Netapp, Inc.

Intel Corporation

Decru, Inc.

Serge Plotkin

Hristo Bojinov

Dan Avida

Robert Paul Wood

Yuval Frandzel

Patrick A Worfolk

Itai Aaronson

Andrew Narver

Hiroshi Ishii

Zi-Bin Yang

Kevin Brown

Shmuel Ravid-Rabinovitz

A system and method for securing data by receiving encrypted data at a security appliance transmitted from a client, wherein at least a portion of the encrypted data is encrypted according to a first encryption protocol, and wherein the encrypted data is transmitted to the security appliance according to a first data transfer protocol. The encrypted data is then decrypted at the security appliance, wherein at least a portion of the decrypted data is re-encrypted according to a second encryption protocol at the security appliance. The re-encrypted data is transmitted from the security appliance to a storage device, wherein the re-encrypted data is transmitted according to a second data transfer protocol that is different than the first data transfer protocol.

Protocol translation

In one embodiment, progress of an encryption process may be tracked. This may comprise, for example, storing progress of an encryption process so that the encryption process may be resumed after an interruption of the encryption process. As such, progress data may identify a point in the encryption process so that encryption may be resumed from that point. In at least one embodiment, storing progress of an encryption process may comprise storing and/or otherwise providing the last segment of data that was encrypted and/or the last segment of data that was not encrypted. Additionally, a data structure, may provide a capability to mark or indicate a point of interruption of the encryption process and provide data that may be utilized to resume from the point of interruption the overall encryption process.

System and/or method for encrypting data

The presently preferred embodiment of the invention provides an encryption based security system for network storage that separates the ability to access storage from the ability to access the stored data. This is achieved by keeping all the data encrypted on the storage devices. Logically, the invention comprises a device that has two network interfaces: one is a clear text network interface that connects to one or more clients, and the other is a secure network interface that is connected to one or more persistent storage servers. Functionally, each network interface supports multiple network nodes. That is, the clear text network interface supports multiple client machines, and the secure network interface supports one or more storage servers.

Encryption based security system for network storage

A system and method comprises receiving a write request from a client to store data at first and second non-sequential locations of a storage medium. The data of the write request is recognized as not being a predefined data pattern, and a first encryption method is applied to the data of the write request before it is stored at the first and second non-sequential locations of the storage medium. Further, a second different encryption method is applied to content of an area between the first and second non-sequential locations, where the content of the area is recognized as being the predefined pattern.

Data storage and/or retrieval

Embodiments of methods, devices and/or systems for managing the encryption of data are described.

Managing the encryption of data

An apparatus and method for connecting a plurality of computing devices, e.g. web servers, database servers, etc., to a plurality of storage devices, such as disks, disk arrays, tapes, etc., by using a stream-oriented (circuit oriented) switch that has high throughput, but that requires non-negligible time for reconfiguration is disclosed. An example of such stream-oriented switch is an optical switch. The system decodes the requests from the computing devices and uses this information to create circuits, e.g. optical paths in embodiments where the stream-oriented switch is an optical switch, through the stream-oriented switch. The system uses these circuits to route traffic between the computing devices and the storage devices. Buffering of data and control in the device memory is used to improve overall throughput and reduce the time spent on reconfigurations.

Stream-oriented interconnect for networked computer storage

Embodiments of methods and/or systems to authorize access to stored data are disclosed herein. When a data access request is detected by an agent executing on a first device, the agent determines whether the data access request is authorized based on at least one rule associated with a security policy on the first device. If the agent determines that the data access request is authorized, then the data access request is transmitted to a second device. Subsequently, an application executing on the second device, then determines whether the presence of an agent on the first device is required to forward the data access request to a data storage system. This determination is based on statistical information associated with data access of the data storage system. If it is determined that the presence of the agent is required, the second device then determines whether the agent is present and forwards the data to the agent if the agent is present.

Method and/or system to authorize access to stored data

The preferred embodiment of the invention distributes, and effectively caches, information by inserting it into file handles that the proxy sends to clients. This information can be used to improve performance by eliminating the need for the proxy to generate additional requests to the server to establish file identity. The distributed information can also be intended to improve security, for example, by allowing the proxy to encode into the file handle a session key that expires after some amount of time.

Method and apparatus for improving file system proxy performance and security by distributing information to clients via file handles

The present invention displays a graphical representation of a multi-layer network having a front end layer and a back end layer. A plurality of front end units of the front end layer and a plurality of back end units of the back end layer are represented as a plurality of front end graphical objects and a plurality of back end graphical objects. A user selects a front end graphical object representing a selected front end unit and a back end graphical object representing a selected back end unit to form a logical connection between the front end unit and the back end unit. The logical connection grants the selected front end unit access to the selected back end unit.

System and/or method relating to managing a network

A method, system and article for encrypting data by applying an encryption process, wherein the encryption process includes storing progress data relating to the progress of the encryption process so that the encryption process may be resumed after an interruption. Even more specifically, after the interruption, progress data relating to the progress of the encryption process is accessed. Portions of the progress data are compared to determine the last encrypted data segment. After the last encrypted data segment, the encryption process at the data segment is resumed.

Embodiments of methods and/or systems to authorize access to stored data are disclosed.

Embodiments of methods, devices and/or systems for a method of managing the retention and/or discarding of stored data are described.

Management of the retention and/or discarding of stored data

Disclosed is a routing algorithm that uses a new concept of node metric system for optimizing the throughput of a network, in particular, a shared medium network. The measure of congestion of a path in the network is represented by a path metric which is computed by summing the node metrics of the intermediate nodes on the path. Factors used in computing node metrics include the following: 1. future traffic load from neighboring nodes to the node; and 2. future traffic load from the node to the neighboring nodes.

Growing community of inventors

San Carlos, CA, United States of America

Serge Plotkin