Microsoft Technology Licensing, LLC

Google Inc.

Grigory Borisovich Lyakhovitskiy

Apurva Ashwin Doshi

Karan Mehra

Bohdan W Raciborski

Sarosh Cyrus Havewala

Octavian Tony Ureche

Innokentiy Basmov

Juan-Lee Pang

Branton Nicolas Boehm

David Abzarian

Vinod R Shankar

Darren Glen Moss

Michael H Tsang

Justin Sing Tong Cheung

Olivier Deiss

Stefen Thom

Dan Kimmel

A method for garbage-collection includes obtaining a request to compact a plurality of log files of a log-structured volume. Each log file includes fresh block runs in use and stale block runs no longer in use. The log-structured volume includes a plurality of snapshots. For each respective snapshot, the method includes determining, using a plurality of interval maps, the fresh block runs of the plurality of log files used by the respective snapshot. For each respective log file, the method includes writing the fresh block runs of the respective log file to a respective compacted log file and generating a respective per-log diff file. The method includes, for each respective snapshot, generating a respective checkpoint based on respective per-log diff files and deleting each respective log file of the plurality of log files.

Garbage-collection in log-based block devices with snapshots

A first storage node configured to store data associated with a user is allocated. The data stored on the first storage node is mirrored at a second storage node. A resiliency mechanism is implemented at the first and second storage nodes. The resiliency mechanism is configured to restore data on at least one of the storage devices of the first and second storage nodes. In response to a loss of availability of either the first or second storage node and a loss of availability of one or more storage device on an available storage node, data on the unavailable storage devices of the available storage node is recovered using the resiliency mechanism of the available storage node.

Multilevel resiliency

Aspects of the subject matter described herein relate to backups and change journals. In aspects, a change journal is read to determine changes that have occurred to objects of a file system. From these changes a data structure is created to capture path information and collect changes for each object. Where the data structure is insufficient to identify a complete path, the live file system is consulted. After the data structure is complete, a data protection engine uses the data structure to update a catalog at least to provide the capability to view the namespace of the protected objects at one or more times covered by the catalog.

File system backup using change journal

Some implementations may include a virtual storage system to which data is written. The virtual storage system may include a cache and multiple hard drives. Multiple queues may be associated with the multiple hard drives such that each hard drive of the multiple hard drives has a corresponding queue of the multiple queues. A set of candidate rows may be selected from the cache. For each candidate row in the set of candidate rows, destination hard drives may be identified. Each candidate row may be placed in queues corresponding to the destination hard drives. Two or more candidate rows from the multiple queues may be written substantially contemporaneously (e.g., in parallel) to two or more destination hard drives.

Cache destaging for virtual storage devices

Aspects of the subject matter described herein relate to adaptive retention for backup data. In aspects, space may be needed on a backup storage in order to store additional backup data. In response, an indication that space is needed provided to a retention manager. The retention manager attempts to prune data on the backup storage to free up space on the backup storage. Before deleting a version on the backup storage, the retention manager determines whether deletion conditions are met. The retention manager may apply one or more retention policies in its efforts to free space. The retention manager may manage and free the space such that versions of files already stored are preserved for the longest possible time.

Adaptive retention for backup data

The re-encryption of data can be performed with independent cryptographic agents that can automatically encrypt and decrypt data in accordance with cryptographic regions, such that data within a single cryptographic region is encrypted and decrypted with the same cryptographic key. An 'in-place' re-encryption can be performed by reading data from a chunk in an existing cryptographic region, shrinking the existing cryptographic region past the chunk, expanding a replacement cryptographic region over the chunk, and then writing the data back to the same location, which is now part of the replacement cryptographic region. An 'out-of-place' re-encryption can be performed by reading data from a chunk in an existing cryptographic region and then writing the data back to a location immediately adjacent that is part of a replacement cryptographic region. After the re-encrypted data is &#x201c;shifted&#x201d;, the cryptographic regions can be expanded and contracted appropriately, and another chunk can be selected.

Data encryption conversion for independent agents

A self-encrypting drive allows finely grained control, i.e., the ability to create, protect, lock and unlock, of different volumes on the same drive. The different volumes enable multiple different operating systems to be booted, depending on the volume that is selected for booting.

Managing self-encrypting drives in decentralized environments

Aspects of the subject matter described herein relate to data protection. In aspects, during a backup cycle, backup copies may be created for files that are new or that have changed since the last backup. If external backup storage is not available, the backup copies may be stored in a cache located on the primary storage. If backup storage is available, the backup copies may be stored in the backup storage device and backup copies that were previously stored in the primary storage may be copied to the backup storage. The availability of the backup storage may be detected and used to seamlessly switch between backing up files locally and remotely as availability of the backup storage changes.

Protecting data during different connectivity states

Cryptographic keys and, subsequently, the data they are intended to protect, are safeguarded from unwarranted attacks utilizing various systems and methodologies designed to minimize the time period in which meaningful versions of cryptographic keys exist in accessible memory, and therefore, are vulnerable. Cryptographic keys, and consequently the data they are intended to protect, can alternatively, or also, be protected from attackers utilizing systems and a methodology that employs a removable storage device for providing authentication factors used in the encryption and decryption processing. Cryptographic keys and protected data can alternatively, or also, be protected with a system and methodology that supports data separation on the storage device(s) of a computing device. Cryptographic keys and the data they are intended to protect can alternatively, or also, be protected employing a system and methodology of virtual compartmentalization that effectively segregates key management from protected data.

Cryptographic key attack mitigation

Security device objects can be utilized to support a stack of components of computer-executable instructions that are directed to managing the security functionality represented by the security device object. In the case of hardware encrypting storage devices, a security device object can represent the self-encrypting capabilities of those devices and the attendant stack can comprise drivers directed to band and key management. A default band management driver can support a band-centric set of input/output controls that can be redirected to the band management driver. It can cache band authentication keys or provide callback mechanisms for key providers to register themselves to provide keys on-demand. Key provider identifiers can be stored on the storage device and utilized to dynamically load, install or upgrade key providers when the band authentication key is required. The band management driver can also prevent the powering-down of the storage device in an unlocked state.

Extensible management of self-encrypting storage devices

An embodiment of a method includes determining a file size of each of multiple files to be included in a file system image. For each file having a file size less than a lower file size threshold of the storage device currently storing the file, the file is stashed in an alternate storage device having a throughput greater than a throughput of the current storage device. In an example embodiment, files that have sizes within a size range greater than the lower file size threshold are randomly selected for stashing in an alternate storage device. A system includes a file system image generator configured to selectively stash files based on file sizes and a lower file size threshold.

Growing community of inventors

Bothell, WA, United States of America

Grigory Borisovich Lyakhovitskiy