Emc IP Holding Company LLC

Emc Corporation

Dell Products Inc.

Emp IP Holding Company LLC

Thomas N Dibb

Walter A O'Brien, Iii

Xuan Tang

Radia Joy Perlman

Gregory William Lazar

Greg Lazar

Amitai Alkalay

Steven D Sardella

Bradley K Goodman

Naizhong Chiu

Millard C Taylor, Iii

Vamsi K Vankamamidi

Stephen Edward Strickland

Min Zhang

Peter Puhov

Mickey Steven Felton

Randall Shain

Ashok Tamilarasan

Aric Hadav

Bernard Warnakulasooriya

Michael Manning

Yechen Huang

Dennis Mazur

Zhonghua Zhu

Walter O'Brien

Guifeng Tang

Qiulin Cheng

Phillip P Fultz

Zhenhua Dong

Naizhong Chiu Qui

A technique is directed to providing dynamic redundant array of independent disks (RAID) transformation which involves measuring a set of storage array parameters for an existing RAID configuration residing in a storage array. The technique further involves identifying a new RAID configuration to use in place of the existing RAID configuration based on the measured set of storage array parameters. The technique further involves, after the new RAID configuration is identified, transforming the existing RAID configuration into the new RAID configuration.

Dynamic redundant array of independent disks (RAID) transformation

A method, computer program product, and computing system for establishing a connection between a virtualization device and a virtual machine infrastructure. The virtualization device may be configured to be communicatively coupled to one or more PCIe devices. A virtual machine may be executed on the virtual machine infrastructure. Control of the virtualization device may be passed through the virtual machine infrastructure to the virtual machine.

System and method for virtualizing hot-swappable PCIe devices for virtual machines

A method for encrypting and decrypting data, that includes using an encryption key and an address associated with a memory device or a software instance. The method for encrypting and decrypting data may be performed by a hypervisor or by a configured processor. The method may include receiving a read or write request specifying an address; performing a first lookup, in an address mapping table, to identify a memory module address of a memory module associated with the address; performing a second lookup to identify an encryption key associated with the read or write request; generating a decryption or encryption request that includes the memory module address; and the encryption key; and sending the decryption or encryption request to the memory module.

Methods and systems for resilient encryption of data in memory

Techniques providing connectivity between a CPU and physical storage devices (PDs) can use a loop back path formed between two connectors of an extended PO slot when an extended I/O card is inserted therein. The two connectors can include a first connector having connectivity with the CPU over a first set of lanes, and a second connector having connectivity with the PDs over a second set of lanes. While the extended I/O card is inserted into the I/O slot, connectivity can be provided between the CPU and the PDs using connectivity provided between the CPU and the first connector and the first set of lanes; using the loop back path provided between the first and second connectors; and using connectivity provided between the second connector and the PDs over the second set of lanes.

Techniques for flexible physical drive expansion using a loop back connection

A method, computer program product, and computing system for receiving, via a storage processor of a storage system, a write request for writing a data portion to a storage array enclosure of non-volatile memory express (NVMe) drives communicatively coupled to the storage processor, where the write request may be received from a host. The data portion may be written to a persistent memory write cache within the storage array enclosure.

System and method for caching data in persistent memory of a non-volatile memory express storage array enclosure

Techniques involve: acquiring, through a first downstream port of a first switch of a data storage system, information indicating an error of a storage device array from a second switch of the data storage system, wherein the first switch and the second switch are connected to the storage device array and the first downstream port is connected to a second downstream port of the second switch; executing, based on the acquired information, actual actions intended for solving the error; and in response to the executed actual actions failing to match with expected actions for the error, issuing an alarm indicating failure of processing the error.

Method for detecting data storage system, device and data storage system

A method for storing encrypted data in a non-volatile memory device, that includes receiving, by a processor, an indication of a power interruption event; disabling, based on the indication, decryption of encrypted data read from a volatile memory module; copying the encrypted data from the volatile memory module to cache; and copying the encrypted data from the cache to the non-volatile memory device.

Methods and systems for data backup and recovery on power failure

An apparatus comprises a storage system, a key manager incorporated in or otherwise associated with the storage system, and an input-output controller coupled to the key manager and configured to control storage of data items in the storage system. The key manager is configured to determine a controller key accessible to the input-output controller and a plurality of data encryption keys utilizable by the input-output controller to encrypt the data items for storage in the storage system. A given one of the data items is encrypted using a particular one of the data encryption keys and has associated metadata that includes the particular data encryption key encrypted using the controller key. The metadata may comprise an inner wrapping of the particular data encryption key using the controller key and at least one outer wrapping of the inner wrapping using at least one additional key.

