Microsoft Technology Licensing, LLC

Emanuel Paleologu

Karan Mehra

David Abzarian

Yun Lin

Surendra Verma

Eran Yariv

Vinod R Shankar

Darren Glen Moss

Gerardo Diaz Cuellar

Narasimha Rao S S Nagampalli

Sachin C Sheth

Maxim A Ivanov

Shirish Koti

Eric Erwin Youngblut

Neal Robert Christiansen

Shiv Kumar Rajpal

Amit A Sehgal

Nandagopal Kirubanandan

Taylor Alan Hope

Michael R Surkan

Salahuddin C J Khan

Ian M Carbaugh

Erik G Hortsch

Shiv K Rajpal

Data is identified that defines a known good state for a current operating system. The identified data includes read-only sets that are not updated during operation of the computing device, and modifiable sets that can be updated during operation of the computing device. The read-only sets are captured on an opportunistic basis and the modifiable sets are captured when the computing device is to be rebooted. A first and second virtual disk are allocated as snapshots of the identified data. The first virtual disk is updated to generate an updated state. The updates to the first virtual disk are isolated from the second virtual disk. The second virtual disk is maintained as an immutable snapshot of the identified data. In response to a failed reboot with the updated state, the computing device reverts to the known good state using the snapshot of the identified data.

Space snapshots

Virtual storage free space management techniques may calculate a data allocation value of a virtual storage entity based on a number of storage slabs allocated with data. The virtual storage free space management techniques may further analyze a physical storage entity to determine a storage allocation value associated with the physical storage entity. The storage allocation value may be obtained by summing the storage amount in bytes associated with each of the storage slabs of the physical storage entity that is allocated to one or more virtual storage entities. A free space value associated with the virtual storage entity may be determined based on the storage allocation value and the data allocation value.

Virtual storage free space management

The techniques disclosed herein provide a dynamically configurable cluster of storage devices. In some configurations, the dynamically configurable cluster is associated with a fault domain. The cluster may include a plurality of computing devices that each include at least a storage device. The plurality of storage devices in the cluster may be configured to support a plurality of workloads coupled to the dynamically configurable cluster. The plurality of storage devices in the dynamically configurable cluster may be allocated to one or more of the plurality of workloads based on metadata identified resiliency requirements, performance requirements, and/or cost factors linked to the one or more of the plurality of workloads.

Dynamically configurable storage clusters

Embodiments are directed to modifying storage capacity within a data store and to modifying resiliency for a data store. In one scenario, a computer system receives a request to move data. The computer system may determine that data is to be moved from an allocation on one data store to a new allocation on another data store. The computer system may create a new allocation on the other data store, where the new allocation is configured to receive data from the first data store. The computer system then moves the data to the new allocation on the second data store as data I/O requests are received at the first data store. Data store access requests are synchronized with the data movement by directing the data store access requests to the first data store, to the second data store or to both data stores depending on the type of access request.

Migrating data in response to changes in hardware or workloads at a data store

Techniques for recovery and redistribution of data from a virtual disk storage system are described herein. In one or more implementations, a storage scheme derived for a virtual disk configuration is configured to implement various recovery and redistribution designed to improve recovery performance. The storage scheme implements one or more allocation techniques to produce substantially uniform or nearly uniform distributions of data across physical storage devices associated with a virtual disk. The allocation facilitates concurrent regeneration and rebalancing operations for recovery of data in the event of failures. Additionally, the storage scheme is configured to implements parallelization techniques to perform the concurrent operations including but not limited to controlling multiple parallel read/writes during recovery.

