Abstract: According to one or more embodiments of the present invention, a network cache intercepts data requested by a client from a remote server interconnected with the cache through one or more wide area network (WAN) links (e.g., for Wide Area File Services, or “WAFS”). The network cache stores the data and sends the data to the client. The cache may then intercept a first write request for the data from the client to the remote server, and determine one or more portions of the data in the write request that changed from the data stored at the cache (e.g., according to one or more hashes created based on the data). The network cache then sends a second write request for only the changed portions of the data to the remote server.

Abstract: A technique is provided for dynamically discovering shared risk node group (SRNG) memberships of a plurality of interconnected edge devices in a computer network. According to the technique, each edge device “learns” the identities of its directly-attached peer devices situated in neighboring routing domains, e.g., by establishing an interior or exterior gateway routing protocol session with each peer. Thereafter, each edge device advertises the identities of its learned peers to the other interconnected edge devices. Preferably, the peer identities are distributed in novel “peer-router” extended community attributes transported in Border Gateway Protocol (BGP) messages. After an edge device has learned the identity of its own peers and received the identities of the other edge devices' peers, the device can automatically detect SRNG memberships in the computer network. Specifically, edge devices that advertise the same peer are determined to participate in the same SRNG.

Abstract: A thermionic electron source comprises a nonlinear metallic substrate, a coating of yttria deposited on the substrate, and a current source configured to drive current through the metallic substrate.

Abstract: In one embodiment, each network interface of a network device in a computer network may be classified as either a low-speed interface (e.g., wireless) or a high-speed interface (e.g., wired). Illustratively, then, low-speed interfaces may be configured (identified) as external interfaces to external links and high-speed interfaces may be configured (identified) as internal interfaces to internal links. By executing a multiple spanning tree (MST) protocol at the network device with other network devices in the computer network, network devices interconnected with internal links are in a same MST region and internal links within an MST region are preferred over external links between MST regions.

Abstract: A wearable or portable intermittently operable hydration system (10) includes a purification module (22, 50) that contains one or more solid state UV devices that are positioned in the path of hydrating fluid, or water, flow through the hydration system to a mouthpiece (18). The UV LEDs are instant on devices with essentially no ramp-up required, and a sensor (20) or the opening of a push-pull valve (53) controls the turning on of the UV LEDs. The fluid flow path may run from a bladder (12) in a backpack (19) worn by the user, a sports bottle (54) worn by or carried by the user or may be through a water filtration system that a user operates via a pump. The power for the purification module may come from batteries, solar cells, fuel cells, power converted from pumping or winding action or any combination thereof.

Abstract: A sequence of series-connected transformers for transmitting power to high voltages incorporates an applied voltage distribution to maintain each transformer in the sequence below its withstanding voltage.

Abstract: An architecture provides the ability to create and maintain multiple instances of virtual servers, such as virtual filers (vfilers), within a server, such as a storage appliance. A vfiler is a logical partitioning of network and storage resources of the storage appliance platform to establish an instance of a multi-protocol server. Each vfiler is allocated a subset of dedicated units of storage resources, such as volumes or logical sub-volumes (qtrees), and one or more network address resources. Each vfiler is also allowed shared access to a file system resource of a storage operating system. To ensure controlled access to the allocated and shared resources, each vfiler is further assigned its own security domain for each access protocol. A vfiler boundary check is performed by the file system to verify that a current vfiler is allowed to access certain storage resources for a requested file stored on the filer platform.

Abstract: A system and method efficiently generates a set of parallel persistent consistency point images (PCPIs) of volumes configured as a SVS and served by a plurality of nodes interconnected as a cluster. A volume operations daemon (VOD) executing on a node of the cluster is configured to manage generation of the volume PCPIs. Notably, the set of PCPIs is generated substantially in parallel to thereby obtain a consistent and accurate point in time reference of the entire SVS.

Abstract: A security control verification and monitoring subsystem of a managed computer system performs security control verification operations regularly and for each security control verification operation determines the applicable security benchmark level for use by a given computer. The subsystem assigns security risk categories to groups of computers based, for example, on overall system or group administrator supplied potential impact settings and/or system type and business or information type selections. The subsystem further associates the security risk categories with security benchmark levels based on mapping information supplied by the overall system or group administrator. The subsystem then directs the computer to benchmark definition files based on the assigned security risk category, the associated security benchmark level and attributes of the computer.

Abstract: A system and method enhances performance of updates to sequential block storage of a storage system. According to an aspect of the invention, a disk array of the storage system is utilized to extend write buffers of the system, thereby rendering a portion of the disk array a disk-based log. To that end, one portion of the disk array is organized into a home location array having a set of sequential home locations for disk blocks. Another portion of the disk array is organized into the disk-based log having a set of log buffers configured to store versions of disk blocks that have yet to be returned to their home locations in the home location array. In addition, non-volatile memory of the storage system is organized as an index configured to provide efficient mappings of disk blocks not yet returned to their home locations.

