Netapp, Inc.

Hristo Bojinov

Serge Plotkin

Ananthan Subramanian

Hiroshi Ishii

Robert Paul Wood

Yuval Frandzel

Andrew Narver

Zi-Bin Yang

Kevin Brown

A network storage server receives multiple write requests from a set of clients via a network and internally buffers multiple data blocks written by the write requests. At a consistency point, the storage server commits the data blocks to a nonvolatile mass storage facility. The consistency point process includes using a storage operating system in the network storage server to compress the data blocks, encrypt selected data blocks, and store the compressed and (possibly) encrypted data blocks in the nonvolatile mass storage facility. Data blocks can also be fingerprinted in parallel with compression and/or encryption, to facilitate subsequent deduplication. Data blocks can be indexed and classified according to content or attributes of the data. Encryption can be applied at different levels of logical container granularity, where a separate, unique cryptographic key is used for each encrypted data container.

Network storage server with integrated encryption, compression and deduplication capability

A system and method for securing data by receiving encrypted data at a security appliance transmitted from a client, wherein at least a portion of the encrypted data is encrypted according to a first encryption protocol, and wherein the encrypted data is transmitted to the security appliance according to a first data transfer protocol. The encrypted data is then decrypted at the security appliance, wherein at least a portion of the decrypted data is re-encrypted according to a second encryption protocol at the security appliance. The re-encrypted data is transmitted from the security appliance to a storage device, wherein the re-encrypted data is transmitted according to a second data transfer protocol that is different than the first data transfer protocol.

Protocol translation

Apparatus and method for synchronizing encryption keys among a cluster of security appliances and stand alone lifetime key management, LKM, appliances. The cluster includes security appliances where new encryption keys are generated and assigned to an SNS ID with an SNS CTR (counter). The security appliances inside a cluster have local sequence counters and share their keys. One security appliance is a coordinator with which the LKMs will synchronize. Each LKM also has a SNS ID and local sequence counter from which increasing sequence numbers are generated. In each security appliance in a cluster, the up-to-date stored sets of keys are organized with respect to SNS IDs and SNS CTRs associated with the other cluster members. The object keys are stored in the SNS space and a peer map associates a given peer with a given SNS ID, and version numbers are assigned and incremented when a key is modified.

Cluster key synchronization

Apparatus and method for synchronizing objects, e, g., encryption key objects, between pairs of appliances, particularly lifetime key management (LKM) appliances. Each LKM has a local sequence counter where increasing sequence numbers are generated and applied to objects. A peer counter is used to indicate the sequence number of an object synchronized from a peer appliance. When two appliances are synchronized, only those new objects with sequence numbers at least equal to or higher than that within the other appliance are transferred. When synchronized to each other, each appliance will have an up-to-date stored set of objects for all of the appliances in the group. Each object has a unique identification number that are compared to eliminate duplicate objects. During synchronization, if unique identification numbers match between a newly received object and a previously stored key, version numbers may be used to determine which object the receiving appliance should store.

Peer to peer key synchronization

In one embodiment, progress of an encryption process may be tracked. This may comprise, for example, storing progress of an encryption process so that the encryption process may be resumed after an interruption of the encryption process. As such, progress data may identify a point in the encryption process so that encryption may be resumed from that point. In at least one embodiment, storing progress of an encryption process may comprise storing and/or otherwise providing the last segment of data that was encrypted and/or the last segment of data that was not encrypted. Additionally, a data structure, may provide a capability to mark or indicate a point of interruption of the encryption process and provide data that may be utilized to resume from the point of interruption the overall encryption process.

System and/or method for encrypting data

A system and method comprises receiving a write request from a client to store data at first and second non-sequential locations of a storage medium. The data of the write request is recognized as not being a predefined data pattern, and a first encryption method is applied to the data of the write request before it is stored at the first and second non-sequential locations of the storage medium. Further, a second different encryption method is applied to content of an area between the first and second non-sequential locations, where the content of the area is recognized as being the predefined pattern.

Data storage and/or retrieval

Described is a process for encrypting and compressing data for storage by computing systems. A data stream received by a computing system is separated into data chunks for storage on a storage device using a data layout format. Each data chunk is examined and if possible, compressed to produce a compressed data chunk. Whether or not the data chunk can be compressed, the data chunk is encrypted and stored on the storage device in addition to metadata that describes the data chunk. When reading the stored data chunk from the storage device, the metadata identifies the starting location of the stored data chunk and provides metadata information to the computing system for decryption and decompression processing.

Encryption and compression of data for storage

Embodiments of methods, devices and/or systems for managing the encryption of data are described.

Managing the encryption of data

Embodiments of methods and/or systems to authorize access to stored data are disclosed herein. When a data access request is detected by an agent executing on a first device, the agent determines whether the data access request is authorized based on at least one rule associated with a security policy on the first device. If the agent determines that the data access request is authorized, then the data access request is transmitted to a second device. Subsequently, an application executing on the second device, then determines whether the presence of an agent on the first device is required to forward the data access request to a data storage system. This determination is based on statistical information associated with data access of the data storage system. If it is determined that the presence of the agent is required, the second device then determines whether the agent is present and forwards the data to the agent if the agent is present.

Method and/or system to authorize access to stored data

The preferred embodiment of the invention distributes, and effectively caches, information by inserting it into file handles that the proxy sends to clients. This information can be used to improve performance by eliminating the need for the proxy to generate additional requests to the server to establish file identity. The distributed information can also be intended to improve security, for example, by allowing the proxy to encode into the file handle a session key that expires after some amount of time.

Method and apparatus for improving file system proxy performance and security by distributing information to clients via file handles

The present invention displays a graphical representation of a multi-layer network having a front end layer and a back end layer. A plurality of front end units of the front end layer and a plurality of back end units of the back end layer are represented as a plurality of front end graphical objects and a plurality of back end graphical objects. A user selects a front end graphical object representing a selected front end unit and a back end graphical object representing a selected back end unit to form a logical connection between the front end unit and the back end unit. The logical connection grants the selected front end unit access to the selected back end unit.

System and/or method relating to managing a network

A method, system and article for encrypting data by applying an encryption process, wherein the encryption process includes storing progress data relating to the progress of the encryption process so that the encryption process may be resumed after an interruption. Even more specifically, after the interruption, progress data relating to the progress of the encryption process is accessed. Portions of the progress data are compared to determine the last encrypted data segment. After the last encrypted data segment, the encryption process at the data segment is resumed.

Embodiments of methods and/or systems to authorize access to stored data are disclosed.

Embodiments of methods, devices and/or systems for a method of managing the retention and/or discarding of stored data are described.

Growing community of inventors

Redwood City, CA, United States of America

Hristo Bojinov