Abstract: Disclosed herein are systems and method for moving a process from a host to a virtual machine (VM). In one exemplary aspect, a method comprises freezing the process at a host operating system (OS) of the host; transferring at least one kernel object of the process from the host OS to a VM OS of the VM; reconfiguring at least one input-output (IO) resource of the process to point to a host-VM channel such that data flow between the host and the VM is enabled; remapping at least one page of the memory into the VM OS; in response to determining that at least one library mapped into the process matches between the host OS and the VM OS, configuring a corresponding memory map of the process to point to at least one library in the VM OS; and unfreezing the process at the VM OS.

Abstract: Disclosed herein are systems and method for moving a process from a host to a virtual machine (VM). In one exemplary aspect, a method comprises freezing the process at a host operating system (OS) of the host; transferring at least one kernel object of the process from the host OS to a VM OS of the VM; reconfiguring at least one input-output (IO) resource of the process to point to a host-VM channel such that data flow between the host and the VM is enabled; in response to determining that the IO resource is a network socket and that the VM has network access, creating a network socket on the VM side and re-configuring a network connection of the VM; mapping memory utilized by the process to the VM by remapping at least one page of the memory into the VM OS; and unfreezing the process at the VM OS.

Abstract: Disclosed herein are systems and method for providing a File System (FS) without redundancy for one or more services. In one aspect, an exemplary method comprises, mounting a base image of microservices to a directory, for each of the one or more services, union-mounting a service image on top of the base image, identifying all dependencies associated with the service image, and creating one or more sub-directories for each dependency associated with the service image, for each identified dependency, creating a link between the dependency and the union-mounted service image and base image, and creating, one or more micro-services.

Abstract: Disclosed are systems and methods for execution of applications in a container. An exemplary method comprises receiving, by at least one computing device, a request to an application, wherein the application includes a set of instructions for processing the request, determining whether a state snapshot is available for the computing device, restoring state of the process from the state snapshot in a container on the computing device and processing the request based on the set of instructions by the process when the state snapshot is available, preparing at least one new process in the container on the computing device for processing the request, creating a new state snapshot for the application and processing the request based on the set of instructions by the new process when the state snapshot is not available, wherein creating the new state snapshot is performed after preparing the new process and before processing the request.

Abstract: A system and method is provided for providing distributed computing platform on untrusted hardware. An exemplary method includes launching a hypervisor on an untrusted computing node and receiving a request generated to provide a computing function using hardware of the untrusted computing node. Upon receiving the request, an enclave in memory of the untrusted computing node is created and a virtual machine is launched in the memory enclave. Moreover, a guest operating system of the virtual machine verifies the security of the untrusted computing node. Finally, the guest operating system performs the computing function using the hardware of the untrusted computing node upon the guest operating system verifying the security of the untrusted computing node and the hypervisor.

Abstract: Disclosed herein are systems and method for moving a process from a host to a virtual machine (VM). In one exemplary aspect, a method comprises freezing the process at a host operating system (OS) of the host; transferring at least one kernel object of the process from the host OS to a VM OS of the VM; reconfiguring at least one input-output (IO) resource of the process to point to a host-VM channel such that data flow between the host and the VM is enabled; mapping memory utilized by the process to the VM by remapping at least one page of the memory into the VM OS; and unfreezing the process at the VM OS.

Abstract: Disclosed herein are systems and method for booting servers in a distributed storage to improve fault tolerance. In one aspect, an exemplary method comprises, during a booting of a hardware server belonging to the distributed storage, starting a boot component from on any one physical block device from at least two or more physical block devices of the hardware server, wherein the at least two or more physical block devices of the hardware server are bootable and each physical block device stores the boot component, wherein an Operating System (OS) of the hardware server is installed on a virtual disk, and wherein the virtual disk is stored on the distributed storage, and by the boot component, accessing the distributed storage to obtain access to the virtual disk, mounting the virtual disk as a root file system of the OS, and booting the OS from the mounted virtual disk.

Abstract: Disclosed are systems and method for managing blocks of data and metadata. In an exemplary aspect, a method comprises receiving, by a first virtual block device on a computing device, a request from a file system. In response to identifying an indication that the request for a block of data, the method comprises accessing, by the first virtual block device, at least one backing block device dedicated to storing data to perform a requested operation on the block of data. In response to identifying an indication that the request for metadata, the method comprises instructing a second virtual block device to perform the requested operation on the metadata of the file system, wherein the second virtual block device accesses at least another one backing block device dedicated to storing metadata to perform the requested operation on the metadata of the file system and caches the metadata in Random Access Memory.

Abstract: Disclosed herein are systems and method for recovering a computing device after an intrusion is detected. In one aspect, an exemplary method comprises, by a minimalistic operating system running on the computing device, deploying a master container, wherein the deploying of the master container comprises creating and starting the master container from a container image, providing, to the master container, access to a storage area network (SAN) volume, providing, to the master container, read-only access to a Distributed Configuration Management (DCM) module domain, the domain being where a configuration of the computing device is stored, and invoking an Intrusion Detection Module (IDM) to start detecting intrusions into the master container; and upon receiving a notification from the IDM, re-deploying, by the minimalistic OS, the master container from the container image, wherein the deployed master container acts as a default runtime environment on the computing device.

Abstract: Disclosed herein are systems and method for deploying servers in a distributed storage to improve fault tolerance. In one aspect, an exemplary method comprises, on a hardware server, installing an OS on a virtual disk, putting the virtual disk on the distributed storage, configuring the hardware server so that at least two physical block devices of the hardware server are bootable by putting, on each physical block device of the at least two physical block devices, a boot component, and configuring the boot component on any one physical block device of the at least two physical block devices, the configuration of the boot component including enabling the boot component to perform at least one of: mounting the virtual disk as a root file system of the OS, and booting the OS from the mounted virtual disk during a booting of the hardware server.

