International Business Machines Corporation

Stefan Roscher

Christoph Raisch

Henry Joseph May

Daniel D Sentler

Sudheer R Yelanduru

Bharath B Somayaji

Alexander Schmidt

Roger Gregory Hathorn

Jakob Christopher Lang

Marco Kraemer

Sriharsha Jayanarayana

Joachim Fenkes

Angel Nunez Mencias

Carsten Otte

Gerd Konrad Bayer

Stefan Usenbinz

Christoph Vincent Schlameuss

Robert Kieninger

A cloud computing system includes a virtual server outputs non-encrypted data and receives encrypted data in response to receiving a write request signal and a read request signal. A hosting server hypervisor receives the write request signal and the read request signal. In response to receiving the write request signal the hosting server hypervisor writes encrypted data corresponding to the write request signal into a storage device. In response to receiving the read request signal the hosting server hypervisor obtains encrypted data corresponding to a data read request signal from the storage device and outputs the encrypted data. A secure channel sub-system is installed between the at least one virtual server and the hosting server hypervisor. The secure channel sub-system stores a virtual device key in a key storage unit and prevents the virtual server and the hosting server hypervisor from accessing the key

I/O encryption device protected against malicious hypervisors

Techniques are provided for two components in a distributed Fiber Channel Forwarder (FCF) to establish a link between them at a level of operation that is mutually compatible with respect to the various capabilities offered by the two components. A controlling switch in the distributed FCF may simultaneously operate at different levels with different Fiber Channel Data-Plane Forwarders (FDFs), on a per-pair basis. The level of operation is established at the granularity of an individual capability offered by a switching element. When switching elements are upgraded, the switching elements can dynamically switch to higher or lower levels of operation for any or all of the capabilities defined per pair of switching element.

Exchange switch protocol version in a distributed switch environment

Securely removing system capabilities, being available to at least one logical partition, from that partition, the partition being hosted by a computer system running an operating system. The system capabilities are available to a boot loader of the computer system, wherein the boot loader is started in the logical partition. The logical partition remains activated while removing the system capabilities. A removal request is initiated by the boot loader; and a deconfigure command is performed by the boot loader.

Securely removing system capabilities from a logical partition

Techniques are provided for synchronizing, in a distributed Fiber Channel fabric or a distributed FCoE fabric in which FC frames are encapsulated in Ethernet frames, a controlling FCoE forwarder (cFCF) with the FCoE data-plane forwarder (FDF). The operation includes entering a recovery mode at the FDF. The FDF is modified based on a route distribution message provided by the cFCF which includes fabric-provided MAC addresses (FPMAs). The FDF notifies the cFCF of differences between the FPMAs supplied by the route distribution message with the FPMAs known by the FDF. The FDF leaves the recovery mode and sends an acknowledgement to the cFCF.

Synchronizing out-of-sync elements in a distributed fibre channel forwarder

Method to perform an operation comprising, receiving a login request from an endpoint connected to first physical port of a first switch module of a distributed network switch, wherein the distributed network switch comprises a plurality of switch modules, wherein each switch module comprises a plurality of ASICs, responsive to the login request, storing, in a FCDF database, an entry comprising an identifier of the first physical port and a unique identifier of the endpoint, and responsive to receiving, from a cFCF, a zoning update comprising the unique identifier of the endpoint and an FCID for the endpoint, storing the FCID in the FCDF database entry for the endpoint, identifying a first ASIC, of the plurality of ASICs of the first switch module, connected to the first physical port, and updating a zoning table of the first ASIC to include the zoning update.

Fibre channel over ethernet (FCoE) zoning in a distributed ethernet switch

A switch unit has one frame buffer pool for storing received frames and another frame buffer pool for storing large frames. The frame size in the large frame buffer pool may be optimized to the largest amount of data the switch unit that an FCoE switching is running on can support (i.e., a limitation of zone entries). Should free space be unavailable in the large frame buffer pool, or if a sequence grows bigger than can be supported, the switch unit may still continue to send response frames back to the sender. While the switch unit may store header information of the frame, the switch unit does not store the data of subsequent frames any longer. Once the sequence has been received completely, a rejection message is sent back with an appropriate error or reason code. The rejection message enables the sender to attempt a retransmission or cancel the current request altogether.

Handling large frames in a virtualized fibre channel over ethernet (FCoE) data forwarder

Systems, methods, and computer program products to perform an operation comprising, receiving a login request from an endpoint connected to first physical port of a first switch module of a distributed network switch, wherein the distributed network switch comprises a plurality of switch modules, wherein each switch module comprises a plurality of ASICs, responsive to the login request, storing, in a FCDF database, an entry comprising an identifier of the first physical port and a unique identifier of the endpoint, and responsive to receiving, from a cFCF, a zoning update comprising the unique identifier of the endpoint and an FCID for the endpoint, storing the FCID in the FCDF database entry for the endpoint, identifying a first ASIC, of the plurality of ASICs of the first switch module, connected to the first physical port, and updating a zoning table of the first ASIC to include the zoning update.

Provided are a computer program product, system, and method for updating zone information in a distributed switch of data forwarders. For each data forwarder, a sequence number is maintained for zone distribution messages sent to the data forwarder. A change to the ports in the network is detected comprising at least one of an allocation or deallocation of at least one port in the network. The sequence number for each data forwarder is incremented in response to detecting the change. For each data forwarder, a zone distribution message is generated indicating the at least one port allocated and/or deallocated, port information indicating each port in the network that may communicate with each other port, and the sequence number for the data forwarder. The generated zone distribution message is transmitted for each data forwarder to the data forwarder for which the zone distribution message was added.

Growing community of inventors

Stuttgart, Germany

Stefan Roscher