Vmware, Inc.

International Business Machines Corporation

Intel Corporation

Tao Xie

Wenguang Wang

Zongliang Li

Jun Wei Zhang

Ruiling Dou

Haoran Zheng

Lei Chen

Zhao Xia Jin

Ye Zhang

Mansi Shah

Christian Dickmann

Wei Fang

Yangyang Zhang

Xin Ni

Banghui Luo

Enning Xiang

Asit Desai

Hui Chen

Jianhui Li

Tianyou Li

Zhen Yu Liu

Satish Pudi

Kevin James Jones

Peng Dai

Shan Fan

Yun Zhou

Kevin Rayfeng Li

Yizheng Chen

Xin Li

Chandrakanth Gadhiraju

Litao Xia

Kiran Patil

Jing Liu

Anil Chintalapati

Abhay Kuamr Jain

A method for encryption in a distributed datastore is provided. The method generally includes receiving random data from a virtualization management platform as a wrapped data encryption key (DEK), retrieving a key encryption key (KEK) from a key management server (KMS), decrypting the wrapped DEK using the KEK to determine a blank DEK, where the blank DEK is common to a plurality of hosts of a host cluster accessing a distributed datastore; encrypting first data using the blank DEK, and storing the encrypted first data in one or more disks of the distributed datastore, the one or more disks belonging to the plurality of hosts.

Encryption in a distributed storage system utilizing cluster-wide encryption keys

The disclosure herein describes converting a disk cluster to a different format. A format conversion instruction associated with a disk cluster is received. A first subgroup of disks of the disk cluster that are the emptiest disks of the disk cluster are identified and all data is evacuated from the first subgroup of disks to other disks of the disk cluster. The first subgroup of disks is reformatted based on the received format conversion instruction. A group of data objects stored in the disk cluster is converted based on the format conversion instruction and the converted group of data objects are written to the reformatted first subgroup of disks. The process iterates through the disks of the disk cluster to reformat all disks and convert all data objects based on the received format conversion instruction. The process reduces the write operations required to convert the format of the disk cluster.

Converting the format of a distributed object storage with reduced write operations

The present disclosure relates to bootstrapping an encrypted single node VSAN cluster. One method includes receiving a request to create an encrypted VSAN cluster from a single host in a software-defined datacenter, deploying a virtual server on a VSAN datastore of the software-defined datacenter, registering a native key provider (NKP) in the virtual server, creating an empty VSAN cluster encrypted by the NKP, adding the single host to the encrypted empty cluster to create a one-host encrypted cluster, registering a KMIP KMS in the virtual server, switching encryption of the one-host encrypted cluster from the NKP to the KMIP KMS, and adding another host to the one-host encrypted cluster to create the encrypted cluster.

Bootstrapping an encrypted single node VSAN cluster

An example method for a first host, being an owner of an object stored in a virtual storage area network (vSAN) cluster, to perform encryption and decryption operations during a rekey in the vSAN cluster is disclosed. The method includes obtaining a first encryption key and a first key identifier (ID) of the first encryption key; transmitting the first key ID and an active key index to a second host; using the first encryption key to perform encryption and decryption operations; and in response to a determination of receiving a key change notification from a master node of the vSAN cluster, terminating a connection with the second host.

Method and system to perform encryption and decryption operations during rekey in virtualized computing environment

Distributed storage system and method for transmitting storage-related messages between host computers in a distributed storage system uses a handshake operation of a first-type communication connection between a source data transport daemon of a source host computer and a target data transport daemon of a target host computer to derive a symmetric key at each of the source and target data transport daemons. The two symmetric keys are sent to a source data transport manager of the source host computer and to a target data transport manager of the target host computer. The source and target data transport managers then use the same symmetric keys to encrypt and decrypt storage-related messages that are transmitted from the source data transport manager to the target data transport manager through multiple second-type communication connections between the source and target data transport managers.

