Emc IP Holding Company LLC

Emc Corporation

Dell Products Inc.

Xuan Tang

Utkarsh Vipul

Ken Kim

Lorenzo Bailey

Yong Wang

Muhamad Djunaedi

Radia Joy Perlman

Charles W Kaufman

Ping Zhang

Gregory William Lazar

Thomas N Dibb

Naizhong Chiu

Ying Xie

James Odis Pendergraft

Greg Lazar

Bruce Rabe

Sriram Krishnan

Qin Tao

Yi Fang

Norman Speciner

Millard C Taylor, Iii

David A Parenti

Xiangping Chen

Andreas L Bauer

David Haase

Russell R Laporte

Lejin Du

Kevin S Labonte

Tianming Zhang

Qi Jin

Yifan Wang

Vasu Subramanian

Scott David Von Rhee

Deene A Dafoe

Ankita A Pawar

Oleksandr Babiychuk

Jingyan Zhao

George Papadopoulos

Gregory W Lazar

Jamie Pocas

RongZhang Wu

Yiyang Zhang

Xiongfei Chen

Andrew Regan

Yixuan Wang

Ruchika Mehresh

Obeahon O Okaiwele

Shailesh Surendra Padwal

Muhamad Djunacdi

Manish Patel

Marion Meirlaen

Charlie Kaufman

Techniques for providing increased support for deduplication and compression of encrypted storage volumes. The techniques include receiving, at a storage virtual machine (VM), a data encryption key (DEK) associated with encrypted volume data, in which the DEK is wrapped in a key encryption key (KEK). The techniques include receiving, at the storage VM from a client virtual machine (VM), a write request specifying the encrypted volume data. The techniques include obtaining, by the storage VM, the KEK from a key management system (KMS) embedded on the storage VM. The techniques include unwrapping, by the storage VM, the DEK using the KEK, and decrypting, by an IO decryptor hosted by the storage VM, the encrypted volume data using the DEK. The techniques include performing, by the storage VM, data reduction operations on the decrypted volume data, and storing, by the storage VM, the data-reduced volume data on a storage array.

Systems and methods of supporting deduplication and compression of encrypted storage volumes

Techniques for adaptive re-keying of encrypted data are provided. For example, a method comprises the following steps. Utilization information associated with a storage system is obtained, wherein the storage system comprises a set of storage devices. The method dynamically selects a re-keying process from a plurality of different re-keying processes based on at least a portion of the obtained utilization information. At least a portion of the set of storage devices are re-keyed in accordance with the selected re-keying process.

Adaptive re-keying in a storage system

An apparatus comprises a processing device configured to receive, at a given data management entity running on a given processing node, a request to create a given cluster of data management entities for a given client. The processing device is also configured to determine membership requirements for the given cluster, to discover additional data management entities running on additional processing nodes, and to select at least one of the additional data management entities for membership in the given cluster based at least in part on the membership requirements. The processing device is further configured to establish a replication relationship for automating sharing of metadata in the given cluster, the metadata comprising access information and location information for data stores where portions of data items of the given client are stored. The processing device is further configured to perform data management functions for the given client utilizing the metadata.

Clustering data management entities distributed across a plurality of processing nodes

A technique for backing up snapshots in a multi-cloud environment includes accessing multiple cloud storage providers and obtaining therefrom respective sets of storage performance data. The technique further includes receiving storage requirements for snapshots of a data object and selecting, based on the requirements and the storage performance data, a designated cloud storage provider for receiving archived snapshots of the data object. The technique then transmits one or more snapshots of the data object to the designated cloud storage provider for archiving.

Dynamic snapshot backup in multi-cloud environment

A technique rekeys information to maintain data security. The technique involves identifying a first storage drive as a source device available to a proactive copy service. The technique further involves identifying a set of second storage drives as a set of spare devices available to the proactive copy service. The technique further involves invoking the proactive copy service which, in response to being invoked, transfers information from the first storage drive to the set of second storage drives. The information is encrypted by a first key when residing on the first storage drive and is encrypted by a set of second keys when residing on the set of second storage drives, the first key being different from each second key.

Rekeying information on storage devices using a proactive copy service

An apparatus in an illustrative embodiment comprises a client device configured for communication with a storage system, with the client device comprising a processor coupled to a memory. The client device is further configured to identify a data item to be stored in the storage system, and to generate a data encryption key for the data item as a function of a first secret key and the data item. For example, the function may comprise hashing at least the data item. The client device is further configured to encrypt the data item using the data encryption key for the data item, and to send the encrypted data item to the storage system for storage therein. The client device in some embodiments is further configured to encrypt the data encryption key using a second secret key, and to send the encrypted data encryption key to the storage system for storage therein as metadata of the data item.

Client-side encryption supporting deduplication across single or multiple tenants in a storage system

Techniques for synchronizing configuration information in a clustered storage environment. The techniques allow a system administrator or other user to make additions and/or updates to configuration information in one or more configuration files, which are automatically propagated for storage in multiple data storage appliances within a storage domain. By allowing a user to make changes to configuration files associated with a primary appliance within the storage domain, and automatically propagating the configuration files in a background process from the primary appliance to multiple secondary appliances within the storage domain, the user can more readily assure consistency of the configuration information, not only among the primary and secondary appliances within the storage domain, but also among previously unavailable or unreachable data storage appliance(s) that may be recovered and brought back on line within the storage domain.

