International Business Machines Corporation

Wayne Erwin Rhoten

Jon Arthur Lynds

Richard Anthony Ripberger

Kirby Grant Dahman

Kathryn Eileen Eldred

Peter Grimm Sutton

Donna N Dillenberger

Gary Stuart Puchkoff

Terri A Menendez

David Carl Frank

Matthew J Kalos

Harry M Yudenfriend

John Glenn Thompson

Erika Dawson

John C Dayka

Scott Milton Fry

Gavin Stuart Johnson

Mark A Nelson

Ralph Thomas Beeston

Jerry Wayne Pence

Joel Kenneth Lyman

Eric David Rossman

Cecilia Carranza Lewis

James B Cammarata

Warren B Harding

Christopher Grunow

Vincent K Allen

Robert G Long

Glen Alan Jaquette

Roger Gregory Hathorn

Beth Ann Peterson

Dale Francis Riedy, Jr

Patricia G Driever

Paul Merrill Greco

John Richard Paveza

Michael James Kelly

James Mitchell Ratliff

Lyn Lequam Ashton

Richard Henry Guski

Anthony Steve Pearson

Kimberly Tekavec Bailey

Michael Ray Noel

Kenneth Michael Kapulka

Marc Kenneth Duquette

Samuel E Reynolds

Andrew K Tracy

Michelle Parks Dais, Legal Representative

Cecelia Carranza Lewis

Josephine M Edwards, Legal Representative

Matthew Joseph Kalos

Harry Morris Yudenfriend

James Cammarata

Provided are a computer program product, system, and method for processing request directed through a channel subsystem to a storage server. In one embodiment, a pattern search request is embedded in a Device Command Word (DCW) which allows the storage server to do all or substantially all of the search and comparison work in response to as few as a single DCW from the host. In addition, I/O processing can be enhanced to use the target record of interest of a successful embedded pattern search request as the starting point for read/write I/O processing, all in response to as few as a single DCW. Still further, orientation rules can also be relaxed such that once a target record is found, any and all fields of the record can be accessed and utilized in execution of subsequent commands of the initial or subsequent DCWs of the chain.

Pattern search request embedded in a transport mode command word for a channel subsystem in a storage system

A computer-implemented method according to one embodiment includes identifying a creation of a container within a system, selecting a security policy for the container, based on one or more attributes, identifying a key label associated with the security policy for the container, retrieving a data encryption key, utilizing the key label, and encrypting the container, utilizing the data encryption key. This may enable a highly granular level of automatic container-level security within the system that may be transparently implemented within the system, which may streamline container security and reduce an amount of stored data and processing necessary for implementing container security, and may thereby improve the performance of the system.

Implementing policy-based container-level encryption

A computer-implemented method according to one embodiment includes identifying a first request from a user to access a container, determining whether the user has a first authorization to access the container, allowing the user to access the container, in response to determining that the user has the first authorization to access the container, identifying a second request from the user to access content within the container, where the content is encrypted, retrieving a key label associated with the container, determining whether the user has a second authorization to access the key label, retrieving a data encryption key, utilizing the key label, in response to determining that the user has the second authorization to access the key label, and allowing the user to access the content that is encrypted by performing one or more decryption actions, utilizing the data encryption key.

Implementing a separation of duties for container security

A computer-implemented method according to one embodiment includes establishing a predetermined checkpoint and storing a log of duplicate read data in association with the predetermined checkpoint during a running of an application that is processing at least one data set, the duplicate read data including an image of all data retrieved from the at least one data set in response to a plurality of data reads made by the application before the predetermined checkpoint; identifying a first failure of the application; and restarting the application and performing a first replay of the application in response to the first failure.

Replaying processing of a restarted application

A computer-implemented method according to one embodiment includes restarting an application at a second system in response to a failure of the application at a first system, receiving replicated logged data from the first system at the second system, updating a second data set at the second system to reflect a first data set at the first system, utilizing the replicated logged data, identifying a first plurality of data reads from the restarted application at the second system, where the first plurality of data reads occur before a predetermined checkpoint, and in response to the first plurality of data reads, retrieving the replicated logged data from the second system, and returning the replicated logged data to the restarted application at the second system.

A computer-implemented method according to one embodiment includes establishing a predetermined checkpoint and storing duplicate read data in association with the predetermined checkpoint during a running of an application that is processing at least one data set, identifying a failure of the application, restarting the application in response to the failure, and enabling a replay of the processing of the at least one data set by the restarted application, utilizing the predetermined checkpoint and the duplicate read data.

