Methods and systems for selective encryption and secured extent quota management for storage servers in cloud computing

• US 9,712,495 B2
• Filed: 05/03/2011
• Issued: 07/18/2017
• Est. Priority Date: 05/03/2011
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Shukla, Divyank, Nagpal, Abhinay R., Patil, Sandeep R., Ramanathan, Sri, Trevathan, Matthew B.
• Primary Examiner(s): Homayounmehr, Farid
• Assistant Examiner(s): Debnath, Suman
• Application Number:
  US13/099,431
• Publication Number:
  US 20120284527A1
• Time in Patent Office: 2,268 Days
• Field of Search: 713189, 713193, 713194, 711154, 711163
• CPC Class Codes: G06F 12/1009 using page tables, e.g. page table structures
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/154 Networked environment
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks

Abstract

Methods and systems for selective encryption and secured extent quota management for storage servers in cloud computing are provided. A method includes associating at least one secure storage disk and at least one non-secure storage disk to a virtual disk, and associating the virtual disk to an application to allow access of the at least one secure storage disk and the at least one non-secure storage disk. The method further includes accessing the at least one secure storage disk and the at least one non-secure storage disk based on the associating of the virtual disk to the application, to write or read confidential and non-confidential data associated with the application into a respective one of the at least one secure storage disk and the at least one non-secure storage disk.

Claims

1. A method, comprising:

allocating at least one secure storage disk and at least one non-secure storage disk in a managed disk group;

associating the at least one secure storage disk and the at least one non-secure storage disk to a virtual disk;

mapping the virtual disk to an application to allow access of the at least one secure storage disk and the at least one non-secure storage disk by the application; and

accessing the at least one secure storage disk and the at least one non-secure storage disk based on the mapping of the virtual disk to the application, to write or read input data which comprises confidential and non-confidential data associated with the application into a respective one of the at least one secure storage disk and the at least one non-secure storage disk,

wherein the application determines whether the input data is the confidential data or the non-confidential data and tags the confidential data,

wherein a determination to write or read the confidential and the non-confidential data to one of the at least one secure storage disk and the at least one non-secure storage disk is based on a read or write encryption command received from the application,

wherein the read or write encryption command received from the application includes an encryption read capacity command to determine and return a size or capacity of the at least one secure storage disk, and

wherein the read or write encryption command received from the application indicates whether the confidential data should be written to or read from the at least one secure storage disk and the non-confidential data should be written to or read from the at least one non-secure storage disk.

2. The method of claim 1, wherein the allocating of the at least one secure storage disk and the at least non-secure storage disk comprises allocating the virtual disk with a predetermined percentage of segments of the at least one secure storage disk.

3. The method of claim 1, wherein the allocating of the at least one secure storage disk and the at least non-secure storage disk comprises allocating the virtual disk with a predetermined number of segments of the at least one secure storage disk.

4. The method of claim 1, wherein:

the at least one secure storage disk comprises at least one encrypting storage disk operable to self-encrypt data written to the at least one encrypting storage disk; and

the at least one non-secure storage disk comprises at least one non-encrypting storage disk.

5. The method of claim 1, further comprising:

reading the confidential data from at least one segment of the at least one secure storage disk based on an encryption read command received from the application; and

forwarding the read confidential data to the application.

6. The method of claim 1, further comprising

reading a size of the at least one secure storage disk based on an encryption read capacity command received from the application;

and

forwarding the read size to the application.

7. The method of claim 1, further comprising writing the confidential data to at least one segment of the at least one secure storage disk based on an encryption write command received from the application.

8. The method of claim 1, further comprising:

reading the non-confidential data from at least one segment of the at least one non-secure storage disk based on a non-encrypting read command received from the application; and

forwarding the read non-confidential data to the application.

9. The method of claim 1, further comprising writing the non-confidential data to at least one segment of the at least one non-secure storage disk based on a non-encrypting write command received from the application.

10. The method of claim 1, wherein a service provider at least one of creates, maintains, deploys and supports a computer infrastructure that performs the steps of claim 1.

11. The method of claim 1, wherein steps of claim 1 are provided by a service provider on a subscription, advertising, and/or fee basis.

26. The method of claim 1, wherein the application can write or read to at least one secure storage disk and at least one non-secure storage disk, based on confidentiality of a data access.

27. The method of claim 26, further comprising:

reading the confidential data from at least one segment of the at least one secure storage disk based on an encryption read command received from the application;

forwarding the read confidential data to the application; and

writing the confidential data to at least one segment of the at least one secure storage disk based on an encryption write command received from the application.

28. The method of claim 1, wherein the virtual disk is implemented in a cloud computing environment.

12. A system implemented in hardware, comprising:

a computer infrastructure operable to;

associate a virtual disk to an application on a computing device, the virtual disk associated with at least one encrypting storage disk and at least one non-encrypting storage disk, and used by the application to access of the at least one encrypting storage disk and the at least one non-encrypting storage disk;

access one of the at least one encrypting storage disk and the at least one non-encrypting storage disk based on the associating of the virtual disk to the application, to write or read confidential or non-confidential data associated with the application into a respective one of the at least one encrypting storage disk and the at least one non-encrypting storage disk; and

read a size of the at least one encrypting storage disk based on a read encryption command received from the application,

wherein a determination to write or read the confidential and the non-confidential data to one of the at least one encrypting storage disk and the at least one non-encrypting storage disk is based on a read or write encryption command received from the application,

wherein the read or write encryption command received from the application includes an encryption read capacity command to determine and return a size or capacity of the at least one encrypting storage disk, and

wherein the read or write encryption command received from the application indicates whether the confidential data should be written or read from the at least one encrypting storage disk and the non-confidential data should be written to or read from the at least one non-encrypting storage disk.

