Hewlett-packard Development Company, L.p.

Entit Software LLC

Hewlett Packard Enterprise Development LP

Micro Focus Lcc

Ram Swaminathan

Mahesh Kallahalla

Sharad Singhal

Jun Li

Erik Riedel

Mustafa Uysal

Anshul Kothari

Robert E Tarjan

Yunhong Zhou

Joshua P Robinson

Alan Hersh Karp

Arif Abdulhusein Merchant

Mehul A Shah

John Johnson Wylie

Nina Mishra

Kevin E Fu

Parthasarathy Ranganathan

Puneet Sharma

Christos Karamanolis

Evan Randy Kirshenbaum

Robert S Schreiber

Marcos Kawazoe Aguilera

Sujata Banerjee

Xiaoyun Zhu

Kimberly Keeton

Eric A Anderson

Richard Andrew Golding

Priya Mahadevan

Alistair Veitch

Alex Xin Zhang

Krishnamurthy Viswanathan

Yin Wang

Guillermo Alvarez

Bryan Stephenson

Hamid Reza Motahari Nezhad

Haris Volos

Yupu Zhang

Qian Wang

Kamalika Chaudhuri

Dana Ron

Ted Romer

Junwen Lai

Brandon Heller

Frederic Gittler

A method performed by a processing system includes identifying a first node in a metadata tree of a patient that corresponds to an encrypted electronic health record in an encrypted data store and preventing a portion of the first node from being decrypted with a node key of a first healthcare participant in response to a second node of the metadata tree including key rotation information that indicates that the node key has been revoked by a second healthcare participant.

Metadata tree with key rotation information

Determining cache value currency using persistent markers is disclosed herein. In one example, a cache entry is retrieved from a local cache memory device. The cache entry includes a key, a value to be used by the computing device, and a marker flag to determine whether the cache entry is current. The local cache memory device also includes a marker location that indicates a location of a marker in a shared persistent fabric-attached memory (FAM). Using a marker location, the marker is retrieved from the shared persistent FAM. From the marker and the marker flag, it is determined whether the cache entry is current. The shared FAM pool is connected to the local cache memory devices of multiple computing devices.

Determining cache value currency using persistent markers

A method performed by a processing system includes reconstructing a metadata tree of a patient from a metadata tree journal, the metadata tree including a plurality of references to a corresponding plurality of encrypted electronic health records of the patient in an encrypted data store, and validating the metadata tree by comparing first integrity information of the metadata tree to second integrity information corresponding to the metadata tree journal provided by a metadata integrity validator.

Validating a metadata tree using a metadata integrity validator

A method performed by a processing system includes determining a location in a metadata tree of a patient for an electronic health record, generating a record key for the electronic health record based on the location and a provider key corresponding to a provider, the provider key generated from a patient key corresponding to the patient, encrypting the electronic health record using the record key to generate a encrypted record, and providing the encrypted record to an encrypted data store.

Encrypted data store for records

An encryption key fragment is divided into a number of encryption key fragments. Requests to store different ones of the encryption key fragments are transmitted to different computer memory storage systems. An individual request to store an encryption key fragment includes one of the encryption key fragments and bears an access control hallmark for regulating access to the encryption key fragment.

Encryption key management using distributed storage of encryption-key fragments

Plural sets of items corresponding to plural tiers of a multi-tiered system are defined, where the items represent amounts of resources to allocate to the tiers. Items from respective sets are selected based on a response time constraint and a target cost. Information is provided pertaining to allocation of amounts of resources to the respective tiers based on the selected items.

Allocation of resources for tiers of a multi-tiered system based on selecting items from respective sets

A method of generating a set of composite services is provided herein. The method includes receiving standardized service descriptions of a set of component services from service providers. The standardized description of a component service may be translated to an automaton-based description. A specified goal associated with the set of component services may be received. The set of composite services may be generated based on the automaton-based description and the specified goal. Each of the generated composite services may accomplish the specified goal.

Composition of services

A network file system includes at least one unmodified client and at least one unmodified physical file server (PFS). Each PFS has at least one file that is identified by an associated physical file handle (PFH). The network file system includes virtual file servers (VFSs) in a data path between the client(s) and the PFS(s). The network file system also includes a virtualized name space that is mapped to the PFS(s) and is provided to the client(s) by the VFS(s). The network file system further includes a virtualized ID space that is established in response to a request from a client. Within the ID space, each file is identified by a physical file handle (PFH) on a PFS. The PFH and PFS pair are mapped to provide a virtual file handle (VFH), and the map of the VFHs is allocated among the VFSs.

