International Business Machines Corporation

Hitachi Global Storage Technologies Netherlands B.v.

Skhynix Inc.

Steven Robert Hetzler

Daniel Felix Smith

Mario Blaum

John Stewart Best

Wayne Curtis Hineman

James Lee Hafner

William John Kabelac

David Jame Altknecht

A David Erpelding

William Marvin Dyer

Drew B Lawson

Robert Michael Rees

Donald Stimson Bethune

Guerney D H Hunt

Veera W Deenadhayalan

Binny Sher Gill

Martin Aureliano Hassner

Wendy Ann Belluomini

Aayush Gupta

Gary Miles McClelland

Shmuel Winograd

Venu Nayar

Robert Fontana

Jaishankar Moothedath Menon

Pin Zhou

Hugo Alberto Santini

Mason Lamar Williams

Tetsuya Tamura

Assaf Nitzan

Edi Shmueli

Zhenxing Han

Alberto Nunez Covarrubias

Michael F Mitoma

Glen Alan Jaquette

Charles Ray Johns

Roy Daron Cideciyan

Louis Joseph Serrano

Thomas Mittelholzer

James Allan Kahle

Chih-Kung Lee

Hideo Asano

Barry Marshall Trager

Hovey Raymond Strong

David A Thompson

Spencer W Ng

Prakash Kasiraj

Krishnakumar Rao Surugucchi

Frank R Chu

Daniel James Malone, Sr

Nyles Heise

Eyal Lotem

Donald E Horne

Rajamohan Gandhasri

Roger F Hoyt

Jeff J Dobbek

Mario H Lichtsinn

Frank Rui-Feng Chu

Vincent Marrello

Wen-Wei Chiang

Eyal Lotern

Richard M New

Mario Blum

A computer-implemented method includes, receiving, by a source node, a request from a destination node for data stored in a region of shared memory controlled by the source node. The data is encrypted in a local key of the source node. The method includes decrypting, by the source node, the locally encrypted data using the local key and encrypting, by the source node, the decrypted data using a first key for generating first encrypted data. The method also includes encrypting, by the source node, the first encrypted data using a second key for generating second encrypted data, and sending, by the source node, the second encrypted data to the destination node. A computer program product includes one or more computer readable storage media and program instructions collectively stored on the one or more computer readable storage media. The program instructions includes program instructions to perform the foregoing method.

Secure memory sharing

A secret is sliced into a number of encrypted slices. The encrypted slices can be distributed amongst members of a group. The encrypted slices make recovery of the secret possible, but a group authority key is required for decryption. Thus, a number of slices are necessary, but still not sufficient, to recover the secret.

Secure secret recovery

A system includes an authenticated encryption layer comprising logic configured to encrypt data received at the authenticated encryption layer from an authorized application at a source node. The data is encrypted using a first key to obtain first encrypted data. The logic is configured to encrypt the first encrypted data using a second key to obtain second encrypted data and generate a watermark for the first encrypted data and/or a watermark for the second encrypted data. The logic is configured to generate a watermark token for the first encrypted data and/or a watermark token for the second encrypted data.

Authorized secure data movement

A computer-implemented method includes receiving, by a storage system, encrypted data and a set of key identifiers. Each key identifier is associated with information specifying a storage location for which the key identifier is authorized. The method also includes storing, by the storage system, the encrypted data in at least one storage location and receiving, by the storage system, at least one key identifier of the set of key identifiers with a data access request. The method includes determining, by the storage system, whether the data access request is authorized for the at least one key identifier.

Encrypted storage with secure access

A computer program product includes one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions include program instructions to authenticate an application as authorized to perform encryption and program instructions to receive data at an authenticated encryption layer. The program instructions include program instructions to encrypt the data using an encryption key, wherein the encryption key is not available to the application, and program instructions to generate a watermark token of the encrypted data. The program instructions include program instructions to generate a watermark of the encrypted data using the watermark token and a watermark key and program instructions to send the encrypted data, the watermark token, and the watermark to a storage system. The storage system is configured to verify the encrypted data for storage using the watermark key.

Authorized encryption

A computer-implemented method includes receiving deduplication information at a storage system. The deduplication information is accessible to the storage system for performing operations thereon. The deduplication information includes signatures associated with portions of client data. The method also includes receiving the client data encrypted with a client secret key. The client secret key is unavailable to the storage system. The method includes deduplicating data chunks stored in the storage system against chunks of the client data, wherein the client data chunks are selected from the client data for deduplication using the deduplication information.

Opaque encryption for data deduplication

A method, system, and computer program product for key in lockbox encrypted data deduplication are provided. The method collects a set of deduplication information by a host in communication with a storage system via a communications network. A fingerprint is generated for a data chunk to be stored on a storage system. The method encrypts the data chunk using a first encryption key to generate an encrypted data chunk. The fingerprint is encrypted with a second encryption key to generate an encrypted fingerprint. The method encrypts the first encryption key with a third encryption key to generate a first encrypted key. The method encrypts the first encryption key with a fourth encryption key to generate a second encryption key. A data package is generated for transmission to the storage system. The method transmits the data package to the storage system.

