Granted Patent B2

US 11,755,222 · App. 17/186,354 · Granted Sep 12, 2023

Inventors: Kundan Kumar (Bangalore, IN); Sanjib Mallick (Bangalore, IN)

Assignee: EMC IP Holding Company LLC

G06F3/0643G06F3/0623G06F3/0673G06F21/602

Abstract

Claims (52)

1. An apparatus comprising:

at least one processing device comprising a processor coupled to a memory;

wherein the at least one processing device is configured:

to control delivery of input-output operations from a host device to a storage system over selected ones of a plurality of paths through a network;

to identify whether operational information of the host device corresponding to a given write input-output operation comprises one or more index nodes;

to analyze the one or more index nodes responsive to a positive identification;

to determine whether one or more portions of data corresponding to the given write input-output operation comprise file data based on the analysis of the one or more index nodes;

to encrypt at least part of the file data responsive to an affirmative determination; and

to deliver the given write input-output operation comprising the encrypted file data to the storage system.

2. The apparatus of claim 1 wherein the operational information of the host device corresponding to the given write input-output operation comprises one or more input-output operation pages.

3. The apparatus of claim 1 wherein the at least one processing device is further configured:

to identify whether operational information of the host device corresponding to a given read input-output operation comprises one or more additional index nodes;

to analyze the one or more additional index nodes responsive to a positive identification of whether the operational information corresponding to the given read input-output operation comprises the one or more additional index nodes; and

to determine whether one or more portions of data corresponding to the given read input-output operation comprise read file data based on the analysis of the one or more additional index nodes.

4. The apparatus of claim 3 wherein the at least one processing device is further configured to decrypt the read file data responsive to an affirmative determination of whether the one or more portions of data corresponding to the given read input-output operation comprise read file data.

5. The apparatus of claim 4 wherein the operational information of the host device corresponding to the given write and the given read input-output operations comprises a plurality of input-output operation pages.

6. The apparatus of claim 1 wherein the at least one processing device is further configured to determine one or more file types of the file data based on the analysis of the one or more index nodes.

7. The apparatus of claim 6 wherein:

the at least one processing device is further configured to determine whether the one or more file types correspond to one or more specified file types; and

wherein the part of the file data that is encrypted comprises the one or more specified file types.

8. The apparatus of claim 7 wherein the at least one processing device is further configured to receive as an input the one or more specified file types.

9. The apparatus of claim 1 wherein the at least one processing device is further configured to determine that at least part of the data corresponding to the given write input-output operation lacks the file data responsive to a negative identification.

10. The apparatus of claim 9 wherein the at least one processing device is further configured to deliver the given write input-output operation to the storage system without encrypting the part of the data lacking the file data.

11. The apparatus of claim 1 wherein the at least one processing device is further configured:

to determine that one or more other portions of data corresponding to the given write input-output operation comprise data other than file data based on the analysis of the one or more index nodes; and

to deliver the given write input-output operation to the storage system without encrypting the one or more other portions of data comprising the data other than file data.

12. The apparatus of claim 1 wherein the at least one processing device comprises at least one multi-path input-output driver implemented in the host device and configured to control delivery of the input-output operations to storage devices of the storage system over the selected ones of the plurality of paths through the network.

13. The apparatus of claim 1 wherein the at least one processing device is further configured to enable one or more bits in an extension field of a storage device to indicate that at least the part of the file data has been encrypted.

14. The apparatus of claim 13 wherein the at least one processing device is further configured:

to recognize in a read input-output operation the one or more bits indicating that at least the part of the file data has been encrypted; and

to decrypt the part of the file data based on the recognition.

15. A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code, when executed by at least one processing device comprising a processor coupled to a memory, causes the at least one processing device:

to control delivery of input-output operations from a host device to a storage system over selected ones of a plurality of paths through a network;

to identify whether operational information of the host device corresponding to a given write input-output operation comprises one or more index nodes;

to analyze the one or more index nodes responsive to a positive identification;

to determine whether one or more portions of data corresponding to the given write input-output operation comprise file data based on the analysis of the one or more index nodes;

to encrypt at least part of the file data responsive to an affirmative determination; and

to deliver the given write input-output operation comprising the encrypted file data to the storage system.

16. The computer program product of claim 15 wherein the operational information of the host device corresponding to the given write input-output operation comprises one or more input-output operation pages.

17. The computer program product of claim 15 wherein the program code further causes the at least one processing device:

to identify whether operational information of the host device corresponding to a given read input-output operation comprises one or more additional index nodes;

to analyze the one or more additional index nodes responsive to a positive identification of whether the operational information corresponding to the given read input-output operation comprises the one or more additional index nodes; and

to determine whether one or more portions of data corresponding to the given read input-output operation comprise read file data based on the analysis of the one or more additional index nodes.

18. The computer program product of claim 17 wherein the program code further causes the at least one processing device to decrypt the read file data responsive to an affirmative determination of whether the one or more portions of data corresponding to the given read input-output operation comprise read file data.

19. A method comprising:

controlling delivery of input-output operations from a host device to a storage system over selected ones of a plurality of paths through a network;

identifying whether operational information of the host device corresponding to a given write input-output operation comprises one or more index nodes;

analyzing the one or more index nodes responsive to a positive identification;

determining whether one or more portions of data corresponding to the given write input-output operation comprise file data based on the analysis of the one or more index nodes;

encrypting at least part of the file data responsive to an affirmative determination; and

delivering the given write input-output operation comprising the encrypted file data to the storage system.

20. The method of claim 19 wherein the operational information of the host device corresponding to the given write input-output operation comprises one or more input-output operation pages.

Assignments (10)

Continuity (1)