Abstract: Disclosed herein are systems and methods for secure authentication of a managed application. In one aspect, an exemplary method comprises receiving, by a cloud platform, a request from a managed application to connect to a middleware service, determining that the managed application is authenticated to use the middleware service based on the secret, obtaining a secret associated with the managed application and the middleware service from a secret store, connecting to the middleware service using the secret to establish a secure connection, and delegating, to the managed application, the secure connection between the managed application and the middleware service.

Abstract: Disclosed are systems and methods for execution of applications in a virtual execution environment. An exemplary method comprises receiving from a client, a request for execution of an application in at least one virtual execution environment on at least one hardware node, determining whether there is a state snapshot of an application in the virtual execution environment, restoring a state of the application from a state snapshot in the virtual execution environment when the state snapshot of the application is found, starting the application without restoring the state of the application from the state snapshot and creating a new state snapshot of the application when the state snapshot of the application is not found, continuing execution of the application in the virtual execution environment and returning a response of the application to the client.

Abstract: Disclosed are systems and methods for encryption of an ephemeral layer of one or more containers. An exemplary method comprises detecting a container starting execution in an operating system, generating a temporary encryption key and storing the temporary encryption key in memory of a kernel of the operating system, creating an encrypted area as the ephemeral layer in a storage device, the encrypted area accessible only by the container, providing to the container access to the encrypted area, and responsive to stopping execution of the container, destroying the temporary encryption key.

Abstract: Disclosed herein are systems and methods for providing a platform for micro-service-based applications with unified management of infrastructure and client containers. An exemplary system may comprise the platform running on at least one computing device. The platform may comprise at least one client micro-service container and a plurality of infrastructure micro-service containers. Each infrastructure micro-service container may run infrastructure services for the at least one client micro-service container and for other infrastructure micro-service containers, wherein infrastructure micro-service containers are used by the platform to run client micro-service containers. The platform may also comprise a single unified management software layer that is responsible for unified management of the plurality of infrastructure micro-service containers and the at least one client micro-service container.

Abstract: A system and method that tracks changes in system memory executed by a software program. An exemplary method includes referencing a memory access tracking file to a file descriptor of a memory monitoring process and registering one or more virtual memory areas of a tracked process to the memory access tracking file. Moreover, the method includes sending, by the memory access tracking file, event information of a write access to the memory monitoring process that identifies a virtual page, where the write access is performed by the tracked process to the virtual page. Finally, the method includes configuring the virtual page such that the tracked process can execute a subsequent write command to the virtual page.

Abstract: A system and method is provided for providing distributed computing platform on untrusted hardware. An exemplary method includes launching a hypervisor on an untrusted computing node and receiving a request generated to provide a computing function using hardware of the untrusted computing node. Upon receiving the request, an enclave in memory of the untrusted computing node is created and a virtual machine is launched in the memory enclave. Moreover, a guest operating system of the virtual machine verifies the security of the untrusted computing node. Finally, the guest operating system performs the computing function using the hardware of the untrusted computing node upon the guest operating system verifying the security of the untrusted computing node and the hypervisor.

Abstract: Systems and methods are disclosed herein for multithreaded access to cloud storage. An exemplary method comprises creating a plurality of mount points by mounting, by a hardware processor, a plurality of file systems on a computer system, creating an image file on each of the plurality of mount points, instantiating, for each of the plurality of mount points, a block device on the image file, creating a union virtual block device that creates one or more stripes from each block device, delegating a request for accessing the union virtual block device, received from a client, to one or more block devices and merging a result of the request from each of the one or more block devices and providing the result to the client.

Abstract: A system and method is provided for fast random access erasure encoded storage. An exemplary method includes writing data to an append-only data log that includes data log extents that are each associated with data that is mapped to corresponding offset range of a virtual file of a client and storing the append-only data log as a sequence of data chunks each allocated on one or more one storage disks. Moreover, the method determines an amount of useful data in one or more data chunks and, when the amount of useful data in the data chunk is less than a predetermined threshold, appending the useful data from the data chunk to an end of the append-only data log. Finally, the data log is cleaned by releasing the one or more data chunk from the append-only data log after the useful data is appended to the append-only data log.

Abstract: Disclosed herein are systems and method for managing blocks of data and metadata. In one aspect, an exemplary method comprises, receiving, by a virtual block device (VBD), a request from a file system, wherein the request includes one or more of: a type of operation requested by the file system, including one of a read operation or a write operation, and/or an indication as to whether the request is for a block of data or a metadata of the file system, when the request includes the indication as to whether the received request is for a block of data or a metadata, selecting, based on the indication, one of two or more separate storage locations associated with the requested block of data or a metadata respectively, and accessing the determined storage location to perform the requested operation on the block of data or the metadata in the storage location.

Abstract: Systems and methods are disclosed herein for maintaining data integrity of data in a storage device. An exemplary method comprises determining whether checksums associated with data on the storage device are trusted or untrusted, responsive to determining that the checksums are trusted, retrieving the checksums from a checksum archive, otherwise initializing the checksums as unknown, when a received storage request is a write request, calculating a checksum of the data and updating the checksum in memory, when a received storage request is a read request and an in-memory checksum associated with the identified block is not unknown, calculating the checksum of the data in the identified block and comparing the checksum with an in-memory checksum associated with the identified block, determining that corruption has occurred when the checksums don't match and saving checksums associated with each of the uncorrupted data blocks of the storage device to an archive.