Storage system with controller key wrapping of data encryption key in metadata of stored data item

One embodiment is directed to a technique which secures data on a set of storage drives of a data storage system. The technique involves encrypting data from a first tenant using a first tenant key to form first tenant encrypted data and storing the first tenant encrypted data on the set of storage drives. The technique further involves encrypting data from a second tenant using a second tenant key to form second tenant encrypted data and storing the second tenant encrypted data on the set of storage drives, the first tenant being different from the second tenant, and the first tenant key and the second tenant key being per tenant keys which are different from each other. The technique further involves destroying the first tenant key to prevent the first tenant encrypted data stored on the set of storage drives from being decrypted while maintaining the second tenant key to enable decryption of the second tenant encrypted data stored on the set of storage drives.

Securing data using per tenant encryption keys

The techniques presented herein provide for initializing and upgrading data encryption capability in a data storage system. The data storage system in initialized to encrypt data writes using a system wide encryption key. A request is received to upgrade the encryption functionality in the data storage system. A data slice is identified for encryption, wherein the data slice is stored in a RAID group in the data storage system. The data slice is pinned in a first cache memory of a first storage processor and persisted in a second cache memory of a second storage processor. The data slice encrypted and a write operation is initiated to write the encrypted data slice back to the RAID group. If the write operation was successful, the data slice is unpinned the first and second cache memory associated with the data slice is freed, else if the write operation was unsuccessful, the data slice is unpinned and the first and second cache memory associated with the data slice are flushed.

Managing system-wide encryption keys for data storage systems

An apparatus comprises a storage system and a key manager incorporated in or otherwise associated with the storage system. The storage system comprises first storage of a first type and second storage of a second type with the first storage providing enhanced data protection relative to the second storage. The key manager is configured to maintain a master key hierarchy for the storage system. The master key hierarchy comprises a plurality of levels each including one or more master keys, with an uppermost level of the master key hierarchy comprising a root master key that is stored in the first storage and at least one lower level of the master key hierarchy comprising a plurality of master keys that are stored in the second storage under encryption by the root master key. Keys of a lowermost level of the master key hierarchy are associated with respective groups of data items.

Storage system with master key hierarchy configured for efficient shredding of stored encrypted data items

The techniques presented herein provide for associating a data encryption lockbox backup with a data storage system. A first set of software system stable values (SSV) is derived from data storage system component values unique to the data storage system. A lockbox storing the first set of SSV and a set of encryption keys associated with a corresponding respective set of data storage system drives is created. Access to the lockbox requires providing a first minimum number of SSV that match corresponding SSV in the first set of SSV. A backup copy of the lockbox is created, wherein access to the backup copy requires providing a second minimum number of SSV that match corresponding SSV in the first set of SSV, wherein the minimum number of SSV is equal to a second match value. The backup copy of the lockbox is stored at a remote location.

Associating a data encryption keystore backup with a computer system

An apparatus comprises a storage system and a key manager incorporated in or otherwise associated with the storage system. The storage system is configured to store data items across a plurality of dimensions with each such dimension comprising a plurality of classes. The key manager is configured to assign class keys to respective ones of the classes of each of the dimensions. A given one of the data items associated with at least one of the classes in each of two or more of the dimensions is encrypted for storage in the storage system using a multidimensional key determined as a function of the class keys corresponding to respective ones of the classes with which that data item is associated. Such an arrangement allows all of the data items associated with a given one of the classes to be deleted by deleting the class key assigned to the given class.

Storage system configured for encryption of data items using multidimensional keys having corresponding class keys

A method and a system for use in managing data storage is disclosed. Data storage is managed in a data storage system comprising a first and a second storage processor and a plurality of data storage devices. The first and the second storage processor having respective caches configured to mirror each other. A write I/O is received in the data storage system, wherein the write I/O is an operation for updating data storage in the data storage system. Load associated with the first and second storage processor in the data storage system is determined. The cache is bypassed and write I/O is delivered to the plurality of data storage devices in the data storage system in response to determining a heavy load associated with the first and second storage processor in the data storage system.

Growing community of inventors

Rutland, MA, United States of America

Thomas N Dibb