Protocol virtualization for a network file system

Systems, methods, and machine-readable and executable instructions are provided for encryption key storage. Encryption key storage may include associating each of a plurality of identifiers with a different one of a plurality of key fragment stores, determining a plurality of indexes, where each of the plurality of indexes is based upon a handle provided by a customer, an authorization token provided by the customer, and a different one of the plurality of identifiers, partitioning an encryption key provided by the customer into a number of encryption key fragments, and distributing the plurality of indexes and the number of encryption key fragments to the plurality of key fragment stores. The handle can be a uniform resource identifier, for instance.

Encryption key storage with key fragment stores

An encryption key may be fragmented into n encryption key fragments such that k&#x3c;n fragments are sufficient for reconstructing the encryption key. The encryption key fragments may be distributed across data stores located within first and second geographic regions. For example, at least k of the encryption key fragments may be distributed across data stores realized at N different availability zones within the first geographic region such that less than k of the encryption key fragments are distributed to each of the N availability zones within the first geographic region. Similarly, at least k of the encryption key fragments may be distributed across data stores realized at M different availability zones within the second geographic region such that less than k of the encryption key fragments are distributed to each of the M availability zones within the second geographic region.

Encryption key fragment distribution

In accordance with an embodiment of the invention, a method of writing and reading redundant data is provided. Data is written by storing a copy of the data along with a timestamp and a signature at each of a set of storage devices. The data is read by retrieving the copy of the data, the timestamp and the signature from each of a plurality of the set of data storage devices. One of the copies of the data is selected to be provided to a requestor of the data. Each of the storage devices of the set is requested to certify the selected copy of the data. Provided that a proof of certification of the selected copy of the data is valid, the storage devices of the set are instructed to store the selected copy of the data along with a new timestamp.

System for and method of writing and reading redundant data

A wireless network metric region in a wireless network is determined using a node metric region and a performance metric. The node metric region, which includes a boundary of the node metric region, for each node is estimated and the performance metric for the node metric region for each node is measured. The boundary of the node metric region for each node is adjusted based on the measured performance metric and then the wireless network metric region for the wireless network is determined based on the adjusted boundaries of the node metric region for each node.

Determining a metric region in a wireless network

A method for constructing a histogram can include sampling attributes in a column of a database on a server and determining a bucket set for the histogram based on a number of buckets that represents a distribution of the attributes with minimum error. A bucket in the bucket set includes boundaries and an approximation of a count of attributes falling within the boundaries. The method further includes determining a precision for encoding the approximation, such that the histogram having the bucket set fits within a storage limit on a tangible computer-readable medium. The histogram can then be stored for the database on a tangible computer-readable medium by encoding the approximation with the precision.

Method for constructing a histogram

Various approaches are described for auditing integrity of stored data. In one approach, a data set is provided from a client to a storage provider, and the data set is stored at a first storage arrangement by the storage provider. An auditor determines whether the data set stored at the first storage arrangement is corrupt without reliance on any part of the data set and any derivative of any part of the data set stored by the client. While the auditor is determining whether the data set stored at the first storage arrangement is corrupt, the auditor is prevented from being exposed to information specified by the data set. The auditor outputs data indicative of data corruption in response to determining that the data set stored at the first storage arrangement is corrupt.

Auditing data integrity

A system for controlling power consumption of a network includes at least one terminal to receive a plurality of requests to route data from a plurality of data sources to a plurality of data sinks, where the data sources and the data sinks are connected to each other through a plurality of network nodes forming the network, and a network configuration unit. The network configuration unit includes a selection module configured to select a configuration of the network nodes that allows the network to have a lowest overall power consumption of the network among a plurality of configurations of the network, and an output module configured to output a plurality of instruction signals to the network nodes to perform the network configuration. A network path for transmitting a network flow is selected that does not allow the network flow to be split and flow through another network path.

System for controlling power consumption of a network

Growing community of inventors

Cupertino, CA, United States of America

Ram Swaminathan