Abstract: An improved technique migrating data from a source LUN (logical unit) to a target LUN manages control I/O's in a manner that depends on the current state of data migration and on whether the control I/O's specify that reservation information for a LUN is to be set or queried. Control I/O's specifying reservation settings during the different states of migration are treated the same way as data WRITEs during those respective states, and control I/O's specifying reservation queries during different migration states are treated the same way as data READs during those respective states.

Abstract: A method performed in a device is provided. The method includes (a) receiving key identification information from a key controller module on an external host, (b) obtaining a key identified by the key identification information from an external key server, (c) decrypting encrypted data from an encrypted storage system using the key, and (d) processing the decrypted data. A corresponding computer program product is also provided.

Abstract: An encryption endpoint (EE) receives, via a storage I/O stack (having a key controller module (KCM)), encryption metadata identifying an encryption key and a set of region entries. Each region entry includes an identification of a region within a storage device subject to encryption with the encryption key and an identification of a correlation between the region and a corresponding region on a logical volume (LV) managed by the KCM. The EE receives, via the stack, a storage command to process a block having a first address on the storage device. It corresponds to a second address located within the corresponding region of the LV. The EE determines the second address within the LV and then cryptographically processes the block using an address-dependent cryptographic algorithm and (a) data of the block, (b) the determined second address, and (c) the encryption key.

Abstract: A host in an encrypted data storage system sends encryption metadata associated with an encrypted logical volume (LV) from a key controller module to an encryption endpoint via a storage I/O stack. The encryption metadata identifies an encryption key and encrypted regions of the LV, and the sending results in establishment of one or more shared associations between the key controller module and the encryption endpoint which associates the encrypted LV with the encryption metadata for the encrypted LV. A data storage operation is performed on the encrypted LV by sending a data storage command from the key controller module to an encrypted region of the encryption endpoint via the storage I/O stack. The encryption endpoint uses the encryption metadata associated with the encrypted LV to cryptographically process data of the data storage operation.

Abstract: Methods and systems are disclosed that relate to selecting a path for sending an I/O request from a host to a data storage subsystem from among a plurality of paths from the host to the subsystem. An exemplary method includes identifying a limitation on the traffic level for the plurality of paths, tracking a first metric corresponding to the limitation on the traffic level for each path, and transmitting a first I/O request having an urgency level other than the highest urgency level by one of the plurality of paths whose first metric does not exceed its limitation on the traffic level.