Emc IP Holding Company LLC

Udi Shemer

Kfir Wolfson

Assaf Natanzon

Amos Zamir

Amitai Alkalay

Zvi Schneider

Oron Golan

Aviram Fireberger

Embodiments for detecting malicious modification of data in a network, by: setting, by a first layer of network resources, a number of markers associated with input/output (I/O) operations of the network; saving the markers, location, and associated metadata in a marker database; reading, by a second layer of the network resources, the markers corresponding to relevant I/O operations; and verifying each scanned I/O operation against a corresponding marker to determine whether or not data for a scanned specific I/O operation has been improperly modified for the first and second layers and any intermediate layer resulting in a fault condition, and if so, taking remedial action to flag or abort the specific I/O operation.

Malicious data manipulation detection using markers and the data protection layer

An apparatus, in one example, comprises a storage system configured to perform one or more deduplication operations on encrypted datasets received for a plurality of tenants and store at least a portion of the encrypted datasets, the datasets having been encrypted for respective ones of the plurality of tenants using a common encryption key. The apparatus further comprises a cryptographic module associated with the storage system, the cryptographic module configured to, in response to a request to access an encrypted dataset stored by the storage system corresponding to a given one of the plurality of tenants, further encrypt the encrypted dataset using a tenant encryption key associated with the given one of the plurality of tenants. The storage system is further configured to send the further encrypted dataset to the given one of the plurality of tenants that requested access.

Multi-tenant deduplication with non-trusted storage system

Embodiments for providing memory for continuous data protection in a data storage system by storing a first key-value map as a data structure wherein the key is an address of a volume and the value comprises timestamp and hash value pairs for each time the address had data written thereto, and corresponding hash values of the written data, and storing a second key-value map as a data structure wherein the key comprises the hash value and the value comprises the written data. The first key-value map and second key-value map are implemented as a driver component in a server computer of the data storage system. The driver exposes a block device protocol on the server computer and leverages the key-value data structures for use with a deduplication storage system.

Fast key-value storage for continuous data protection systems

Embodiments for providing compare and swap (CAS) functionality to key value storage to allow multi-threaded applications to share storage devices and synchronize multiple concurrent threads or processes. A key-value application programming interface (API) is modified to include a CAS API in addition to the standard Put and Get APIs. The CAS function uses a key, expected old value, and new value to compare and swap an existing key value only if its current value equals the expected old value. Hash values of the key value and expected old value may be used by the CAS function to improve performance and reduce bandwidth.

Compare and swap functionality for key-value and object stores

Existing policies enforced at or above an operating system (OS) layer of a device are obtained. Translation rules are stored that include data structure descriptions of conditions, corresponding actions performed when the conditions are satisfied, and attributes specified in the existing policies, and attributes of one or more layers below the OS layer that are relevant to policy enforcement in the one or more layers below the OS layer. The existing policies are parsed using the data structure descriptions to identify the conditions, corresponding actions, and attributes specified in the existing policies. New policies are generated that are consistent with the existing policies. The new policies include the identified attributes specified in the existing policies and the attributes relevant to policy enforcement in the one or more layers below the OS layer. The new policies are enforced in the one or more layers below the OS layer.

Translating existing security policies enforced in upper layers into new security policies enforced in lower layers

Embodiments for providing continuous data protection in a data processing and storage system with a storage server and storage devices, by providing a solid state disk (SSD) device having a processor and non-volatile memory and an interface to a host device, providing a resident continuous data protection program on the SSD and executed by the processor, recording, for each write command, a memory address offset and a timestamp for the write command, and maintaining one of: an undo journal storing data in a location that is to be overwritten by the write command with the timestamp, or a log-structured file exposing a single large file as a volume to an upper layer of a host software stack for storing periodic snapshot backups of data created by the write command.

Growing community of inventors

Kfar Saba, Israel

Udi Shemer