Pure Storage, Inc.

Moka5, Inc.

Cisco Technology, Inc.

Leland Stanford Junior University

Constantine P Sapuntzakis

Ronald S Karr

John Colgrove

Kiron Vijayasankar

Yuval Frandzel

Timothy W Brennan

Monica Sin-Ling Lam

Naveen Neelakantam

Ethan L Miller

Neil A Vachharajani

Marco Sanvido

Joshua Freilich

Aswin Karumbunathan

Sergey Zhuravlev

Daquan Zuo

Jimmy T Hu

Terence W Noonan

John Whaley

Benjamin P Borowiec

Alexandre Xavier Duchateau

Ramesh U V Chandra

Won-Suk Chun

Alexandre Xavier Duchâteau

Andrew R Bernat

Michael Kerby Chen

Farhan Abrol

Kelvin Kam-Suen Yue

David R Cheriton

Peter E Kirkpatrick

Feng Wang

Cary A Sandvig

Igor Ostrovsky

Mark L McAuliffe

Andrew D Berkheimer

James Eugene Chow

David James Brumley

Mendel Rosenblum

Nickolai Borisovich Zeldovich

Par Botes

Daniel Christian Biederman

Matthew Paul Fay

Dan Boneh

Neil Buda Vachharajani

Martin Conway Rinard

Krishna Kant

Yanwei Jiang

Brandon Davis

Mark McAULIFFE

Jeffrey P Chou

Malathy Sethuraman

Alexandre Duchâteau

Vivian W Chiang

Nathan David Parrish

Guy Messalem

Ramesh Chandra

Kelvin Yue

Prakash Linga

Robert A Iannucci, Jr

Phanindra V R Ganti

Burt A Toma

Gautam Kachroo

Wen-Suk Chun

Providing authorization and authentication in a cloud for a user of a storage array includes: receiving, by a storage array access module from a client-side array services module, a token representing authentication of user credentials and authorized access privileges defining one or more storage array services accessible by the user, where the token is generated by a cloud-based security module upon authentication of the user credentials and identification of authorized access privileges for the user; receiving, by the storage array access module from the user, a user access request to one or more storage array services; and determining, by the storage array access module, whether to grant the user access request in dependence upon the authorized access privileges represented by the token.

Multi-array user authorization for cloud-based storage systems

Creating a replica of a storage system, including: receiving, by a first storage system from a computing device, data to be stored on the first storage system; reducing, by the first storage system, the data using one or more data reduction techniques; sending, from the first storage system to the second storage system, the reduced data, wherein the reduced data is encrypted; and sending, from the second storage system to a third storage system, the reduced data, wherein the reduced data is encrypted.

Maintaining encryption during storage system replication

Staging data on a storage element integrating fast durable storage and bulk durable storage, including: receiving, at a storage element integrating fast durable storage and bulk durable storage, a data storage operation from a host computer; storing data corresponding to the data storage operation within fast durable storage in accordance with a first data resiliency technique; and responsive to detecting a condition for transferring data between fast durable storage and bulk durable storage, transferring the data from fast durable storage to bulk durable storage in accordance with a second data resiliency technique.

Tiering valid data after a disaster recovery operation

A method of volume compressed header identification includes reading, by a processing device of a host, compressible data on a sector of a storage volume of a storage array. The method further includes compressing the compressible data to generate compressed data for the sector. The method further includes adding, by the processing device of the host, metadata associated with the storage volume to the compressed data. The method further includes writing the compressed data, including the added metadata, to the sector of the storage volume of the storage array.

Optimizing I/O operations for compressed data

Performing partial redundant array of independent disks (RAID) stripe parity calculations, including: receiving a last portion of a RAID stripe among multiple portions of the RAID stripe, all portions for a successful write of the RAID stripe being previously received except for the last portion; calculating a parity value based on the last portion of the RAID stripe and a previous parity value without calculating the parity value using a previous portion of the RAID stripe; and writing of the RAID stripe.

Efficient redundant array of independent disks (RAID) stripe parity calculations

Utilizing multiple redundancy schemes within a unified storage element, including: receiving, in a storage system at a unified storage element that integrates both fast durable storage and bulk durable storage, a data storage operation from a host computer; storing, in accordance with a first data resiliency technique that corresponds to a RAID N+R format, data corresponding to the data storage operation within the fast durable storage of the unified storage element; and responsive to determining that the complete RAID stripe has been written to the fast durable storage, moving a portion of the stored data from the fast durable storage to the bulk durable storage of the unified storage element, the bulk durable storage storing the data in accordance with a second data resiliency technique that corresponds to a RAID M+R format, wherein M is different from N.

