Symantec Corporation

Veritas Technologies LLC

Bruce Robert Montague

Matthew Conover

Viswesvaran Janakiraman

Sanjay Sawhney

Petros Efstathopoulos

Gaurav Makin

Tzi-cker Chiueh

Rajeev Bharadhwaj

Komal Desai

Dharmesh Shah

Kody Kantor

John Kjell

Martim Carbone

Douglas Fallstrom

Jonathan Purcell

Kevin Butler

The disclosed computer-implemented method for rerouting data sent between application containers and storage containers may include (1) identifying an application container, a storage container that stores data for the application container, and a host that hosts both the application container and the storage container, (2) configuring the application container and the storage container to share a namespace on the host, (3) creating, within the shared namespace on the host, a resource that enables the application container and the storage container to share data, and (4) rerouting at least one item of data sent between the application container and the storage container to pass through the resource in the shared namespace rather than through a kernel of the host. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for rerouting data sent between application containers and storage containers

A method and apparatus for injecting function calls into a virtual machine whereby a Function Call Injection (FCI) process is employed, through which a Secure Virtual Machine (SVM) is used to trigger desired function call invocations inside a Guest Virtual Machine (GVM) by externally manipulating the GVMs memory and CPU register contents using a security API. Once the triggered function is executed, control is then returned at the originating SVM invocation point. Therefore, the GVM state is manipulated to externally inject function calls, making it possible to create control appliances which do not require an in-GVM agent.

Method and system for injecting function calls into a virtual machine

A computer-implemented method for providing network access control in virtual environments. The method may include: 1) injecting a transient security agent into a virtual machine that is running on a host machine; 2) receiving, from the transient security agent, an indication of whether the virtual machine complies with one or more network access control policies; and 3) controlling network access of the virtual machine based on the indication of whether the virtual machine complies with the one or more network access control policies. Various other methods, systems, and computer-readable media are also disclosed herein.

Systems and methods for providing network access control in virtual environments

A host validation system runs on a portable storage device, and protects data stored thereon from unauthorized access by host computers. The system identifies a host to which the portable device is coupled, for example by using the host's TPM. This can further comprise identifying the host's current configuration. The system uses the identification and configuration information to verify whether the host is approved to access data stored on the portable device. The system provides the host a level of data access responsive to this verification. This can involve denying all data access to the host, or providing at least some access to data stored on the portable device, for example based on a stored access policy specifying levels of access to provide to specific hosts with specific configurations.

Host validation mechanism for preserving integrity of portable storage data

A system and method for efficient security protocols in a virtualized datacenter environment are contemplated. In one embodiment, a system is provided comprising a hypervisor coupled to one or more protected virtual machines (VMs) and a security VM. Within a private communication channel, a split kernel loader provides an end-to-end communication between a paravirtualized security device driver, or symbiont, and the security VM. The symbiont monitors kernel-level activities of a corresponding guest OS, and conveys kernel-level metadata to the security VM via the private communication channel. Therefore, the well-known semantic gap problem is solved. The security VM is able to read all of the memory of a protected VM, detect locations of memory compromised by a malicious rootkit, and remediate any detected problems.

Security driver for hypervisors and operating systems of virtualized datacenters

A system and method for implementing data deduplication-aware copying of data are provided. In response to a request to copy a source file between a source filesystem and a destination filesystem, file mapping information corresponding to the source file is retrieved. The file mapping information is stored in a source filesystem map. The source filesystem accesses a source logical volume. The source logical volume maps to a deduplication storage area. The destination filesystem accesses a destination logical volume. The destination logical volume maps to the deduplication storage area. The source file comprises data stored in the deduplication storage area. A destination file is allocated, based on the file mapping information, in the destination filesystem. The destination file is mapped to the data stored in the data deduplication storage area.

System and method for implementing data deduplication-aware copying of data

A system and method for efficiently locating and processing data on a deduplication storage system are provided. A logical volume is mapped to a deduplication storage area. The logical volume includes a collection of logical block locations and the deduplication storage area includes a collection of physical block locations. The collection of logical block locations is mapped to the collection of physical block locations. A filesystem organizes the logical volume by organizing the logical block locations into a collection of files. Reverse-mapping information is generated for a logical block location that associates the logical block location with at least one file. In response to receiving a logical block address of a logical block location, at least one file is returned.

System and method for efficiently locating and processing data on a deduplication storage system

Techniques for allocating/reducing storage required for one or more virtual machines are disclosed. In one particular exemplary embodiment, the techniques may be realized as a method for allocating storage for one or more virtual machines. The method may comprise providing one or more virtual machines. The method may also comprise creating one or more master images containing one or more commonly used blocks. The method may also comprise creating one or more Copy on Write volumes, where each Copy on Write volume may be associated with at least one of the one or more virtual machines and at least one of the one or more master images, and wherein updated blocks may be stored in at least one of the one or more Copy on Write volumes, thereby reducing storage required for one or more virtual machines.

Growing community of inventors

Santa Cruz, CA, United States of America

Bruce Robert Montague