Key in lockbox encrypted data deduplication

A computer-implemented method includes receiving, by a transcoder, second encrypted data. The second encrypted data is data that has been encrypted in a first key to create first encrypted data that is then encrypted in a second key to create the second encrypted data. The method includes receiving the second key and decrypting the second encrypted data using the second key to obtain the first encrypted data. The method includes encrypting the first encrypted data using a third key to create third encrypted data, and sending the third encrypted data to a destination node. A computer-implemented method includes receiving, by a transcoder, a second encrypted key. The second encrypted key is a key that has been encrypted in a first key to create a first encrypted key that is then encrypted in a second key to create the second encrypted key.

Secure data movement

According to one embodiment, a computer-implemented method includes receiving an object to be stored within a storage library, computing a hash value, utilizing the object, determining a storage location within the storage library to store the hash value, and sending the hash value to the storage location and neighbor locations of the storage location within the storage library.

Hash protection within an object storage library

A computer implemented method for recovering erased entries within a system of arrays includes identifying a system consisting of a plurality of arrays, wherein each array consists of m rows and n columns of entries, each entry is divided into p symbols consisting of a plurality of bits, protecting the m rows and n columns of entries in the system with an erasure-correcting code allowing the recovery of a number of erased entries in such rows and columns, detecting an erasure corresponding to an entry in the identified system, and, responsive to detecting an erasure, determining the value of the erased entry according to the p symbols of one or more non-erased entries.

Multiple responder approach to systems with different types of failures

One embodiment provides a system including a computer processor, a computer-readable hardware storage device, and program code embodied with the computer-readable hardware storage device for execution by the computer processor to implement a method that includes receiving a selection of a first blob for reclamation from a first data center. The first blob includes multiple erasure code groups. A first message is sent to a second data center indicating the first blob is to be reclaimed. A global reclamation complete message is received from the second data center. The global reclamation complete message indicates a second blob in the second data center has been reclaimed. The first data center and the second data center each maintain local blob occupancy information.

Reclaiming free space in a storage system

A computer-implemented method includes sending key group information to a storage system. The key group information includes keyID information for client data keys in the key group. The client data keys enable deduplication of data chunks encrypted in any of the client data keys in the key group. The method also includes generating deduplication information. The deduplication information includes fingerprints associated with chunks of client data. The method also includes encrypting the data chunks with one of the client data keys, wherein a corresponding decryption key for the encrypted data chunks is not available to the storage system. The method includes sending the deduplication information to the storage system for use in a deduplication process by the storage system and sending the encrypted data chunks to the storage system.

Multi-key encrypted data deduplication

A computer-implemented method according to one embodiment includes initiating a read-modify-write (RMW) operation; assigning the RMW operation to a thread; identifying a storage device associated with the RMW operation; assign a log block within the storage device to the thread; determining a free shadow block location within the storage device; creating a copy of data to be written to the storage device during the RMW operation; writing the copy of the data to the free shadow block location within the storage device; updating the log block within the storage device to point to the free shadow block location to which the copy of the data is written; and writing the data to one or more blocks of a home area of the storage device.

Optimizing read-modify-write operations to a storage device by writing a copy of the write data to a shadow block

A computer-implemented method includes encoding an array of (p&#x2212;1)&#xd7;k symbols of data into a p&#xd7;(k+r) array. The method includes p is a prime number, r&#x2265;1, and k&#x2264;p&#x2212;r. The method also includes each column in the p&#xd7;(k+r) array has an even parity and each line of slope j for 0&#x2264;j&#x2264;r&#x2212;1 in the p&#xd7;(k+r) array has an even parity. The method includes the lines of slope j taken with a toroidal topology modulo p. A computer program product for encoding an array of (p&#x2212;1)&#xd7;k symbols of data into a p&#xd7;(k+r) array includes a computer readable storage medium having program instructions executable by a computer. The program instructions cause the computer to perform the foregoing method.

Expansion for Blaum-Roth codes

A data storage system includes a plurality of data blocks. A set of data blocks are protected by an erasure correcting code and each of the data blocks in the set of data blocks includes block identification information. The data storage system includes a processor and logic integrated with the processor, executable by the processor, or integrated with and executable by the processor. The logic is configured to verify the block identification information for each of the data blocks in the set of data blocks at the time of read and, as part of reconstructing a data block, reconstruct the block identification information for the reconstructed data block, and verify the block identification information.

Block ID encoding in an erasure coded storage system

Growing community of inventors

Los Altos, CA, United States of America

Steven Robert Hetzler