Abstract: Embodiments of the present invention provide mechanisms that overcome limitations of existing indexes by creating two-dimensional (2D) spatial indexes to quickly locate data containers that match two or more predicates. This is accomplished by representing metadata attributes describing a data container as dimensions in a 2D space so that a data container can be expressed as a point or a cell in a 2D space with coordinates being a pair of values of the selected attributes. A space filling curve is used to traverse the 2D space and convert each pair of the 2D coordinates to a single space filling curve value. A 2D spatial index is then created based on the computed space filling curve values so that one value can be associated with one or more points (data containers) in the index. Advantageously, the created spatial index provides for searching and processing fewer metadata entries, thereby decreasing the time typically used to search for data.

Abstract: A system and method for signature based data container recognition is provided. When a new data container, such as a lun, is created, a security appliance generates a signature of the data container, by, e.g., examining the contents of one or more data blocks of the data container. The generated signature is then associated with the appropriate encryption key for the data container and is stored either within a configuration database of the security appliance or on a key management system operating within a security appliance environment. To identify the encryption key associated with a data container, the security appliance generates a signature of the data container and compares the generated signature with the stored signatures. Should there be a matching signature, the security appliance utilizes the encryption key associated with the matching signature to process data access requests to/from the data container.

Abstract: Embodiments of methods, devices and/or systems for managing the encryption of data are described.

Abstract: In one embodiment, a server and a client are configured to trust a certificate of an intermediate proxy device. The proxy device may then intercept a client-server security session request message sent from the client to the server. In response, the proxy device initiates a proxy-server security session with the server and obtains server security information from the server. Then, the proxy device initiates a client-proxy security session with the client using the trusted proxy certificate, and obtains client security information from the client. Upon obtaining the client security information, the proxy device creates a dynamic certificate using the obtained client security information and the trusted proxy certificate, and establishes the initiated proxy-server security session with the dynamic certificate.

Abstract: In one embodiment, a multimedia resource is shared among a plurality of devices based upon a physical location of an active wireless endpoint unit within a structure. Devices are associated with corresponding zones within the structure. Each device provides functionality within the device's corresponding zone. Using one of a number of techniques, the physical location of the active wireless endpoint unit is determined to be within a particular zone. In response, one or more devices associated with the particular zone are provided with access to the multimedia control resources. Access is withheld to one or more other devices associated with another zone that is remote from the physical location of the active wireless endpoint unit.

Abstract: In one embodiment, receiving a data packet in a data forwarding domain, encapsulating a header to the received data packet, and routing the encapsulated data packet in the data forwarding domain over a distribution tree are provided.

Abstract: A technique dynamically activates a secondary Traffic Engineering Label Switched Path (TE-LSP) at a secondary head-end node upon failure of a primary TE-LSP in a computer network. According to the novel technique, a primary head-end node establishes the primary TE-LSP having a primary bandwidth (BW) amount to a primary tail-end node. Also, the secondary head-end node establishes the secondary TE-LSP having zero BW to a secondary tail-end node (e.g., the same as the primary tail-end node). The secondary head-end node monitors the state of the primary TE-LSP, and in response to a failure (e.g., or other state change) substantially immediately adjusts the BW of the secondary TE-LSP to the primary BW amount (“activating” the TE-LSP). A “prior-hop” node to the primary and secondary head-end nodes originally forwarding traffic to the primary head-end node, may then begin forwarding traffic to the secondary head-end node, and thus onto the adjusted secondary TE-LSP.

Abstract: In one embodiment, in response to receiving a topology change notification at a network bridge having ports identified as either a network port or an edge port, address learning may be disabled on the network bridge. Once address learning is disabled, an association of all entries of a forwarding table of the network bridge having addresses previously forwarded on a particular network port of the network bridge may be changed to forward those addresses on all network ports of the network bridge (e.g., flooding the frames not addressed to edge ports on all network ports only). Subsequently, address learning may be enabled on the network bridge, thus repopulating the network port entries of the forwarding table in response to the topology change.

Abstract: A technique for accelerating the creation of a hyperclone of a virtual file system. Specifically, each data block and indirect block directly referenced by a base inode are only copied. The hyperclone may then reference the original data blocks and original indirect blocks. Further, an indication may be provided for at least one of the copied data blocks and indirect blocks that indicates that the at least one of the copied data blocks and indirect blocks is in use.

Abstract: A method for measuring the contact force exerted on tissue by a probe for heating the tissue and containing an antenna which is connected to a radiometer whose output reading indicates the temperature at depth of the tissue contacted by the probe comprises displaying the output reading of the radiometer, applying sufficient power to the probe to heat the tissue to a selected first temperature that is not lethal to the tissue, moving the probe into contact with the tissue, observing the increase in the displayed temperature reading that occurs when the probe contacts the tissue, and advancing the probe toward the tissue until the displayed temperature reading reaches a value corresponding to a selected tissue contact force. After the probe position in the tissue has stabilized, the applied power to the probe may be increased to heat the tissue to a selected second temperature that is lethal to tissue for a sufficient time to ablate the tissue followed by lowering the tissue heating to a sub-lethal temperature.