Abstract: A cloud statistics server generates statistics for a cloud service based on an identified data item and an identified operation. The cloud service may include various computing nodes and storage nodes. The cloud statistics may include expected completion times for the identified operation and the identified data item with respect to each of the computing nodes. A computing node may be selected to execute the identified operation based on the expected completion times. The generated statistics may be generated by the cloud statistics server using a network topology associated with the data item that is based on the latencies or expected transfer times between the various storage nodes and computing nodes, and a replication strategy used by the cloud service. The topology may be implemented as a directed graph with edge weights corresponding to expected transfer times between each node.

Abstract: To determine files associated with one or more workflows, a trace of accesses of files in at least one server is received. The files are grouped into at least one set of files, where the files in the set are accessed together more than a predetermined number of times in the trace. Files associated with the particular workflow are identified based on the at least one set.

Abstract: A method and a system of improving recoverability of a dataset associated with a multi-tier storage system are provided. Updates to a dataset are stored in first storage. The dataset and a point-in-time copy of the dataset reside on second storage, and the first storage provides higher reliability than the second storage. The dataset is restored using at least a subset of the stored updates in combination with the point-in-time copy in the event that the dataset is lost.

Abstract: Preventing replay attacks on servers. At least one Bloom filter may be set up in a server for tracking requests received from clients. Identifying data may be generated for each request. The identifying data may be checked against the Bloom filter array. If a match is found, the message may be a replay and may be rejected. If a match is not found, the request identifying data may be added to the Bloom filter and the request may be processed.

Abstract: To perform information tracing, at least one signature to be traced is received. It is detected that a first process causes data to be provided to at least one of a second process and a file. It is determined whether the data contains the at least one signature. In response to determining that the data contains the at least one signature, a log is updated. The log contains information identifying at least one of processes and files that are part of a flow of the at least one signature.

Abstract: A remote procedure call chain is provided that replaces multiple consecutive remote procedure calls to multiple servers from a client by allowing a client to specify multiple functions to be performed consecutively at multiple servers in a single remote procedure call chain. The remote procedure call chain is executed by a sequence of multiple servers. Each server executes a service function and a chaining function of the remote procedure call chain. The chaining function uses the state of the remote procedure call chain in the sequence of servers to determine the next server to receive the remote procedure call chain, and the service function to be executed by that server. After the last service function is performed, the last server in the sequence of servers sends the results of the executed service functions to the client that originated the remote procedure call chain.

Abstract: In accordance with an embodiment of the invention, a method of writing and reading redundant data is provided. Data is written by storing a copy of the data along with a timestamp and a signature at each of a set of storage devices. The data is read by retrieving the copy of the data, the timestamp and the signature from each of a plurality of the set of data storage devices. One of the copies of the data is selected to be provided to a requestor of the data. Each of the storage devices of the set is requested to certify the selected copy of the data. Provided that a proof of certification of the selected copy of the data is valid, the storage devices of the set are instructed to store the selected copy of the data along with a new timestamp.

Abstract: To determine files associated with one or more workflows, a trace of accesses of files in at least one server is received. The files are grouped into at least one set of files, where the files in the set are accessed together more than a predetermined number of times in the trace. Files associated with the particular workflow are identified based on the at least one set.

Abstract: A transactional shared memory system has a plurality of discrete application nodes; a plurality of discrete memory nodes; a network interconnecting the application nodes and the memory nodes, and a controller for directing transactions in a distributed system utilizing the shared memory. The memory nodes collectively provide an address space of shared memory that is provided to the application nodes via the network. The controller has instructions to transfer a batched transaction instruction set from an application node to at least one memory node. This instruction set includes one or more write, compare and read instruction subsets, and/or combinations thereof. At least one subset has a valid non null memory node identifier and memory address range. The memory node identifier may be indicated by the memory address range.

Abstract: Provided is a system and method for directing group communication in a system environment that has a plurality of discrete application nodes networked with at least one discrete memory node, establishing a shared memory providing a passive message queue. A code library permits an application node member of a group to assemble a message selected from the group of send, join, leave, or read. The send, join and leave messages permit a first application node to add a message to the queue for all members of a group including the first application node at the time the message was added. The instruction set permitting the addition of the message is executed atomically.

