Emc IP Holding Company LLC

Emc Corporation

Agami Systems, Inc.

Terry Gene Hahn

Subhasish Chakraborty

Hongyu Zhang

Shobhan Chinnam

Ravi V Chitloor

George Mathew

William John Earl

David Lin

Shefali Gautam

Thomas Alan Bean

Shufeng Huang

Manish Chhabra

Shruthi Herale

Dhanabal Ekambaram

Xiaoyin Hu

Rodney Edward Radford

Sunil Prabhakar

Catherine E Agbaw

David Alexander Darling

Embodiments are directed to a load balancer process for use in a deduplication backup process implemented in a cluster system that provides ideal placement of the Mtrees on the expanded capacity by monitoring the available capacity and providing recommendations on the best node to place newly created Mtrees. Continuous monitoring of the capacity and activity level of the nodes helps identify the appropriate node to place a new Mtree. The monitoring of existing node in the cluster and balancing capacity by recommending migration of files from heavily-utilized nodes to under-utilized nodes produces an overall increase in cluster performance.

Scale out capacity load-balancing for backup appliances

Embodiments for managing access to Mtrees using a mechanism through the use of net groups that contain a pool of IP addresses with configuration information that is automatically propagated to new nodes as they are added to a defined net group to facilitate zero configuration when scaling a network. Using net groups, access to an Mtree across nodes in a data center or similar network can be managed with a group of IP addresses spread across all the nodes in the cluster as a single net group entity. The net group provides flexibility to create multiple net groups that can be used to manage the appliance in management, diagnostic, data, and interconnect domains. It allows flexibility to manage the access to Mtree from different networks and security domains, and allows a user to configure the network attributes of all the IP addresses as a single entity.

Network configuration method to allow access to the backup and restores to Mtrees on a clustered backup appliance

A data storage device includes advertised internet protocol (IP) addresses, a logical data storage, and a resource request processor. The logical data storage includes an object storage. The resource request processor obtains a data access request that includes a destination IP address and that requests a portion of data stored in the object storage. The resource request processor makes a determination to allow access to the portion of the data based on a multifactor authorization. The multifactor authorization is based, at least in part, on an association between the destination IP address and the portion of the data. In response to the determination, resource request processor provides the portion of the data to a requestor specified in the data access request.

System and method for local data IP based network security for preventing data breach attempts in a multi-tenant protection storage deployment

A first request is received from a first user to access a first file system management objects (FSMOs) of a first tenant unit (TU), the first TU being one of a plurality of TUs. The first FSMO is one of a plurality of FSMOs, each FSMO containing namespace information of a particular tenant. In response to the first request, it is determined whether the first user is authorized to access the first FSMO, including identifying TUs that are associated with the first user, determining whether the first TU is included in the TUs, and if so, determining whether the first FSMO is included in FSMOs associated with the first TU. In response to determining that the first FSMO is included in a set of one or more FSMOs that are associated with the first TU, the first user to access the first FSMO is allowed.

System and method for secure multi-tenancy in datadomain operating system (DDOS), a purpose built backup appliance (PBBA) operating system

A method for replicating data from a plurality of storage systems to a target storage system. The method implemented at the target storage system receives a replication request to replicate data from a source storage system to the target storage system, where the target storage system stores data replicated from the plurality of source storage systems. In response to the replication request, the target storage system identifies a replication resource limit associated with the data to be replicated from the source storage system. The target storage system then determines whether a replication resource requested by the replication request has exceeded the replication resource limit. The target storage system thus allows the replication resource to replicate data from the source storage system, in response to the replication resource not exceeding the replication resource limit.

System and methods for replication resource management in asymmetric secure multi-tenancy deployments in protection storage

A data storage device includes egress ports, a logical data storage, and a packet processor. The local data storage includes resources allocated to multiple tenants. The packet processor obtains packets that include data stored in the resources of the logical data storage. The obtained packets are addressed to a packet destination. The packet processor selects an egress port of the egress ports based on mappings between the data and the multiple tenants. The packet processor sends the packets via the selected egress port.

System and method for physical data packets isolation for different tenants in a multi-tenant protection storage environment

A request is received from a client device of a user for configuring a tenant of a multi-tenant storage system, the multi-tenant storage system storing data for different tenants. An entity identifier (ID) identifying an entity to be associated exclusively with the tenant is obtained from the request. A lookup operation is performed based on the entity in an SMT registry namespace cache stored in a memory to locate an entry that matches the entity. If no matching entry is found, the request is allowed. If a matching entry is found, a first tenant ID obtained from the request is compared with a second tenant ID stored in the matching entry. The request to configure the tenant is allowed if the first tenant ID matches the second tenant ID. The request is denied if the first tenant ID does not match the second tenant ID.

System and method for ensuring per tenant mutual exclusion of data and administrative entities with low latency and high scale

Exemplary methods for providing secure multi-tenancy in a Purpose Built Backup Appliance include creating a set of tenant-units (TUs), associating file system management objects (FSMOs) and users with the TUs. The methods further include maintaining a protocol config-metadata store based on the association of the FSMOs and users with the TUs. In one embodiment, in response to a first request from a first user to access a first FSMO of a first TU, the methods include determining whether the first user is authorized to access the first FSMO based on information of the protocol config-metadata store, and in response to the protocol config-metadata store indicating the first user is authorized to access the first FSMO, allowing the first user to access the first FSMO.

System and method for secure multi-tenancy in an operating system of a storage system

A native protection storage operating system (PSOS) process receives a request specifying an operation having security related implications for elements in the PSOS having a first set of components handling data transfer operations and a second set of components handling configuration operations. A security component stores an identifier of the requester and a security related information element locally within a storage location of the first or second set of components, and accesses, upon receiving the request, the security related information element and requester identifier to match other elements of the network impacted by the request, and performs a security condition specific check to determine whether or not the request is to be allowed or denied. The native process eliminates a need for caching, locking, and chain propagation of the security related information through the PSOS.

Cache-free and lock-free handling of security information for multiple distributed objects in protection storage systems

A system and method for managing software upgrades in a distributed computing system. The distributed computing system may include a plurality of nodes which provide one or more fault-tolerant services. The system and method perform software upgrades in a sequential or 'rolling' manner (e.g., node by node). The rolling upgrade process allows all services and data of the distributed computing system to remain operable and available throughout the upgrade process.

Growing community of inventors

Los Altos, CA, United States of America

Terry Gene Hahn