Emc IP Holding Company LLC

Ryan Wallner

Kenneth Durazzo

Robert Anthony Lincourt, Jr

Vaibhav Khanduja

Suresh Kumar

Xiaohong Qin

Lejin Du

Misha Nossik

Shamail Tahir

Patrick J Mullaney

An apparatus comprises at least one container host device implementing containers for respective tenants of a multi-tenant environment. The containers are configured to utilize storage resources of at least one storage platform. A given one of the containers comprises at least one application, and an application file system security layer configured to communicate with the storage platform. The application file system security layer comprises a container storage volume supported by the storage platform, and an encryption engine configured to encrypt and decrypt data of the container storage volume utilizing one or more data encryption keys that are encrypted under a tenant-specific key encryption key. The tenant-specific key encryption key is provided to the application file system security layer by a tenant key manager that is external to the container. The tenant key manager is illustratively controlled by the tenant for which the given container is implemented.

Security layer for containers in multi-tenant environments

A system, computer program product, and computer-executable method for managing data I/Os from an application in communication with a cache appliance, wherein the cache appliance is in communication with a cloud storage provider having a first portion of data, the system, computer program product, and computer-executable comprising receiving a data I/O from the application, wherein the data I/O relates to the first portion of data on the cloud storage provider, analyzing the data I/O, creating a caching policy based on the analysis of the data I/O, creating a tenant cache resource vessel based on the caching policy, and managing the data I/O using the tenant cache resource vessel based on the caching policy.

Multi-tenant caching storage intelligence

At least one processing device comprises a processor coupled to a memory and implements virtualization infrastructure including a first container comprising a software agent of a locator-identifier separation protocol. The software agent is configured to communicate with a locator-identifier mapping system that associates identifiers of respective endpoints with respective locators in accordance with the locator-identifier separation protocol. The endpoints comprise respective ones of a plurality of additional containers of the virtualization infrastructure. The first container may be coupled to the plurality of additional containers via a bridge element that combines virtual interfaces of respective ones of the additional containers into a single physical network interface. The first container may additionally be coupled to a network via a router configured to operate in accordance with the locator-identifier separation protocol as an ingress tunnel router with respect to inbound packets and as an egress tunnel router with respect to outbound packets.

Network virtualization for container-based cloud computation using locator-identifier separation protocol

A first virtual network storage function instance associated with a first portion of at least one network is configured to communicate with at least a second virtual network storage function instance associated with a second portion of the at least one network. The first and second virtual network storage function instances collectively comprise at least part of a virtual network storage function layer configured to interact with an underlying storage layer providing access to physical storage comprising a plurality of storage elements. The first and second virtual network storage function instances are configured to implement at least one data service that involves processing data obtained from at least one of the storage elements via at least one of the first and second portions of the at least one network, responsive to analytics performed by at least one of the first and second virtual network storage function instances.

Virtual network storage function layer comprising one or more virtual network storage function instances

An apparatus comprises container host devices each implementing one or more containers, at least one storage platform coupled to the plurality of container host devices and implementing storage resources for utilization by processes running in the containers, and a controller associated with at least a subset of the container host devices and the storage platform. The containers implemented by the container host devices are arranged in container groups and the storage resources implemented by the storage platform are arranged in storage groups. The controller is configured to coordinate establishment of container host resource allocations for one or more of the container groups with establishment of storage resource allocations for one or more of the storage groups. Portions of the container groups may be arranged with corresponding portions of the storage groups into container-storage groups, with the controller generating information indicative of relative levels of resource utilization across the container-storage groups.

Coordinated resource allocation between container groups and storage groups

An apparatus comprises at least one container host device implementing containers for respective tenants of a multi-tenant environment, a storage platform coupled to the container host device and implementing storage resources for utilization by the containers, and a container storage controller associated with the container host device. The container storage controller is configured to provision portions of the storage resources for respective ones of the containers including for each of the containers at least one virtual storage volume accessible only to that container and having an associated file system that is not visible to an operating system of the container host device. The provisioned portion of the storage resources for a given one of the containers of a corresponding one of the tenants is thereby isolated from the provisioned portions of the storage resources for respective other ones of the containers of corresponding other ones of the tenants.

Growing community of inventors

South Grafton, MA, United States of America

Ryan Wallner