A method, system, and computer program product for managing a storage facility are disclosed. A potential file overlay may be detected when performing a file transfer. When a file is common to multiple systems and resides on a shared system storage volume, potential file corruption due to a data transfer request is detected and then able to be prevented. Hardware identifiers such as Universal Unique Identifiers (UUIDs) are used in managing a write of a file to shared system storage. By comparing multiple hardware identifiers, a determination is made as to whether to process the write of the file. If the hardware identifiers mismatch, the write is processed. If the hardware identifiers match, a potential file overlay is detected. Because of the potential file overlay, the write is aborted and a failure notification is returned. A successful overwrite prevention notification may also be returned.

Managing a shared storage system using hardware identifiers to deter data/file corruption

Provided are a method, system, and article of manufacture for configuring host settings to specify encryption and a key label referencing a key encrypting key to use to encrypt an encryption key provided to a storage drive to use to encrypt data from the host. User settings are received to configure a data class having data attributes with encryption settings. The data class is stored with the received user encryption settings. A job is received indicating a data set to store to a removable storage medium. A data class is determined having data class attributes matching data attributes of the data set indicated in the job. A determination is made from the determined data class whether to encrypt the data. The data set and a command to encrypt the data set are transmitted to a storage drive in response to determining that the determined data class indicates to encrypt the data, wherein the command to encrypt the data set causes the storage drive to encrypt the data sets written to the removable storage medium with an encryption key.

Configuring host settings to specify an encryption setting and a key label referencing a key encryption key to use to encrypt an encryption key provided to a storage drive to use to encrypt data from the host

Provided are a system and article of manufacture for providing an address format compatible with different addressing formats used for addressing different sized address spaces. An address format is used in an operating system to address storage space in a storage device comprising a first region and a second region of storage space. A first group of applications uses the address format to only address the storage space in the first region and is not coded to use the address format to access the second region and a second group of applications uses the address format to address the storage space in the first and second regions.

System and article of manufacture for providing an address format compatible with different addressing formats used for addressing different sized address spaces

Provided are techniques for determining whether to encrypt data. It is determined whether an element is to be encrypted based on an encryption policy, wherein the element comprises one of metadata and a data set. In response to determining that the element is to be encrypted, the element is encrypted and written to a data storage medium. In response to determining that the element is not to be encrypted, the element is written in the effective clear to the data storage medium.

Encryption policy based on data context recognition

Provided is a method, system, and article of manufacture for providing an address format compatible with different addressing formats used for addressing different sized address spaces. An address format is used in an operating system to address storage space in a storage device comprising a first region and a second region of storage space. A first group of applications uses the address format to only address the storage space in the first region and is not coded to use the address format to access the second region and a second group of applications uses the address format to address the storage space in the first and second regions.

Method for providing an address format compatible with different addressing formats used for addressing different sized address spaces

The present invention provides fast read performance for accessing a file from a multiplicity of files when its corresponding Block ID is unavailable, by furnishing new file-positioning commands, allowing access to data based on File Number, at the same fast locate speed as with Block Ids, thereby expanding the range of applications that can use certain tape drive systems effectively. The present invention includes both a device architecture for supporting the file oriented positioning and the appending, as well as a software system that can permit easy application access to the device facilities and system components which permit the advantages to accrue without any software application or operator changes, including a robust architecture for navigating residual data, e.g., for data recovery. The present invention comprises several device command innovations, a relative positioning command, an absolute positioning command, and other commands, e.g., for sensing current position.

System for fast tape file positioning

Storage management system, apparatus, and method for supporting a multiplicity of logical block identification

A method to record information on a data storage medium using buffered tape marks. A data storage device comprising a computer useable medium having computer readable program code disposed therein for implementing Applicants' method to record information on a data storage medium using buffered tape marks. A data storage and retrieval system comprising a computer useable medium having computer readable program code disposed therein for implementing Applicants' method to record information on a data storage medium using buffered tape marks. Computer program products embodied as program code stored in one or more memory devices, such as a magnetic disk, a magnetic tape, or other non-volatile memory device disposed in a host computer, a data storage device, and/or a library controller.

Data management system, apparatus, and method to use buffered file marks

Growing community of inventors

Morgan Hill, CA, United States of America

Wayne Erwin Rhoten