Netapp, Inc.

Bracket Computing, Inc.

Sun Microsystems, Inc.

Network Appliance, Inc.

Vmware, Inc.

James J Voll

Jason Ansel Lango

Shailaja Kamila

Anurag Palsule

Ameet Deulgaonkar

Andrew G Tucker

Nagender Somavarapu

James Hartwell Holl, Ii

Dennis Ramdass

David A Grunwald

Steven Robert Kleiman

Graham Hamilton

Ashish Prakash

David Hitz

Konstantinos Roussos

Michael Lee Federwisch

Madhusudhan Talluri

Szu-Wen Kuo

Paul Christopher Eastham

Kartik Ayyar

Kevin C Fox

Emmanuel Ackaouy

Daniel Ting

Brian Mederic Quirion

Timothy Paul Marsland

Mehul S Shah

Panagiotis S Kougiouris

Anshu Surana

Jason Sobel

Ramanathan S Padinjarel

In an approach, an intermediary guest manager operates within a virtual machine hosted by a host machine and managed by a hypervisor. The intermediary guest manager manages one or more guest operating systems operating within the virtual machine and implements one or more security services for the guest operating systems. The security services provided to the guest operating systems may include system call filtering, memory protections, secure memory dumps, and others. In some cases, the intermediary guest manager consults a threat defense policy which contains a number of records, where each record has one or more triggers representing suspicious activity and one or more actions to take in response to being triggered. When the intermediary guest manager identifies a request, such as a system call or memory access, that meets the trigger of a particular record, the intermediary guest manager executes the associated actions to remediate the suspicious activity.

Threat defense techniques

One or more services for enhancing guest utilization of a virtual machine and other VDC resources may be provided at the intermediary manager. In an embodiment, the intermediary manager intercepts a hypercall from a guest operating system that is separate from the intermediary manager. The intermediary manager determines that a particular intermediary service is associated with the hypercall and causes execution of service instructions associated with the particular intermediary service. The intermediary manager and guest operating systems may operate within a virtual machine hosted by a host machine and managed by a hypervisor. Embodiments may be useful in any of a virtualized enterprise computer system; a virtual machine infrastructure in a private data center; computing, storage or networking resources in a private cloud; computing, storage or networking resources of cloud service provider; and a hybrid cloud computing environment.

Expansion of services for a virtual data center guest

A system for managing configuration of a storage network having multiple storage resources is disclosed. The system uses a storage management policy to set parameters for detecting storage resource problems in the storage network. The system monitors the storage resources in the storage network based on the storage management policy. Based on the monitoring, the system detects limited storage resource conditions, and identifies one or more potential solutions to the condition. After identifying potential solutions, the system simulates effects on the storage resources of implementing individual solutions. Based on the simulations, the system then implements one or more selected solutions. These solutions may be selected automatically or by a user.

Method and system for managing storage capacity in a storage network

Method and system for processing client provisioning and migration requests is provided. The process evaluates a provisioning request and selects a storage that best meets the client requirements. The process determines if non-disruptive migration is possible and if it is possible then the storage is automatically configured for non-disruptive migration. Once the storage is provisioned and configured, the process receives a migration request to migrate information from the storage. The process determines an access protocol used by the client to access the storage. The process determines if a storage system that manages the storage is capable of supporting non-disruptive migration of information from the storage. If the storage system is capable, then a migration technique is automatically selected for migrating the information from the storage.

Method and system for non-disruptive migration

Files or directories in a persistent image such as a file system backup structure are hidden from general access by establishing a data set used by the file system when accessing the persistent image. The data set indicates a visibility status of the files or directories in the persistent image. Requests to the file system for access to the image are filtered through the data set to prevent unintentionally revealed information in the image from being generally available. Commands to add and remove entries in the data set are provided. The data set may be composed of combinations of lists, in which list entries indicate a hidden file or directory, or indicate a visible file or directory. The data set is maintained in system memory and updated on disk to permit restoration of the data set when a volume is mounted or during recovery from a system crash. Information that was unintentionally revealed in the active file system while a backup was being made can be obscured retroactively to provide protection from general access to improve information security in the file system.

