Emc Corporation

Digital Equipment Corporation

Yoav Raz

Steven M Blumenau

Natan Vishlitzky

Philip E Tamer

Michel F Fisher

David C Butchart

Ruben Michel

Bruno Alterescu

Yechiel Yochai

Tao Kai Lam

Walter M Caritj

Yeshayahu Hass

Allan L Scherr

Avigail Matalon

Musik Schreiber

Douglas V Johnson

A method for pre-fetching database records from a database includes identifying an index record containing index entries that identify those database records. This information is then retrieved from the index entries and used to pre-fetch the database records.

Pre-fetch of records identified by an index record

Scanning a storage device for viruses includes determining physical portions of the storage device that have been modified since a previous virus scan and scanning at least parts of the physical portions for viruses. The physical portions may correspond to tracks of the storage device, sectors of the storage device, and/or to subportions of the storage device. Determining the physical portions of the storage device that have been modified may include creating a table that is indexed according to each of the portions and has entries indicating whether a corresponding one of the portions has been modified, the entries being cleared after a virus scan to indicate that no portions have been modified and setting a specific one of the entries in response to a corresponding one of the portions of the storage device being subject to a write operation. Creating the table may include copying an other table provided by the storage device and/or using an other table provided by the storage device.

Physical scanning of storage based apparatus for antivirus

Detecting computer viruses includes providing a disk space having at least a portion that is partitioned into separate segments, each segment being accessed by at least one of a plurality of hosts. A first one of the segments is accessed using a different file system than a second one of the segments. An antivirus unit scans at least part of the disk space for viruses. The part of the disk space that is scanned by the antivirus unit includes at least some parts of the first and second segments. The first and second segments may correspond to different physical portions of the disk space. The first and second segments may or may not overlap. The first and second segments may correspond to logical entities. Part of the disk space that is scanned by the antivirus unit may correspond to particular types of files stored in the disk space. The disk space that is scanned by the antivirus unit may correspond to files that have been modified since a previous virus scan.

Storage based apparatus for antivirus

An object is authenticated by transmitting a random number to the object. The object has an integrated circuit chip including a memory and encryption circuitry. The memory stores information defining an encryption scheme preassigned to the object. The encryption circuitry reads the memory, and encrypts the random number according to the encryption scheme defined by the information read from the memory to produce encrypted data. The memory cannot be read from any output of the integrated chip, and the chip is constructed so that it is virtually impossible to recover the information contained in the memory by visual inspection, probing, or disassembly of the chip. The object is authenticated by checking whether the encrypted data is a correct result of encrypting the data using the encryption scheme pressigned to the object.

Electronic device for secure authentication of objects such as computers in a data network

An apparatus has host ports for coupling hosts to data storage devices. The data storage devices are configured into logical storage units, and the apparatus is programmed with a mapping of the hosts to respective logical storage units. The apparatus decodes a host identifier and a logical storage unit specification from each data access request received at each host port, and determines whether or not the decoded host identifier and logical storage unit specification are in conformance with the mapping in order to permit or deny data access of the logical storage unit through the host port. For example, the apparatus includes a switch for routing the data storage access requests from the host ports to ports that provide access to the data storage, and a set of logical volumes of storage are accessible from each of the ports that provide access to the data storage.

Mapping of hosts to logical storage units and data storage ports in a data processing system

A storage controller has at least one physical data port for a data network including host processors. The storage controller is programmed to provide a plurality of virtual ports for access to storage, and a virtual switch for routing storage access requests from the physical port to the virtual ports. The virtual ports and the virtual switch are defined by software. The virtual ports appear to the hosts as physical ports in the data network. For example, in a Fiber-Channel network, the virtual ports have World Wide Names (WWNs) and are assigned temporary addresses (S_IDs), and the virtual switch provides a name server identifying the WWNs and S_IDs of the virtual ports. For convenient partitioning of storage among host processors, one or more virtual ports are assigned to each host, and a set of storage volumes are made accessible from each virtual port.

Virtual ports for partitioning of data storage

A storage controller for controling access to data storage has a memory and at least one data port for a data network including host processors. The memory is programmed to define a respective specification for each host processor of a respective subset of the data storage to which access by the host processor is restricted, and each specification is associated with a host identifier stored in the memory. When the storage controller receives a data access request from a host processor, it decodes a host identifier from the data access request, and searches the memory for a host identifier matching the host identifier decoded from the request. Upon finding a match, the respective specification of the respective subset for the host processor is accessed to determine whether or not storage specified by the storage access request is contained in the respective subset. If so, then storage access can continue, and otherwise, storage access is denied. Preferably the host identifier decoded from the request is a temporary address assigned by the network, and also stored in the memory in association with each respective specification is a relatively permanent identifier for the host processor.

Storage mapping and partitioning among multiple host processors

Described are techniques for determining temporary storage areas for logical volumes to be swapped. Logical volumes may be swapped in a computer system in connection with efforts to improve performance of associated data storage entities in the computer system. As part of the data swapping and physical relocation of logical volumes, temporary storage locations are used. A temporary storage location is associated and used with each logical volume being swapped. Determining a temporary storage area for a logical volume may be made in accordance with particular criteria. A temporary storage area is determined for each logical volume from a list of one or more possible candidate locations. The problem of matching a logical volume to a unique temporary storage area may be represented as a bipartite graph matching problem using solutions, such as the maximum flow, and other techniques to find a match for each logical volume.

