Alcatel Lucent

Provenance Asset Group LLC

Krishna P Puttaswamy Naga

Thyagarajan Nandagopal

Fang Hao

Muralidharan Sampath Kodialam

Murali Kodialam

Tirunell V Lakshman

Katherine Hua Guo

Ashok Anand

T V Lakshman

Matteo Varvello

Antony Martin

Tv Lakshman

TV Lakshman

A data block storage management capability is presented. A cloud file system management capability manages storage of data blocks of a file system across multiple cloud storage services (e.g., including determining, for each data block to be stored, a storage location and a storage duration for the data block). A cloud file system management capability manages movement of data blocks of a file system between storage volumes of cloud storage services. A cloud file system management capability provides a probabilistic eviction scheme for evicting data blocks from storage volumes of cloud storage services in advance of storage deadlines by which the data blocks are to be removed from the storage volumes. A cloud file system management capability enables dynamic adaptation of the storage volume sizes of the storage volumes of the cloud storage services.

Apparatus and method for managing storage of data blocks

Various embodiments provide a method and apparatus of providing a network and storage-aware virtual machine (VM) placement that optimizes placement based on network layer metrics, performance characteristics of the storage arrays and application constraints. Advantageously, since storage is often necessary in servicing application requests, basing VM placement on performance characteristics of the storage arrays as well as network layer metrics can lead to a significant improvement in VM performance.

Method and apparatus for network and storage-aware virtual machine placement

A capability is provided for reducing the costs of data transfers for networks using pricing heterogeneity. For data to be transferred between an application of a first network and a user device, the data may be transferred directly without using a second network or indirectly using a second network including a transfer of the data between the first network and the second network. In a network-based file system, a first network is primarily used for write requests and a second network is primarily used for read requests, and a data block is transferred from the first network to the second network based on a determination that a threshold number of read requests for the data block have been received. The determination as to when to transfer data between networks may be determined based on various costs associated with the networks.

Reducing costs related to use of networks based on pricing heterogeneity

A security management capability enables migration of individual security rules between storage/application locations. The migration of a security rule may include selection of a location at which the security rule is to be applied and migration of the security rule to the selected location at which the security rule is to be applied. The selection of the location at which the security rule is to be applied may be performed based on security rule policies and/or security rule location selection information. The security rule is migrated from a current location (e.g., a location at which the security rule is currently applied, a management system, or the like) to the selected location at which the security rule is to be applied. In this manner, a fluid security layer may be provided. The fluid security layer may be optimized for one or more of security level, performance, cost, or the like.

Apparatus and method for providing a fluid security layer

Various embodiments provide a method and apparatus of providing a distributed security service that runs light instances in a number of security devices and central instances of the security services in select security devices. A received or transmitted client content segment is directed to a light instance which either applies a security policy corresponding to the client content segment if the client content segment has been previously analyzed and has a valid security policy, or else, the light instance sends the client content segment to a central instance to be analyzed. The central instance may then provide a complete security analysis on the client content segment, determine a security policy corresponding to the client content segment and push the determined security policy to one or more of the light instances. Advantageously, a distributed security service delivery may provide highly secure, network efficient and cost effective security service delivery.

Method and apparatus for a distributed security service in a cloud network

A flow deflection capability is provided for deflecting data flows within a Software Defined Network (SDN) in order to provide security for the SDN. A flow forwarding rule is generated for a first network element of the SDN based on detection of a condition (e.g., TCAM utilization condition, CPU utilization condition, or the like) associated with the first network element. The flow forwarding rule is generated by a control element of the SDN or the first network element of the SDN. The flow forwarding rule is indicative that at least a portion of new flow requests received at the first network element are to be forwarded from the first network element to a second network element of the SDN. The flow forwarding rule may specify full flow deflection or selective flow deflection.

Securing software defined networks via flow deflection

A method and apparatus of providing an RE-aware technique for placing slots based on redundancy across and within slot communication pairs. In particular, the RE-aware placement strategy takes into account the redundancy in data transfers for slot-to-slot communications and place slots to exploit redundancy in data transfers while minimizing the overall inter-rack (or inter-data center) bandwidth usage.

Method and apparatus for providing traffic re-aware slot placement

An exemplary data transfer manager includes a datacenter configured to communicate over at least one link and a scheduler that is configured to schedule a plurality of jobs for communicating data from the datacenter. The scheduler determines a minimum bandwidth requirement of each job and determines a maximum bandwidth limit of each job. The scheduler determines a flex parameter of each job. The flex parameter indicates how much a data transfer rate can vary between adjacent data transfer periods for the job.

System and method for managing data transfer from a data center including bandwidth limits and a flex parameter indicating bandwidth variation between data transfer periods

Various embodiments provide a method and apparatus of providing accelerated encrypted connections in a cloud network supporting transmission of data including per-user encrypted data. Transmission of encrypted data from an application server uses an encryption scheme that encrypts static data using a first encryption scheme that derives keys from the content itself and encrypts dynamic data, such as dynamic website content with personalized user data, using a second encryption scheme.

Method and apparatus for accelerating connections in a cloud network

A data block storage management capability is presented. A file system includes a plurality of data blocks which are managed using a first storage service and a second storage service, where the first storage service has a lower storage cost and a higher input-output cost than the second storage service. The data blocks stored using the second storage service have associated therewith respective expected storage durations indicative of respective lengths of time for which the data blocks are to be stored using the second storage service (which may be the same or different across the ones of the data blocks stored using the second storage service). The expected storage durations of the data blocks are modified based on a comparison of an expected hit rate of the second storage service and a current hit rate of the second storage service or current hit rates of the data blocks.

Apparatus and method for meeting performance metrics for users in file systems

Various embodiments provide a method and apparatus of providing a frugal cloud file system that efficiently uses the blocks of different types of storage devices with different properties for different purposes. The efficient use of the different types of available storage devices reduces the storage and bandwidth overhead. Advantageously, the reduction in storage and bandwidth overhead achieved using the frugal cloud file system reduces the economic costs of running the file system while maintaining high performance.

Method and apparatus for a frugal cloud file system

Apparatuses, methods and articles of manufacture for performing data leakage prevention are provided. Data leakage prevention may be performed by determining a signature of a transmitted document, the transmitted document being in transit to a location beyond a network boundary. The signature of the transmitted document is compared with one or more signatures of documents authorized to be transmitted beyond the network boundary. The transmitted document is prevented from being transmitted beyond the network boundary if the signature of the document does not correspond to a signature of a document authorized to be transmitted beyond the network boundary.

Data leakage prevention for cloud and enterprise networks

A data-leakage prevention capability is presented herein. The data-leakage prevention capability prevents leakage of data, of a file set having a plurality of files, from a secure network using online fingerprint checking of data flows at a boundary of the secure network. The online fingerprint checking is performed using a set of data structures configured for the file set. The data structures for the file set are configured based on file set characteristics information of the file set and a target detection lag indicative of a maximum number of bits within which a data leakage event for the file set is to be determined. The data structure configuration is computed for a plurality of data structures configured for use in monitoring the files of the file set. The data structure configuration includes a plurality of data structure locations and data structure sizes for the respective plurality of data structures.

Growing community of inventors

Metuchen, NJ, United States of America

Krishna P Puttaswamy Naga