Abstract: Ensuring crash-safe forward progress of a system configuration update in a storage system that includes a storage array controller and a plurality of storage devices, including: determining a number of storage devices in the storage system; determining a number of unavailable storage devices in the storage system; and determining, for the one or more system configurations, whether the system configuration can be reconstructed in dependence upon the number of storage devices in the storage system and the number of unavailable storage devices in the storage system.

Abstract: In a storage system that includes a plurality of storage devices, data protection may include, for each of the plurality of storage devices: encrypting data of the storage device using the device key for the storage device; and encrypting the device key for the storage device using a master secret; generating a plurality of shares from the master secret; and storing the encrypted data, the encrypted device key, and a separate share of the plurality of shares in each storage device.

Abstract: Periodically re-encrypting user data stored on a storage device, including: detecting that a data encryption key should be decommissioned; and for user data stored on the storage device that is encrypted with the data encryption key: reading the user data that is encrypted with the data encryption key from the storage device; re-encrypting the user data utilizing a current data encryption key; and writing the user data that is encrypted utilizing the current data encryption key to the storage device.

Abstract: Periodically re-encrypting user data stored on a storage device, including: reading user data stored on the storage device, wherein the user data is associated with a user-visible identifier; determining, from metadata associated with the user data, whether the user data is encrypted utilizing an expiring data encryption key; responsive to determining that the user data is encrypted utilizing the expiring data encryption key, re-encrypting the user data utilizing a current data encryption key; and writing the user data that is encrypted with the current data encryption key to the storage device, wherein the user data remains associated with the user-visible identifier.

Abstract: Protecting an encryption key for data stored in a storage system that includes a plurality of storage devices, including: reading, from at least a majority of the storage devices, a portion of an apartment key; reconstructing the apartment key using the portions of the apartment key read by the majority of the storage devices; unlocking the main portion of each of the storage devices utilizing the apartment key; reading, from the main portion of one of the storage devices, a portion of a third-party resource access key; requesting, from the third-party resource utilizing the third-party resource access key, an encryption key; receiving, from the third-party resource, the encryption key; and decrypting the data stored on the storage devices utilizing the encryption key.

Abstract: Distributing management responsibilities for a storage system that includes a storage array controller and a plurality of storage devices, including: identifying a plurality of elements in the storage system; for each of the plurality of elements in the storage system, creating a distributed manager, wherein each distributed manager is configured for gathering information describing the state of the associated element in the storage system, determining an action to perform against the associated element in the storage system, and executing an approved action against the associated element in the storage system; and creating a distributed management hierarchy that includes each of the distributed managers.

Abstract: Ensuring crash-safe forward progress of a system configuration update in a storage system that includes a storage array controller and a plurality of storage devices, including: determining a number of storage devices in the storage system; determining a number of unavailable storage devices in the storage system; and determining, for the one or more system configurations, whether the system configuration can be reconstructed in dependence upon the number of storage devices in the storage system and the number of unavailable storage devices in the storage system.

Abstract: Rehabilitating storage devices in a storage array that includes a plurality of storage devices, including: receiving a request to rehabilitate a storage device that is operating outside of a defined range of expected operating parameters; selecting, from a hierarchy of rehabilitative actions that can be performed on the storage device, a rehabilitative action to perform on a storage device in dependence upon information describing a number of times that one or more of the rehabilitative actions have been performed on the storage device; and initiating execution of the selected rehabilitative action.

Abstract: Periodically re-encrypting user data stored on a storage device, including: reading user data stored on the storage device, wherein the user data is associated with a user-visible identifier; determining, from metadata associated with the user data, whether the user data is encrypted utilizing an expiring data encryption key; responsive to determining that the user data is encrypted utilizing the expiring data encryption key, re-encrypting the user data utilizing a current data encryption key; and writing the user data that is encrypted with the current data encryption key to the storage device, wherein the user data remains associated with the user-visible identifier.

Abstract: Distributing management responsibilities for a storage system that includes a storage array controller and a plurality of storage devices, including: identifying a plurality of elements in the storage system; for each of the plurality of elements in the storage system, creating a distributed manager, wherein each distributed manager is configured for gathering information describing the state of the associated element in the storage system, determining an action to perform against the associated element in the storage system, and executing an approved action against the associated element in the storage system; and creating a distributed management hierarchy that includes each of the distributed managers.

Abstract: Ensuring crash-safe forward progress of a system configuration update in a storage system that includes a storage array controller and a plurality of storage devices, including: determining a number of storage devices in the storage system; determining a number of unavailable storage devices in the storage system; and determining, for the one or more system configurations, whether the system configuration can be reconstructed in dependence upon the number of storage devices in the storage system and the number of unavailable storage devices in the storage system.