Systems and methods of synchronizing configuration information in a clustered storage environment

A challenge/response authentication procedure determines whether a response is a correct response, a unique incorrect response, or a non-unique incorrect response, the unique incorrect response and non-unique incorrect response being differentiated by comparing the response value with a store of unique incorrect response values. For the correct response, client access to protected computer system resources is allowed, and the challenge value is discarded so as not to be used again. For the unique incorrect response, (1) when a predetermined limit of unique incorrect responses has not been reached, then the response value is added to the store of unique incorrect response values and the process is repeated with reuse of the challenge value, and (2) when the predetermined limit has been reached, then the client is locked out. For the non-unique incorrect response, the process is repeated with reuse of the challenge value.

Computer system employing challenge/response protocol with detection of non-unique incorrect responses

In response to determining that an encryption operation request includes no indication of a cryptographic key, an encryption service module performs an encryption operation using a current cryptographic key retrieved by the encryption service module, and creates and stores an encrypted data object that includes the resulting ciphertext and a key identifier that uniquely identifies the cryptographic key and the associated cryptographic algorithm used to perform the encryption. A subsequent decryption operation request to the encryption service module that indicates the encrypted data object is processed by retrieving the cryptographic key and identifying the associated cryptographic using the key identifier contained in the encrypted data object. The encrypted data object may also include an initialization vector used to generate the ciphertext contained in the encrypted data object, as well as an integrity check value generated across the ciphertext and initialization vector.

Data encrypting system with encryption service module and supporting infrastructure for transparently providing encryption services to encryption service consumer processes across encryption service state changes

An apparatus in one embodiment comprises at least one processing device having a processor coupled to a memory. The processing device implements a messaging policy enforcement server that receives from a first client device metadata of an encrypted message to be sent from the first client device to a second client device. The received metadata comprises a first key utilized by the first client device to encrypt the message with the first key being encrypted utilizing a second key associated with the second client device. The messaging policy enforcement server processes the received metadata to determine one or more policies applicable to the encrypted message and to generate a further encrypted version of the encrypted first key utilizing one or more additional keys corresponding to the one or more policies. The further encrypted version of the encrypted first key is sent to the second client device in modified metadata of the encrypted message.

Privacy-preserving policy enforcement for messaging

An apparatus comprises a storage system, a key manager incorporated in or otherwise associated with the storage system, and an input-output controller coupled to the key manager and configured to control storage of data items in the storage system. The key manager is configured to determine a controller key accessible to the input-output controller and a plurality of data encryption keys utilizable by the input-output controller to encrypt the data items for storage in the storage system. A given one of the data items is encrypted using a particular one of the data encryption keys and has associated metadata that includes the particular data encryption key encrypted using the controller key. The metadata may comprise an inner wrapping of the particular data encryption key using the controller key and at least one outer wrapping of the inner wrapping using at least one additional key.

Storage system with controller key wrapping of data encryption key in metadata of stored data item

Described are techniques for processing requests. A profile is recorded comprising a plurality of prior requests from a client to a server. The plurality of prior requests associated with first data. A cached copy of the first data is stored in a cache of the server. A quality of service associated with the received request is determined for affecting when the update is applied to the cached copy of first data. The quality of service associated with the received request is dependent on the prior requests in the profile. The first update is applied to the first data. In accordance with the quality of service, the first update is applied to the cached copy of the first data.

Techniques for cache updates based on quality of service

The techniques presented herein provide for initializing and upgrading data encryption capability in a data storage system. The data storage system in initialized to encrypt data writes using a system wide encryption key. A request is received to upgrade the encryption functionality in the data storage system. A data slice is identified for encryption, wherein the data slice is stored in a RAID group in the data storage system. The data slice is pinned in a first cache memory of a first storage processor and persisted in a second cache memory of a second storage processor. The data slice encrypted and a write operation is initiated to write the encrypted data slice back to the RAID group. If the write operation was successful, the data slice is unpinned the first and second cache memory associated with the data slice is freed, else if the write operation was unsuccessful, the data slice is unpinned and the first and second cache memory associated with the data slice are flushed.

Managing system-wide encryption keys for data storage systems

An apparatus comprises a storage system and a key manager incorporated in or otherwise associated with the storage system. The storage system comprises first storage of a first type and second storage of a second type with the first storage providing enhanced data protection relative to the second storage. The key manager is configured to maintain a master key hierarchy for the storage system. The master key hierarchy comprises a plurality of levels each including one or more master keys, with an uppermost level of the master key hierarchy comprising a root master key that is stored in the first storage and at least one lower level of the master key hierarchy comprising a plurality of master keys that are stored in the second storage under encryption by the root master key. Keys of a lowermost level of the master key hierarchy are associated with respective groups of data items.

Storage system with master key hierarchy configured for efficient shredding of stored encrypted data items

A method is used in managing multi-step storage management operations. A policy is defined for a task of a multi-step storage management operation. The multi-step storage management operation includes multiple tasks. The policy for the task indicates directions for reacting to results of the task of the multi-step storage management operation. The task is invoked. The policy for the task is invoked based on results of the task.

Managing multi-step storage management operations by using fault recovery policies

Growing community of inventors

Hopkinton, MA, United States of America

Xuan Tang