Emc IP Holding Company LLC

Emc Corporation

Sirf Technology Holdings, Inc.

Hongyu Zhang

Subhasish Chakraborty

Terry Gene Hahn

Ravi V Chitloor

Chi-Shin Wang

Zhike Jia

Uday Jonnala

Thomas Alan Bean

Lianxue Xiong

Catherine E Agbaw

David Alexander Darling

Xiaoyin Hu

Manish Chhabra

Shruthi Herale

Rodney Edward Radford

A data storage device includes advertised internet protocol (IP) addresses, a logical data storage, and a resource request processor. The logical data storage includes an object storage. The resource request processor obtains a data access request that includes a destination IP address and that requests a portion of data stored in the object storage. The resource request processor makes a determination to allow access to the portion of the data based on a multifactor authorization. The multifactor authorization is based, at least in part, on an association between the destination IP address and the portion of the data. In response to the determination, resource request processor provides the portion of the data to a requestor specified in the data access request.

System and method for local data IP based network security for preventing data breach attempts in a multi-tenant protection storage deployment

In one embodiment, a request is received from a remote device of a user for configuring a tenant-unit of a storage system via a secure connection session. A secure multi-tenancy (SMT) module determines a first network identity associated with the secure connection session. The SMT module examines an SMT registry namespace associated with the tenant-unit of the tenant to determine a second network identity that has been assigned to the tenant-unit. The first network identity is compared with the second network identity. The request is allowed to configure the tenant-unit in response to determining that the first and second network identities match; otherwise, the request is denied.

System and method for tenant network identity-based authentication and authorization for administrative access in a protection storage system

A first request is received from a first user to access a first file system management objects (FSMOs) of a first tenant unit (TU), the first TU being one of a plurality of TUs. The first FSMO is one of a plurality of FSMOs, each FSMO containing namespace information of a particular tenant. In response to the first request, it is determined whether the first user is authorized to access the first FSMO, including identifying TUs that are associated with the first user, determining whether the first TU is included in the TUs, and if so, determining whether the first FSMO is included in FSMOs associated with the first TU. In response to determining that the first FSMO is included in a set of one or more FSMOs that are associated with the first TU, the first user to access the first FSMO is allowed.

System and method for secure multi-tenancy in datadomain operating system (DDOS), a purpose built backup appliance (PBBA) operating system

A data storage device includes egress ports, a logical data storage, and a packet processor. The local data storage includes resources allocated to multiple tenants. The packet processor obtains packets that include data stored in the resources of the logical data storage. The obtained packets are addressed to a packet destination. The packet processor selects an egress port of the egress ports based on mappings between the data and the multiple tenants. The packet processor sends the packets via the selected egress port.

System and method for physical data packets isolation for different tenants in a multi-tenant protection storage environment

A request is received from a client device of a user for configuring a tenant of a multi-tenant storage system, the multi-tenant storage system storing data for different tenants. An entity identifier (ID) identifying an entity to be associated exclusively with the tenant is obtained from the request. A lookup operation is performed based on the entity in an SMT registry namespace cache stored in a memory to locate an entry that matches the entity. If no matching entry is found, the request is allowed. If a matching entry is found, a first tenant ID obtained from the request is compared with a second tenant ID stored in the matching entry. The request to configure the tenant is allowed if the first tenant ID matches the second tenant ID. The request is denied if the first tenant ID does not match the second tenant ID.

System and method for ensuring per tenant mutual exclusion of data and administrative entities with low latency and high scale

According to one embodiment, a request is received from a remote device of a user for performing a data management operation from source data represented by a source data management object (DMO) to destination data represented by a destination DMO. A first security mode associated with a source tenant-unit corresponding to the source DMO and a second security mode associated with a destination tenant-unit corresponding to the destination DMO are determined. It is determined whether the user is a system administrator for a storage system corresponding to the source data or the destination data, and whether the user is a tenant administrator for a tenant associated with the source data or the destination data. It is determined whether the data management operation should be allowed based on the first and second security modes.

System and method for security mode-based authorization for data management operations in a multi-tenant protection storage system

Exemplary methods for providing secure multi-tenancy in a Purpose Built Backup Appliance include creating a set of tenant-units (TUs), associating file system management objects (FSMOs) and users with the TUs. The methods further include maintaining a protocol config-metadata store based on the association of the FSMOs and users with the TUs. In one embodiment, in response to a first request from a first user to access a first FSMO of a first TU, the methods include determining whether the first user is authorized to access the first FSMO based on information of the protocol config-metadata store, and in response to the protocol config-metadata store indicating the first user is authorized to access the first FSMO, allowing the first user to access the first FSMO.

System and method for secure multi-tenancy in an operating system of a storage system

A native protection storage operating system (PSOS) process receives a request specifying an operation having security related implications for elements in the PSOS having a first set of components handling data transfer operations and a second set of components handling configuration operations. A security component stores an identifier of the requester and a security related information element locally within a storage location of the first or second set of components, and accesses, upon receiving the request, the security related information element and requester identifier to match other elements of the network impacted by the request, and performs a security condition specific check to determine whether or not the request is to be allowed or denied. The native process eliminates a need for caching, locking, and chain propagation of the security related information through the PSOS.

Cache-free and lock-free handling of security information for multiple distributed objects in protection storage systems

Provided herein is multi-function platform comprising a plurality of devices and a large memory that is external to the devices and shared among the devices. In an embodiment, a Direct Memory Access (DMA) controller is provided for each device to efficiently transfer data between the device and the shared memory. More than one DMA may be provided for a device. For example, separate DMAs may be provided for different components of a device that perform different subfunctions enabling efficient transfer of data between the different components of the device and the shared memory. In another embodiment, each device comprises a local embedded memory and is provided with a DMA for transferring data between the local memory and the shared memory. Examples of devices that can be included in the platform include a GNSS receiver, a audio player, a video player, a wireless communication device, a routing device, or the like.

High sensitivity global navigation satellite system (GNSS) receiver platform having DMA controller for transferring between internal and external memory

Growing community of inventors

San Jose, CA, United States of America

Hongyu Zhang