Distributed storage system and method of reusing symmetric keys for encrypted message transmissions

Example methods and systems to perform a migration of a virtualized computing instance and its first snapshot hierarchy from a first object store to a second object store have been disclosed. One example method includes identifying a first disk chain of the first snapshot hierarchy having an object running point, identifying a second disk chain of the first snapshot hierarchy different from the first disk chain, and migrating the second disk chain from the first object store to the second object store to form a first branch of a second snapshot hierarchy in the second object store. After the migrating, the example method includes instructing to take a first native snapshot on the object running point in the second object store, instructing to revert the object running point along the first branch and migrating the first disk chain from the first object store to the second object store.

Migration of virtualized computing instance with multiple disk chains in virtualized computing environment

A distributed system, such as a distributed storage system in a virtualized computing environment and having storage nodes arranged in a cluster, is provided by management server with a transition period between non-encryption and encryption modes of operation. The transition period enables all of the nodes to complete a transition from the non-encryption mode of operation to the encryption mode of operation, without loss of data-in-transit (DIT). An auto-remediation feature is provided by the management server to the cluster, so as to fix inconsistent state(s) of one or more nodes in the cluster.

Workflow for enabling data-in-transit in a distributed system

A method of enhancing security in object based datastores is provided. The method mounts first and second datastores identified, respectively, by first and second datastore identifiers. The first and second datastores include, respectively, first and second namespace objects that are mapped to first and second subfolders in the first and second datastores. A first file within the first subfolder references a first object via a first object identifier, while a second file within the second subfolder references a second object via a second object identifier. The first and second objects are tagged with the first and second datastores' identifiers. The first and second datastores share an underlying storage and may be configured to have separate access permissions. The method receives a command to access the first object via a datastore identifier, compares the datastore identifier with the first datastore identifier, and if they match, allows access to the first object.

Providing enhanced security for object access in object-based datastores

Example methods are provided for unbalanced storage resource usage configuration for a distributed storage system in a virtualized computing environment. An example method may include obtaining usage data associated with multiple storage resources forming the distributed storage system. The multiple storage resources are supported by the multiple hosts. Based on the usage data, the method may further include determining a higher usage set and a lower usage set of one or more storage resources from the multiple storage resources and configuring the multiple hosts to use the multiple storage resources in an unbalanced manner by using the higher usage set of one or more storage resources at a higher usage level compared to the lower usage set of one or more storage resources.

Unbalanced storage resource usage configuration for distributed storage systems

A distributed storage system, such as a distributed storage system in a virtualized computing environment, stores data in storage nodes as immutable key-value entries. A coordinator storage node creates a key-value entry and attempts to store the key-value entry in the coordinator storage node and in neighbor storage nodes. If the storage of the key-value entry in the in the coordinator storage node and in the neighbor storage node is successful, the coordinator storage node pushes the key-value entry to other storage nodes in the distributed storage system for storage as replicas.

Storage of key-value entries in a distributed storage system

Balancing resource usage for client applications workload and data merge optimization of the backend for both a local merge within one server and a merge across multiple servers is determined based on previous resource usage pattern in a distributed storage system.

Planning of data segment merge for distributed storage system

Embodiments relate to cube construction. According to a method, a plurality of valid history queries that request to retrieve a cube comprising a first number of cuboids in an On-Line Analytical Processing (OLAP) system are collected. A plurality of dimension combinations is acquired from the plurality of valid history queries. A query frequency of each cuboid of a second number of cuboids with the plurality of dimension combinations is determined, the second number of cuboids being a subset of the first number of cuboids. A cuboid construction sequence for the second number of cuboids is determined based on the query frequency. The cube is constructed based on the cuboid construction sequence.

Cube construction for an OLAP system

Example methods are provided for unbalanced storage resource usage configuration for a distributed storage system in a virtualized computing environment. The method may comprise: obtaining usage data associated with multiple storage resources forming the distributed storage system; and based on the usage data, determining a higher usage set and a lower usage set from the multiple storage resources. The method also comprise configuring the multiple hosts to use the multiple storage resources in an unbalanced manner by using the higher usage set at a higher usage level compared to the lower usage set.

Methods and apparatuses for creating a dynamic profile for a plurality of structurally similar extensible markup language (XML) documents based at least in part on a document structure or data pattern of the XML documents. A specialized XML parser is generated based at least in part on the dynamic profile and then is specialized in parsing XML documents that substantially match the dynamic profile.

Growing community of inventors

Shanghai, China

Tao Xie