13. The system of claim 12, wherein the computer infrastructure is further operable to allocate the virtual disk with a predetermined percentage of segments of the at least one encrypting storage disk.

14. The system of claim 12, wherein the computer infrastructure is further operable to allocate the virtual disk with a predetermined number of segments of the at least one encrypting storage disk.

15. The system of claim 12, wherein the at least one encrypting storage disk is operable to self-encrypt data written to the at least one encrypting storage disk.

16. The system of claim 12, wherein the computer infrastructure is further operable to:

read the confidential data from the at least one encrypting storage disk based on the encryption read command received from the application; and

forward the read confidential data to the application.

17. The system of claim 12, wherein the computer infrastructure is further operable to:

forward the read size to the application.

18. The system of claim 12, wherein the computer infrastructure is further operable to write the confidential data to the at least one encrypting storage disk based on an encryption write command received from the application.

19. The system of claim 12, wherein the computer infrastructure is further operable to:

read non-confidential data from the at least one non-encrypting storage disk based on a non-encrypting read command received from the application;

forwarding the read data to the application; and

write the non-confidential data to the at least one non-encrypting storage disk based on a non-encrypting write command received from the application.

20. A computer program product comprising a computer readable storage device or memory having readable program code embodied in the storage medium, the computer program product includes at least one component operable to:

allocate at least one secure storage disk and at least one non-secure storage disk in a managed disk group;

associate the at least one secure storage disk and the at least one non-secure storage disk to a virtual disk;

map the virtual disk to an application to allow access of the at least one secure storage disk and the at least one non-secure storage disk by the application; and

access the at least one secure storage disk and the at least one non-secure storage disk based on the mapping of the virtual disk to the application, to write or read input data which comprises confidential and non-confidential data associated with the application into a respective one of the at least one secure storage disk and the at least one non-secure storage disk,

wherein the application determines whether the input data is the confidential data or the non-confidential data and tags the confidential data,

wherein a determination to write or read the confidential and the non-confidential data to one of the at least one secure storage disk and the at least one non-secure storage disk is based on a read or write encryption command received from the application,

wherein the read or write encryption command received from the application includes an encryption read capacity command to determine and return a size or capacity of the at least one secure storage disk, and

wherein the read or write encryption command received from the application indicates whether the confidential data should be written to or read from the at least one secure storage disk and the non-confidential data should be written to or read from the at least one non-secure storage disk.

21. The computer program product of claim 20, wherein the allocating of the at least one secure storage disk and the at least non-secure storage disk comprises allocating the virtual disk with a predetermined percentage of segments of the at least one secure storage disk.

22. A method of deploying a system for selective encryption and secured extent quota management for storage servers, comprising:

providing a computer infrastructure, being operable to;

receive input data which comprises confidential data or non-confidential data;

tagging the received input data as the confidential data to indicate confidential information or the received input data as the non-confidential data to indicate non-confidential information;

determine whether the received input data is tagged as confidential or non-confidential respectively; and

send one of an encryption command and a non-encryption command to a storage controller based on whether the received input data is tagged as confidential,

wherein the one of the encryption command and the non-encryption command instructs the received input data to be stored in a secure or a non-secure storage based on whether the received input data is tagged as the confidential or the non-confidential respectively,

wherein the encryption command includes an encryption read capacity command to determine and return a size or capacity of the secure storage, and

wherein the encryption command instructs the received input data tagged as confidential to be stored in the secure storage and the non-encryption command instructs the received input data tagged as non-confidential to be stored in the non-secure storage.

23. The method of claim 22, wherein:

the encryption command instructs the storage controller to one of write the input data to an encrypting storage disk and read data from the encrypting storage disk; and

the non-encryption command instructs the storage controller to one of write the input data to a non-encrypting storage disk and read data from the non-encrypting storage disk.

24. A computer system for selective encryption and secured extent quota management for storage servers, the system comprising:

a CPU, a computer readable memory and a computer readable storage media;

first program instructions to associate at least one encrypting storage disk and at least one non-encrypting storage disk to a virtual disk;

second program instructions to associate the virtual disk to an application on a computing device to allow access of the at least one encrypting storage disk and the at least one non-encrypting storage disk;

third program instructions to access the at least one encrypting storage disk based on an encryption command received from the application, to write or read confidential data associated with the application into the at least one encrypting disk; and

fourth program instructions to access the at least one non-encrypting storage disk based on a non-encryption command received from the application, to write or read non-confidential data associated with the application into the at least one non-encrypting disk,

wherein a determination to write or read input data which comprises the confidential and the non-confidential data to one of the at least one encrypting storage disk and the at least one non-encrypting storage disk is based on a read or write encryption command received from the application,

wherein the application determines whether the input data is the confidential data or the non-confidential data and tags the confidential data,

wherein the read or write encryption command received from the application includes an encryption read capacity command to determine and return a size or capacity of the at least one encrypting storage disk,

wherein the read or write encryption command received from the application indicates whether the confidential data should be written to or read from the at least one encrypting storage disk and the non-confidential data should be written to or read from the at least one non-encrypting storage disk, and

wherein the first, second, third, and fourth program instructions are stored on the computer readable storage media for execution by the CPU via the computer readable memory.

25. The computer system of claim 24, further comprising:

sixth program instructions to allocate the virtual disk with a predetermined percentage of segments of the at least one encrypting storage disk;

seventh program instructions to read the confidential data from the at least one encrypting storage disk based on an encryption read command received from the application;

eighth program instructions to forward the read data to the application; and

ninth program instructions to write the confidential data of the application to the at least one encrypting storage disk based on an encryption write command received from the application,

wherein the sixth, seventh, eighth, and ninth program instructions are stored on the computer readable storage media for execution by the CPU via the computer readable memory.