Microsoft Technology Licensing, LLC

Oracle International Corporation

Vadim Makhervaks

Bjorn Dag Johnsen

Richard P Mousseau

Aaron William Ogus

David Brean

Sumanta Kumar Chatterjee

Kant C Patel

Avneesh Pant

Jason David Adrian

Bhaskar Mathur

Sudeep Vatsanath Reguna

Yi Yuan

Jacob Kappeler Oshins

Scott Chao-Chueh Lee

Ioan Oltean

Madhav Himanshubhai Pandya

Oren Ish-am

Rajsekhar Das

Bjørn Dag Johnsen

Feroz Alam Khan

Jean De Lavarene

Michael Konstantinos Papamichael

Laura Marie Caulfield

Lee Edward Prewitt

Yevgeny Yankilevich

Robert Groza, Jr

Matthew G Humphrey

Garret Buban

Omar Carey

Bryan Stephen Matthew

Hari Angepat

Orr Srour

Yuxing Zhou

Yingrui Tong

Zhihao Liu

Xigeng Sun

Junxiang Wang

Sijia Huang

Bangzhu Zhu

Requests for a write storage operation are stored in a ring buffer. The next available request is retrieved from the ring buffer. When the next available request comprises a write operation that overlaps in a logical address range with a previous request stored in the ring buffer, the next available request is suspended. The next available request and the previous request are merged to generate a single request that includes logical address ranges of the next available request and the previous request.

Log-based block cache de-stage and backend storage

A computing system uses Advanced Encryption Standard XEX Based Tweaked Codebook Mode with Ciphertext Stealing (AES-XTS) encryption to encrypt a block of data using a tweak key, a data key, a modified tweak value, and the block of data to thereby generate an encrypted block of data. The modified tweak value is computed according to the expression DEC(0, CONST KEY), where DEC is an AES decryption algorithm, and CONST KEY is the tweak key. The encrypted block of data is thereby formatted according to the Advanced Encryption Standard with no extended mode and not according to the XEX Based Tweaked Codebook Mode with Ciphertext Stealing.

Encryption system and method

A server system is provided that includes one or more compute nodes that include at least one processor and a host memory device. The server system further includes a plurality of solid-state drive (SSD) devices, a local non-volatile memory express virtualization (LNV) device, and a non-transparent (NT) switch for a peripheral component interconnect express (PCIe) bus that interconnects the plurality of SSD devices and the LNV device to the at least one processor of each compute node. The LNV device is configured to virtualize hardware resources of the plurality of SSD devices. The plurality of SSD devices are configured to directly access data buffers of the host memory device. The NT switch is configured to hide the plurality of SSD devices such that the plurality of SSD devices are not visible to the at least one processor of each compute node.

Local non-volatile memory express virtualization device

Embodiments of the present disclosure include systems and methods for providing a scalable controller for managing data storages. A system includes a non-volatile memory controller comprising a set of data queues and a set of administrative queues. The system also includes a set of physical storages communicatively coupled to the non-volatile memory controller. A set of logical storages are created from the set of physical storages. A primary non-volatile memory controller is created from the non-volatile memory controller. The primary non-volatile memory controller comprising an administrative queue in the set of administrative queues, a first subset of the set of data queues, and a first subset of the set of logical storages. An extended non-volatile memory controller is created from the non-volatile memory controller. The extended non-volatile memory controller comprising a second subset of the set of data queues and a second subset of the set of logical storages.

Scalable controller for managing data storages

Methods, systems, apparatuses, and computer program products are provided herein for rendering secured content. For instance, a computing device may be utilized to view content that is to be displayed via a display device coupled thereto. However, rather than rendering the content, the computing device generates and/or provides a graphical representation of the content to a rendering device coupled between the computing device and the display device. The rendering device analyzes the graphical representation to determine characteristics of the graphical representation, characteristics of a display region of an application window in which the content is to be rendered, and a network address at which the actual content is located. The rendering device retrieves the content using the network address and renders the retrieved content over the display region of the application window in accordance with the characteristics determined for the graphical representation and the display region of the application window.