Abstract: Embodiments of the present invention pertain to improving recoverability of a dataset associated with a multi-tier storage system. According to one embodiment, updates to a dataset are stored in first storage. The dataset and a point-in-time copy of the dataset reside on second storage, and the first storage provides higher reliability than the second storage. The dataset is restored using at least a subset of the stored updates in combination with the point-in-time copy in the event that the dataset is lost.

Abstract: A method, and associated apparatus, comprises calculating a first part of a message authentication function by a first processor, calculating a second part of the message authentication function by a second processor, and combining the first and second parts into the message authentication function by the first or second processor. The message authentication function can be used to authenticate data transmitted between the first processor and a third processor.

Abstract: Embodiments include methods, apparatus, and systems for snapshots in distributed storage systems. One method of software execution includes using a version tree to determine what data blocks are shared between various storage nodes in the version tree in order to create a clone or a snapshot of a storage volume in a distributed storage system that uses quorum-based replication.

Abstract: Provided is a system and method for directing group communication in a system environment that has a plurality of discrete application nodes networked with at least one discrete memory node, establishing a shared memory providing a passive message queue. A code library permits an application node member of a group to assemble a message selected from the group of send, join, leave, or read. The send, join and leave messages permit a first application node to add a message to the queue for all members of a group including the first application node at the time the message was added. The instruction set permitting the addition of the message is executed atomically.

Abstract: A transactional shared memory system has a plurality of discrete application nodes; a plurality of discrete memory nodes; a network interconnecting the application nodes and the memory nodes, and a controller for directing transactions in a distributed system utilizing the shared memory. The memory nodes collectively provide an address space of shared memory that is provided to the application nodes via the network. The controller has instructions to transfer a batched transaction instruction set from an application node to at least one memory node. This instruction set includes one or more write, compare and read instruction subsets, and/or combinations thereof. At least one subset has a valid non null memory node identifier and memory address range. The memory node identifier may be indicated by the memory address range.

Abstract: A system for protecting data integrity in a network attached block-device, such as a disk or a disk array, includes a capability issuer module coupled to a metadata server. The capability-issuer module creates capability data in accordance with a predetermined set of rules, and issues the capability data to the client over a secured channel. The capability data includes a group identifier, a capability identifier, a block-device identifier, a list of extents for specifying a range of blocks to which access is granted, an access mode for indicating the type of access allowed, and a cryptographic string for preventing forgery of capabilities by unauthorized parties. A capability checker module coupled to a network attached block-device verifies that the client's block access request is consistent with the capability data issued, and that the capability data is authentic. Upon verifying the client's capability data, the client's block access request is granted and executed at the network-attached block-device.

Abstract: A method for managing access control of a resource includes storing a revocation list containing a list of revoked capabilities and their corresponding groups; storing a group list containing a list of valid groups; receiving a capability revocation request to revoke a specified capability; selecting a revocation method from among a plurality of revocation methods, including an individual capability revocation method and a group revocation method; revoking the specified capability by invalidating the group to which the specified capability belongs if the group revocation method is selected; and revoking the specified capability by invalidating only the specified capability if the individual capability revocation method is selected.

Abstract: The Heartbeat Failure Detector of the present invention, is a new, simple method and device that has several identical modules, and each module is attached to a processor in the system. Roughly speaking, the module of a processor x maintains a heartbeat counter for every other process. For each process y, the counter of y at x (called the heartbeat of y at x) periodically increases while y is alive and in the same network partition, and the counter stops increasing after y crashes or becomes partitioned away. Using such a device, x can solve the communication problem above by resending m only if the heartbeat of y at x increases. Note that if y is crashed (or partitioned away from x), its heartbeat at x stops almost immediately, and so x will also immediately stop sending copies of m to y.

Abstract: New failure detector mechanisms particularly suitable for use in asynchronous distributed computing systems in which processes may crash and recover, and two crash-recovery consensus mechanisms, one requiring stable storage and the other not requiring it. Both consensus mechanisms tolerate link failures and are particularly efficient in the common runs with no failures or failure detector mistakes. Consensus is achieved in such runs within 3□ time and with 4n messages, where □ is the maximum message delay and n is the number of processes in the system.