Abstract: A method, apparatus and computer program product for handling secure information (e.g., a password, an account number, a personal identification number (PIN), a user identifier, an encryption key, and a path where said secure information is stored) is presented. Secure information is stored in a software container. A plurality of representations of the secure information is provided, each of the plurality of representations for use under different conditions. Dependent on the particular condition, at least one of the plurality of representations of the secure information is provided by the container. The container holds the secure information during all stages of processing in a manner that prevents unauthorized parties from gaining access to the secret in clear form.

Abstract: Data structures, methods, and apparatus useful in configuring agent services operating in a storage area network are provided. The data structures may include a list of agent types for which agent services are configurable for operation by agents of those agent types in a storage area network; for each agent type in the list of agent types, a corresponding list of configurable agent services operable by agents of the agent type; for each configurable agent service in each list of configurable agent services, a corresponding list of configurable parameters for the configurable agent service; and for each configurable parameter in each list of configurable parameters, at least one parameter value associated with the configurable parameter. Procedures and apparatus are provided for configuring agent services by updating elements of the data structures and providing the updated elements to the agent services.

Abstract: A storage area network management application operates using agents for management of resources. Authenticity is verified in installing an agent on a host computer system in the storage area network. A file is identified for use in installing the agent. The file is signed to produce a digital signature for the file. A certificate is sent to a recipient for use in verifying authenticity of information. The file and digital signature are sent to the recipient. At the recipient, the certificate and the digital signature are used to verify the file. An agent installation operation is performed, using the file, to install the agent on the host computer system.

Abstract: In a storage area network, agents provide transactions of data sets containing updates to manageable entities in a SAN. A SAN server avoids intermittent dissemination of events pertaining to a single transaction by storing events in a cache until completion of all subtransactions in the transaction, and then disseminating all events pertaining to the transaction. Transactions are broken down into update sections, each containing one or more subtransactions collectively defining the entire transaction. Update sections corresponding to the transaction are tagged with a section ID. Events indicating completion of processing of the update section are identified by the section ID, and suppressed temporarily by storing them in the event cache pending completion of the transaction. Other events not matching a tagged section ID are allowed to disseminate. Upon completion of the transaction, events for all section IDs corresponding to the transaction are disseminated from the cache.

Abstract: A SAN management application stores a password file in a secure repository inside a database to which the stored passwords provide access. A separate database account (i.e. login) is created to afford access to the password repository. The password repository, typically a database table or file, is stored in a secure area accessible only by the specialized password account. A separate password, or access token, is employed for access to the password repository account. Executable entities, such as processes of the management application, are encoded with the password, or access token, to the password repository account. From the password account, the password repository provides availability to the stored passwords for specific privileged access by designated processes. In this manner, a dual level authorization is provided to privileged database operations, and corresponding logic embedded in particular processes authorized to traverse both levels.

Abstract: A storage area network (SAN) license validator manages data collection policies (DCPs) in deployed SAN agents by identifying data collection policies corresponding to unlicensed features, and disabling the DCPs for the unlicensed features. Thus, the agents need not expend computational and memory resources to gather data for unlicensed features that will not be queried. Agents receive a set of data collection policies (DCPs) for licensed features for which the corresponding data will be gathered and reported to the MODB. DCPs for unlicensed features are disabled in the agents that would have executed them, either by removing or canceling from an active DCP list or by omitting the unlicensed DCPs from the startup sequence of the agent. In this manner, agents operate with only the DCPs for licensed products and corresponding features, and need not gather extraneous data.

Abstract: In a storage area network (SAN), a SAN management application provides a security audit log of security sensitive user actions performed across the storage area network. In a SAN, multiple services operate to perform requested user actions. Configurations herein substantially overcome the shortcomings of conventional SAN security event logging by providing a comprehensive security audit mechanism operable to identify and record user actions. An event normalizer disposed in each of the services identifies requested user actions, creates a uniform user action object, and sends the user action object to a coalescer operable to receive user action objects from the plurality of services in the SAN. The user action object provides a generic template responsive to each of the event normalizers in the services. The event normalizers normalize event properties and attributes concerning a user action into the generic user action object, and employs preexisting conduits for gathering and recording events.

Abstract: A system receives notification from an agent of that agent's availability for data collection from resources within a network. The system identifies, from the notification, a version value associated with the agent. The system determines, from the version value, a set of operations to be assigned to the agent that will be compatible with that agent, and assigns a subset of the set of operations to the agent to enable that agent to collect data from resources in the network.

Abstract: In a storage area network, agents provide transactions of data sets containing updates to manageable entities in a SAN. A SAN server avoids intermittent dissemination of events pertaining to a single transaction by storing events in a cache until completion of all subtransactions in the transaction, and then disseminating all events pertaining to the transaction. Transactions are broken down into update sections, each containing one or more subtransactions collectively defining the entire transaction. Update sections corresponding to the transaction are tagged with a section ID. Events indicating completion of processing of the update section are identified by the section ID, and suppressed temporarily by storing them in the event cache pending completion of the transaction. Other events not matching a tagged section ID are allowed to disseminate. Upon completion of the transaction, events for all section IDs corresponding to the transaction are disseminated from the cache.

Abstract: A method, apparatus and computer program product for handling secure information (e.g., a password, an account number, a personal identification number (PIN), a user identifier, an encryption key, and a path where said secure information is stored) is presented. Secure information is stored in a software container. A plurality of representations of the secure information is provided, each of the plurality of representations for use under different conditions. Dependent on the particular condition, at least one of the plurality of representations of the secure information is provided by the container. The container holds the secure information during all stages of processing in a manner that prevents unauthorized parties from gaining access to the secret in clear form.

Abstract: Storage Area Network (storage area network) management employs agents, each under the control of a common server. Determination and assignment of available agents to candidate manageable entities suffers from several deficiencies. Distributed access control information may be security sensitive. Distribution of the access data across the local storage at the manageable entities is cumbersome to track and manage. Embodiments of the invention provide assignment of agents to manageable entities from a central repository, therefore avoiding distributed sensitive information. Depending upon the type of managed entity the agent is adapted to manage, the server retrieves access data from the repository, rather than from a local initialization (.ini) file. Each agent determines which storage elements it can manage. The server correlates the information sent by each agent for each configured managed entity to generate a management correlation.

Abstract: Methods and apparatus operate in a computer system to manage initiation and operation of plug-in modules providing plug-in services. The plug-in manager obtains identities of a plurality of plug-in modules and retrieves a dependency list indicating respective plug-in services provided by, and required by, each plug-in module identified in the identities of the plug-in modules. The plug-in manager then calculates a plug-in initiation order based upon the dependency list indicating respective plug-in services provided by, and required by, each plug-in module. The plug-in manager then initiates service operation of plug-in modules according to the plug-in initiation order, such that if a first plug-in module provides a service required by a second plug-in module, the first plug-in module is initiated such that the service provided by the first plug-in module is available to the second plug-in module when required by the second plug-in module.