Abstract: The invention notably relates to a computerized system (301) comprising a storage system (302, 308) storing objects and attribute values associated to the objects. The attribute values are organized according to a set of N attribute types, N?1, such that, for each of said attribute types, an object can be associated with an attribute value. Each of said attribute types is associated to a respective graph. Each node of the respective graph is associated to a key. Said key is wrapped with a key associated to a parent node of said each node except for a root node. Also, said key is associated to one attribute value for the attribute type associated to the respective graph. Each of the objects is stored encrypted based on one or more keys. Each of said one or more keys is associated to one attribute value that is associated with said each of the objects. Such a system improves the deletion of objects stored on a storage system of a computerized system.

Abstract: Machines, systems and methods for handling a client request in a hierarchical multi-tenant data storage system, the method comprising processing a request in subtasks, wherein a subtask is executed with a minimal set of privileges associated with a specific subtenant; extracting a claimed n-level hierarchy of a tenant and sub-tenant identities from the request; extracting authentication signatures or credentials that correspond to a level in the hierarchy; for a first level in the hierarchy, sending the request to a dedicated subtenant authenticator with privilege to validate credentials for a subtenant at the first level; and receiving a confirmation from the dedicated subtenant authenticator, whether the request is authentic.

Abstract: A distributed system, machine and method in which execution of a client request is performed by entities located on multiple server nodes, the system comprising a proxy and guard component serving as sole communication exit and entry points on a source node and a target nodes respectively, wherein the source node hands off a request to the target node to service via the proxy and guard component; a mechanism via which the proxy locally extracts a set of tenant-related privileges associated with a client submitting the request for service; wherein the proxy sends the request to the guard via a secured network while attaching a description of the sender's set of tenant privileges to the request.

Abstract: Machines, systems and methods for controlling access to data stored on shared storage, servicing a plurality of tenants, the method comprising receiving a request from a first process to access a first data item associated with a first tenant in a multi-tenant data storage system, and providing access to the data item through a gatekeeper, in response to determining that the first process is associated with the first tenant.

Abstract: A computer-implemented method for storing an object includes providing an object, an ordering vector of the object, the ordering vector being associated to a lexicographic order having at least one dimension, and base keys associated to each dimension of the lexicographic order; deriving a key by retrieving the base key associated to the first dimension of the lexicographic order for which the ordering vector has a value different from the smallest value, and applying a one-way function a number of times corresponding to the value of the ordering vector for the last dimension of the lexicographic order; encrypting the object with the key; and storing the object as encrypted.