Intellectual Ventures I LLC

Vmware, Inc.

Other

Guardian Data Storage, LLC

Intellectual Property Ventures I LLC

Nicholas Michael Ryan

Klimenty Vainstein

Denis Jacques Paul Garcia

Weiqing Huang

Serge Humpich

Michael Michio Ouye

Alain S Rossmann

Steven Toye Crocker

Eric Gilbertson

Patrick Zuili

Senthilvasan Supramaniam

Chang-Ping Lee

Hal Hilderbrand

Rossmann Alain

Matthew Eccleston

Prasanna Aithal

Krishna Yadappanavar

Matthew David Ginzton

Gerald C Chen

Sunil Satnur

Srinivas Krishnamurti

Nishant Yadav

Michael Michio Ouya

In a system for providing access control management to electronic data, techniques to secure the electronic data and keep the electronic data secured at all times are disclosed. According to one embodiment, a secured file or secured document includes two parts: an attachment, referred to as a header, and an encrypted document or data portion. The header includes security information that points to or includes the access rules and a file key. The access rules facilitate restrictive access to the secured document and essentially determine who/when/how/where the secured document can be accessed. The file key is used to encrypt/decrypt the encrypted data portion. Only those who have the proper access privileges are permitted to retrieve the file key to encrypt/decrypt the encrypted data portion.

Methods and systems for providing access control to secured data

Read data blocks are selectively decrypted and write data bocks are selectively encrypted in an input-output path between an application and a file system driver. If a read data block contains all zeroes, the read data block is not decrypted even though the read data block is a block of an encrypted file. Likewise, if a write data block contains all zeroes, the write data block is not encrypted even though the write data block is a block of an encrypted file. In this manner, the handling of zero blocks of an encrypted file is efficiently processed outside the file system without relying on bitmaps or other data structure maintained by the file system that may inform which blocks contain all zeroes.

Optimized encryption filtering of files

A method for coalescing IO requests includes maintaining a queue in a layer of an IO stack of a hypervisor, wherein (i) the queue holds IO requests received from an upper layer of the IO stack without forwarding the IO requests down the IO stack, and (ii) the layer of the IO stack resides above a file system layer of the IO stack. The method further includes receiving, at the layer, an IO request from the upper layer or a notification of a completion of certain IO requests previously transmitted by the layer down the IO stack. The method further includes determining whether any IO requests currently held in the queue should be transmitted down the IO stack based upon a condition; and combining any IO requests in the queue into at least one combined IO request to transmit down the IO stack if the condition is satisfied.

Storage performance by heuristically coalescing IO requests

Exemplary methods, apparatuses, and systems include receiving selection of a virtual disk and a plug-in. The virtual disk includes an extent file storing data used by a virtual machine and a descriptor file including a reference to the extent file and used by a virtualization stack of a host computer to manage the virtual disk. The plug-in is attached to the virtual disk in response to the received selection. Attaching the plug-in includes adding an identification of the plug-in to the descriptor file. The plug-in is notified of the attachment to the virtual disk. A request is received from the plug-in to create a sidecar file to store data or metadata on behalf of the plug-in. The sidecar file is created for the attached plug-in. The sidecar file is attached to the virtual disk.

Sidecar file framework for managing virtual disk plug-in data and metadata

An improved file security system that manages secured files (documents) is disclosed. The file security system provides centralized management and storage of security information that can be referenced by secured files. In other words, a secured file need not itself contain security information that is needed to determine whether access to the secured file is to be permitted. That is, at least a portion of the security information can be remotely stored and accessed by way of an identifier that is provided within the secured file. By centralizing storage of security information, the file security system is able to subsequently modify access criteria for secured files (documents) without having to physically make modifications to the secured files.

Method and system for using remote headers to secure electronic files

An administrator may set restrictions related to the operation of a virtual machine (VM), and virtualization software enforces such restrictions. There may be restrictions related to the general use of the VM, such as who may use the VM, when the VM may be used, and on what physical computers the VM may be used. There may be similar restrictions related to a general ability to modify a VM, such as who may modify the VM. There may also be restrictions related to what modifications may be made to a VM, such as whether the VM may be modified to enable access to various devices or other resources. There may also be restrictions related to how the VM may be used and what may be done with the VM. Information related to the VM and any restrictions placed on the operation of the VM may be encrypted to inhibit a user from circumventing the restrictions.

Enforcing restrictions related to a virtualized computer environment

An improved system and approaches for protecting secured files when being used by an application (e.g., network browser) that potentially transmits the files over a network to unknown external locations are disclosed. According to one aspect, access to secured files is restricted so that unsecured versions of the secured files are not able to be transmitted over a network (e.g., the Internet) to unauthorized destinations. In one embodiment, processes operating on a computer system are monitored to determine destination locations, if any, of said processes, and then using such destination locations to determine whether to permit the processes to open files in a secure or unsecured manner.

Protecting encrypted files transmitted over a network

Techniques for providing pervasive security to digital assets are disclosed. According to one aspect of the techniques, a server is configured to provide access control (AC) management for a user (e.g., a single user, a group of users, software agents or devices) with a need to access secured data. Within the server module, various access rules for the secured data and/or access privileges for the user can be created, updated, and managed so that the user with the proper access privileges can access the secured documents if granted by the corresponding access rules in the secured data.

Methods and systems for providing access control to electronic data

Techniques for managing files in a designated location are disclosed. An example of the designated location is a folder, a directory, a repository, a device, or a storage place. A set of access rules is applied to a designated location such that all files in the designated location shall have substantially similar security. As a result, secured files can be easily created and managed with respect to the designated location and users with access privilege to the designated location can access most of the files, in not all, in the designated location.

Managing secured files in designated locations

Improved approaches for securing files that are derived from secured files are disclosed. In general, a secured file can only be accessed by authenticated users with appropriate access rights or privileges. Each secured file is provided with a header portion and a data portion, where the header portion contains, or points to, security information. The security information is used to determine whether access to associated data portions of secured files is permitted. These improved approaches can thus impose security on files that are derived from secured files. In one embodiment, files that are deemed derived from a secured file include files that are copies of the secured file. In another embodiment, files that are deemed derived from a secured file include files having content substantially similar to the content of the secured file.

System and method for imposing security on copies of secured items

An improved system and approaches for protecting secured files when being used by an application (e.g., network browser) that potentially transmits the files over a network to unknown external locations are disclosed. According to one aspect, access to secured files is restricted so that unsecured versions of the secured files are not able to be transmitted over a network (e.g., the Internet) to unauthorized destinations. In one embodiment, in opening a file for use by a network browser, the network browser receives a secured (e.g., encrypted) version of the secured file when the destination location (e.g., destination address) for the network browser is not trusted, but receives an unsecured (e.g., unencrypted) version of the secured file when the destination location for the network browser is trusted. According to another aspect, processes operating on a computer system are monitored to determine destination locations, if any, of said processes, and then using such destination locations to determine whether to permit the processes to open files in a secure or unsecured manner.

Growing community of inventors

Sunnyvale, CA, United States of America

Nicholas Michael Ryan