Method and apparatus for determining volume swaps

A data network includes a switch that links a number of host processors to shared resources such as network ports of a cached storage subsystem. The switch routes resource requests from its inputs to selected ones of its outputs in accordance with programmed routing information. The routing information is changed dynamically based on measured loading characteristics of requests from the switch inputs or the respective hosts, in order to reduce the probability of blocked paths. In a specific example, respective subsets of output ports of the switch are assigned to each respective input port, the loading of each input port of the switch is measured, and the respective subset of output ports assigned to each input port are repetitively changed, and the respective subset of an input port is changed in response to blocking of the output ports assigned to the input port. A respective subset is selected based on the measured loading characteristics and a priority assigned to the input port, in order to balance loading on the output ports. In another specific example, a respective subset of the output ports is assigned to each host, based on host loading characteristics and a respective priority assigned to each host.

Dynamic routing for performance partitioning in a data processing network

In a data storage subsystem providing data storage to host processors, a process of configuration defines a subset of the data storage that each host may access. A vector specification is a convenient mechanism for specifying a set of storage volumes that a host may access. For example, for each host processor, there is stored in memory of the data storage subsystem a list of contiguous ranges or vectors of the storage volumes that the host may access. To determine whether or not a specified logical volume number is included in the vector, a mudulus of the stride of the vector is computed from the difference between the address of the specified logical volume and the beginning address of the vector, and the modulus is compared to zero. To provide a mapping between logical unit numbers specified by the host and the logical volumes, a contiguous range of logical unit numbers may also be specified for each contiguous range or vector of storage volumes. The logical volume number is computed from a specified logical unit number by computing a difference between the specified logical unit number and the beginning logical unit number, multiplying the difference by the stride of the vector to produce a product, and adding the product to the beginning address of the vector.

Configuring vectors of logical storage units for data storage partitioning and sharing

An object is authenticated by transmitting a random number to the object. The object has an integrated circuit chip including a memory and encryption circuitry. The memory stores information defining an encryption scheme preassigned to the object. The encryption circuitry reads the memory, and encrypts the random number according to the encryption scheme defined by the information read from the memory to produce encrypted data. The memory cannot be read from any output of the integrated chip, and the chip is constructed so that it is virtually impossible to recover the information contained in the memory by visual inspection, probing, or disassembly of the chip. The object is authenticated by checking whether the encrypted data is a correct result of encrypting the data using the encryption scheme pressigned to the object. The method can be used in a data processing system to authenticate each message transmitted by a host processor to a data processing device. For example, when a host logs into the data processing device, the data processing device transmits a series of random numbers to the host. The host encrypts the random numbers to produce a series of encrypted data, and the data processing device concurrently encrypts the random numbers to produce a series of encrypted values. The host inserts respective encrypted data into each message, and the data processing device authenticates each message by comparing the encrypted data in the message to a corresponding encrypted value.

Authentication of a host processor requesting service in a data processing network

A method of communicating between first and second processes running on a plurality of host processors that are connected to a data storage system, the method including the steps of establishing a connection between the first and second processes through the data storage system; and by using the connection established through the data storage system, sending information between the first and second processes.

File transfer utility which employs an intermediate data storage system

A data network links a number of host processors to alternative shared resources. In order to allocate a respective subset of the alternative shared resources to each host, a directory service of the network is programmed to present a respective view of the network to each host. For example, hosts on the same network loop may see a different picture of the network. When a host logs into the network, the directory service reports to the host information about the alternative shared resources that the host should use. The host then commences a sequence of data processing operations during which the host accesses only the shared resources that were reported to it by the directory service. The shared resources, for example, are ports of a storage subsystem, and a respective subset of the ports is assigned to each host to balance loading of the hosts on the ports.

Load balancing using directory services in a data processing system

A storage controller has at least one physical data port for a data network including host processors. The storage controller is programmed to provide a plurality of virtual ports for access to storage, and a virtual switch for routing storage access requests from the physical port to the virtual ports. The virtual ports and the virtual switch are defined by software. The virtual ports appear to the hosts as physical ports in the data network. For example, in a Fiber-Channel network, the virtual ports have World Wide Names (WWNs) and are assigned temporary addresses (S_Ds), and the virtual switch provides a name server identifying the WWNs and S_IDs of the virtual ports. For convenient partitioning of storage among host processors, one or more virtual ports are assigned to each host, and a set of storage volumes are made accessible from each virtual port. A host can access storage at a virtual port only if the virtual port has been assigned to the host. Preferably, storage can be accessed through each virtual port by no more than one assigned host, although a shared volume may be accessible from more than one virtual port. The storage controller may provide a service for reporting to a host the virtual ports through which the host can access storage, and the storage volumes that are accessible to the host through each of the virtual ports.

Virtual ports for data transferring of a data storage system

A method of moving data between first, second, and third storage levels of a hierarchically arranged data storage system is described. The method includes the steps of dividing address space into a plurality of contiguous segments, each of which is further divided into a plurality of contiguous groups. Each of the groups may store a sequence of records, each of which is represented by a sequence of bytes. When it is necessary to move a designated record between the second and third levels of the data storage system, the segment in which that designated record is stored is moved; and when it is necessary to move the designated record between the first and second levels, the group in which that designated record is stored is moved.

Growing community of inventors

Newton, MA, United States of America

Yoav Raz