a given drive are spread within the DNSE to minimize the number of sets of drives within the DNSE that have RAID members in common. By causing the splits to be protected by RAID groups, restoration of the splits may occur in parallel involving multiple drives within the DNSE. By minimizing the overlap between RAID members on various drives, failure of a given drive will not require multiple reads from another drive in the DNSE. Likewise, spare splits are distributed to enable write recovery to be performed in parallel on multiple drives within the DNSE.

Allocating RAID storage volumes across a distributed network of storage elements

Growing community of inventors

Shrewsbury, MA, United States of America

Seema G Pai