Maintaining multiple redundancy schemes across different storage types

Synchronously replicating a dataset across cloud-based storage systems, including adding a cloud-based storage system to a set of storage systems that the dataset is synchronously replicated across, where access operations are applied to the dataset equivalently through all storage systems in the set, all storage systems in the set store a separate copy of the dataset, and operations to modify the dataset performed and completed through any of the storage systems in the set are reflected in access operations to read the dataset, the cloud-based storage system including one or more cloud computing instances executing a storage controller application, a virtual drive layer that includes one or more cloud computing instances with local storage for storing at least a portion of the dataset as block data, and an object storage layer for storing at least a portion of the dataset as object data.

Replication utilizing cloud-based storage systems

A system with storage memory and a processing device has a logical deletion to physical erasure time bound. The system dereferences data, responsive to a direction to delete the data. The system monitors physical blocks in storage memory for live data and the dereferenced data. The system cooperates garbage collection with monitoring the physical blocks, so that at least a physical block having the dereferenced data is garbage collected and erased within a logical deletion to physical erasure time bound.

Guaranteeing physical deletion of data in a storage system

Servicing I/O operations in a cloud-based storage system, including: receiving, by the cloud-based storage system, a request to write data to the cloud-based storage system; storing, in solid-state storage of the cloud-based storage system, the data; storing, in object storage of the cloud-based storage system, the data; detecting that at least some portion of the solid-state storage of the cloud-based storage system has become unavailable; identifying data that was stored in the portion of the solid-state storage of the cloud-based storage system that has become unavailable; retrieving, from object storage of the cloud-based storage system, the data that was stored in the portion of the solid-state storage of the cloud-based storage system that has become unavailable; and storing, in solid-state storage of the cloud-based storage system, the retrieved data.

Metadata-based recovery of a dataset

A method of decommissioning a key in a decryption storage system includes scanning a storage system to identify metadata associated with a current key to be decommissioned. The method further includes encrypting, with the current key, data corresponding to the metadata to generate encrypted data. The method further includes decrypting the encrypted data with a target key to generate decrypted data. The method further includes modifying, by a processing device, the metadata to identify the target key to generate modified metadata. The method further includes storing the decrypted data and the modified metadata to the storage system.

Decommissioning keys in a decryption storage system

A method of data reduction in a partially encrypted volume includes receiving data to be stored on a storage array, decrypting the data using a first encryption key to generate first decrypted data, and decrypting the data using a second encryption key to generate second decrypted data. The method further includes comparing, by a storage array controller, a first compressibility value of the first decrypted data to a second compressibility value of the second decrypted data. The method further includes storing the first decrypted data if the first compressibility value is greater than or equal to the second compressibility value. The method further includes storing the second decrypted data if the second compressibility value is greater than the first compressibility value.

Optimizing data reduction for data in encrypted volumes

A storage system includes solid-state storage devices and a storage controller operatively coupled to the solid-state storage devices, the storage controller including a processing device, to store sets of data at one or more solid-state storage devices of the plurality of solid-state storage devices. The processing device may also generate tags for each of the sets of data based on one or more metadata items associated with each set of data. The processing device may also determine an expected lifespan for each set of data based on the one or more tags generated for the respective set of data. The processing device may also group each of the one or more sets of data into respective ones of a plurality of memory blocks based on the expected lifespan for each set of data, wherein each memory block corresponds to sets of data of a particular expected lifespan.

Intelligent grouping of data based on expected lifespan

Replicating data using inferred trust, including: receiving, by a first storage system from a computing device, data encrypted using a first encryption key; decrypting, by the first storage system, the encrypted data using the first encryption key; encrypting, by the first storage system, the decrypted data using a second encryption key; storing, on the first storage system, the data encrypted using the second encryption key; sending, from the first storage system to the second storage system, the data; and servicing, by the second storage system, an input/output ('I/O') operation directed to the data.

Replicating data to a storage system that has an inferred trust relationship with a client

Protecting an encryption key for data stored in a storage system that includes a plurality of storage devices, including: reading, from at least a majority of the storage devices, a portion of an apartment key; reconstructing the apartment key using the portions of the apartment key read by the majority of the storage devices; unlocking the main portion of each of the storage devices utilizing the apartment key; reading, from the main portion of one of the storage devices, a portion of a third-party resource access key; requesting, from the third-party resource utilizing the third-party resource access key, an encryption key; receiving, from the third-party resource, the encryption key; and decrypting the data stored on the storage devices utilizing the encryption key.

Unlocking data stored in a group of storage systems

Securely encrypting data using a remote key management service, including: transmitting a local secret to a key management service; transforming an encryption key received from the key management service to generate a key-encrypting key, wherein the encryption key is a one-way cryptographic hash using, as input, the local secret transmitted to the key management service; and decrypting, based on the key-encrypting key, a local data encryption key for encrypting or decrypting local data.

Securely encrypting data using a remote key management service

Growing community of inventors

Palo Alto, CA, United States of America

Constantine P Sapuntzakis