Virtual disk recovery and redistribution

A set of storage devices may interoperate to share a pool of storage space, such as in a Redundant Array of Inexpensive Disks (RAID) scheme. However, the details of the representation of the pool and the allocation of capacity to the pool may enable advantages and/or impose limitations on the storage set. Presented herein are techniques for generating a representing a pooled partition on one or more storage devices featuring a pool configuration representing the pool as a set of spaces manifested by the pool; a set of storage devices sharing the pool; and a set of extents that map physical areas of the storage devices to logical areas of the spaces. The flexibility of these pooling techniques may enable such features as flexible capacity allocation, delayed binding, thin provisioning, and the participation of a storage device in two or more distinct pools shared with different sets of storage devices.

Pooled partition layout and representation

A storage set (e.g., an array of hard disk drives) may experience a failure, such as a loss of power, a software crash, or a disconnection of a storage device, while writes to the storage set are in progress. Recover from the failure may involve scanning the storage set to detect and correct inconsistencies (e.g., comparing mirrors of a data set or testing checksums). However, lacking information about the locations of pending writes to the storage set during the failure, this 'cleaning' process may involve scanning the entire storage set, resulting in protracted recovery processes. Presented herein are techniques for tracking writes to the storage set by apportioning the storage set into regions of a region size (e.g., one gigabyte), and storing on the nonvolatile storage medium descriptors of 'dirty' regions comprising in-progress writes. The post-failure recovery process may then be limited to the regions identified as dirty.

Nonvolatile media dirty region tracking

A storage device set may allocate capacity for spaces (e.g., logical volumes) according to an allocation strategy, e.g., allocating capacity from the storage device having the greatest available capacity, or maximizing the distribution of allocated capacity across the storage devices. However, such allocation strategies may be inefficient (e.g., limiting the capability of the storage device set to satisfy subsequent requests with constraints such as a minimum distribution of capacity across several storage devices). The techniques presented herein achieve efficient allocation by first allocating capacity on storage devices having ample available capacity using a round-robin technique, and if such storage devices do not satisfy the capacity request, allocating capacity on storage devices having limited available capacity. Additionally, the techniques presented herein facilitate thin provisioning through capacity reservations, wherein storage devices withhold unallocated storage for particular spaces that may be utilized as a reserve if unreserved capacity is exhausted.

Allocation strategies for storage device sets

A host firewall can determine and consider whether unsolicited traffic is inbound from beyond the edge of the network and allow or block such traffic based at least in part upon this characteristic. In one implementation, an edge traversal parameter can be set on a host firewall rule, which typically includes other parameters such as port, protocol, etc. If the unsolicited traffic received via an edge traversal interface matches a host firewall rule that has the edge traversal criterion, then the firewall does not block the traffic. On the other hand, if the unsolicited traffic received via an edge traversal interface fails to satisfy the edge traversal criterion on any firewall rule, then the firewall blocks the traffic.

Host firewall integration with edge traversal technology

Embodiments of the invention are directed to a firewall installer that receives a set of configuration instructions for configuring a firewall in a declarative format that describes one or more rules to be implemented by the firewall, and that automatically configures the firewall. Providing a firewall installer that is capable of configuring a firewall based upon declarative input rather than procedural process-oriented input facilitates administration of a firewall by allowing an administrator to specify desired firewall configuration at a higher, declarative level and frees the administrator from the need to specify procedures for implementing configuration changes in the firewall. In one embodiment of the invention, the firewall installer can receive and store input for configuring a firewall even when the firewall is not running, such that the firewall executes on those configuration changes when it next comes online.

Firewall installer

A method and system for distributing and enforcing security policies is provided. A firewall agent executing at a host computer system that is to be protected receives security policies for the enforcement engines responsible for enforcing the security policies on the host computer system. A security policy has rules that each provide a condition and action to be performed when the condition is satisfied. A rule also has a rule type that is used by the distribution system to identify the security components that are responsible for enforcing the rules. To distribute the security policies that have been received at a host computer system, the firewall agent identifies to which enforcement engine a rule applies based in part on rule type. The firewall agent then distributes the rule to the identified enforcement engine, which then enforces the rule.

Growing community of inventors

Kirkland, WA, United States of America

Emanuel Paleologu