Systems and methods for rendering secured content items

A computing system uses AES-XTS encryption to encrypt data of a first part of first data stream using a tweak key, a data key, an initial tweak value, in a first encryption session, store the encrypted first part, then encrypts a second part of the first data stream in a second encryption session commenced after the termination of the first encryption session; and store the encrypted second part in the encrypted data store. The second part of the first data stream is encrypted using a modified tweak value computed based on the initial tweak value, the tweak key, and a block index of a last cipher block of the first part of the first data stream.

System and method for incremental encryption

Zone hints for use with a zoned namespace (ZNS) storage device. Zone hints include one or more of a first hint indicating that a zone is part of a group of a plurality of zones, a second hint indicating that the zone is to be fast-filled, or a third hint indicating that the zone is associated with a background operation. The first hint is structured to instruct the ZNS storage device to allocate to the zone a first storage resources that are physically adjacent to second storage resources reserved for others of the plurality of zones. The second hint is structured to instruct the ZNS storage device to bypass a staging area when writing to the zone. The third hint is structured to instruct the ZNS storage device to deprioritizing at least one operation writing to the zone, or to bypass the staging area when writing to the zone.

Zone hints for zoned namespace storage devices

Techniques are disclosed for implementing direct memory access in a virtualized computing environment. A new mapping of interfaces between RNIC Consumer and RDMA Transport is defined, which enables efficient retry, a zombie detection mechanism, and identification and handling of invalid requests without bringing down the RDMA connection. Techniques are disclosed for out of order placement and delivery of ULP Requests without constraining the RNIC Consumer to the ordered networking behavior, if it is not required for the ULP (e.g., storage). This allows efficient deployment of an RDMA accelerated storage workload in a lossy network configuration, and reduction in latency jitter.

RDMA transport with hardware integration

RDMA transport with hardware integration and out of order placement

A technique is described herein for updating the logic used by a hardware accelerator provided by a computing device. In one implementation, the technique provides a pass-through mode which allows a virtual machine (provided by the computing device) to directly interact with the hardware accelerator. Upon the commencement of an updating operation, the technique instructs an emulator to begin emulating the function(s) of the hardware accelerator and the resultant effects of these functions, without interaction with the actual hardware accelerator. When the updating operation finishes, the technique re-enables the pass-through mode. By virtue of the above-summarized manner of operation, the technique allows the computing device to perform the function(s) associated with the hardware accelerator while the hardware accelerator is being updated. In one case, the technique disables the pass-through mode by modifying address-mapping information used by the virtual machine to access system physical addresses.

Updating hardware with reduced virtual machine downtime

An append-only streams capability may be implemented that allows the host (e.g., the file system) to determine an optimal stream size based on the data to be stored in that stream. The storage device may expose to the host one or more characteristics of the available streams on the device, including but not limited to the maximum number of inactive and active streams on the device, the erase block size, the maximum number of erase blocks that can be written in parallel, and an optimal write size of the data. Using this information, the host may determine which particular stream offered by the device is best suited for the data to be stored.

Append only streams for storing data on a solid state device

A system and method can provide a data service in a network environment. The system can provide a data service component on a node in the network environment, wherein the network environment includes a plurality of nodes interconnected via a network fabric. Furthermore, the system can use a native packet forwarding mechanism to direct a data flow in the network fabric to said data service component on the node. Then, the system can use said data service component to process one or more data packets in the data flow in the network fabric.

System and method for providing a data service in an engineered system for middleware and application execution

An integrated firewall provides security in a multi-tenant environment having a connection-based switched fabric directly connecting database servers which provide a plurality of database services with application servers hosting database service consumers each having a different database service consumer identity. The firewall functionality integrated into each database server provides access control by discarding communication packets which do not include a database service consumer identity and using the database service consumer identity in combination with an access control list to control access from the database service consumers to the database services. The access control includes address resolution access control, connection establishment access control, and data exchange access control based on said access control list. The integrated firewall enables direct connection of database servers and application servers via an InfiniBand network providing without requiring a separate intermediary firewall appliance or security node.

System and method for providing an integrated firewall for secure network communication in a multi-tenant environment

Growing community of inventors

Bellevue, WA, United States of America

Vadim Makhervaks