System and method for securing information by obscuring contents of a persistent image

Methods and systems for mapping data-management requirements to the provisioning of a data storage system to conform to a set of user-defined data-management policies. A conformance engine with storage system awareness translates the set of data-management policies to a corresponding set of storage-provisioning policies and provisions the resources of the storage system thereby to conform the storage system to the data-management policies. A conformance checker continuously and automatically compares the provisioning of the storage system resources to the provisioning required to meet the data-management policies. When nonconformance is detected, the conformance engine automatically re-provisions the available resources of the storage system to conform the storage system to the data management policies.

Automated continuous provisioning of a data storage system

Described herein is a centralized access request authorization system comprising an authorization module, one or more server systems, and a collection of one or more storage systems connected through a network. An application executing on a server system receives an access request for accessing the storage system collection and sends an authorization request to the authorization module for authorizing the access request. The application may be configured to only send the access request to the storage system collection if it first receives an authorization of the access request from the authorization module. Since the application is configured to do such, the storage system performs the access request without performing any authorization verification on the access request. The authorization module may receive authorization requests from a plurality of applications (executing on a plurality of server systems) and determine received authorization requests using a single repository of access permission information.

Centralizing access request authorizations for storage systems

In an embodiment, a method to provide data consistency in a storage system, includes: providing, by a server to a proxy cache, a lock associated with a delegated file in the server; in response to a write request from a client, modifying data in a cached copy of the delegated file in the proxy cache; revoking, by the server, the lock associated with the delegated file, in response to a request from another device to access the delegated file so that the delegated file is now a formerly delegated file; and writing the modified data to the formerly delegated file in the server to update the formerly delegated file; and permitting access to the formerly delegated file by the another device.

Apparatus and method for data consistency in a proxy cache

In a technique for compressing data, a data storage server receives a set of data, which includes a first number of subsets. The storage server defines a number of compression groups for the set of data, each compression group including multiple entries, each entry containing a pointer to a different subset of the set of data. At least part of the set of data is then compressed into a smaller number of subsets. For each of the subsets which does not contain compressed data after the compression, a predetermined value is stored in the corresponding entry of the corresponding compression group, to indicate that corresponding data is compressed and represented elsewhere in the compression group. The predetermined value may also indicate which compression algorithm was used to compress the data.

In a data storage server, for each subsets which does not contain compressed data after the compression, a predetermined value is stored in the corresponding entry of the corresponding compression group to indicate that corresponding data is compressed

Doors are implemented in an existing operating system by using a novel adaptation of existing data structures and procedures which represent and control data files of the operating system. A door is represented by a file descriptor and is managed by existing mechanisms of an operating system, such as the Unix operating system, which are also used to manage files. A door is represented by a door node, which is a novel extension of the conventional vnode structure which in turn is used in conventional operating systems to represent the state of a computer resource, e.g., a data file. A door node is adapted such that most conventional file access and control procedures, e.g., procedures open( ) and close( ), can be used to access and control door with minimal adaptation. A door node is formed by appending fields which are specific to a door node's representation of the state of a door to fields of the door node which are analogous to the fields of a vnode, which represents the state of a resource and which has a conventional structure. Thus, the fields of a door node which precede the fields specific to the representation of the state of a door are of the size, location, and format of analogous fields in a conventional vnode. A client process obtains a file descriptor which identifies a door by supplying the name of the door to the operating system.

Remote procedure calling using an existing descriptor mechanism

A devtmp device driver provides the functionality of temporary files by representing a virtual device and including the virtual device among several devices within which a file system can store files. Rather than storing data in and retrieving data from a physical device, the devtmp device driver stores data in and retrieves data from anonymous storage through a swap file system which manages anonymous storage for a virtual memory system. A file system uses the devtmp device driver in the same manner the file system uses conventional device drivers which store data in and retrieve data from secondary storage devices. Since the devtmp device driver represents a virtual device whose data are stored in anonymous storage managed by the swap file system, the total amount of storage available for storing data of temporary files is shared among the various components of a computer process to successfully satisfy various needs of various computer processes. Temporary files can be accessed through a main file system, e.g., the UNIX file system, using a delayed-write-mode. In the delayed-write mode, the file system does not write metadata of a device to secondary storage and writes substantive data of files stored on the device only when insufficient primary storage is available to store the substantive data. Accordingly, temporary files are stored in primary storage so long as primary storage is available for such temporary files and are stored in, or moved to, secondary storage when primary storage is unavailable.

Temporary computer file system implementing using anonymous storage

Growing community of inventors

Palo Alto, CA, United States of America

James J Voll