Abstract: A system that monitors telemetry from a host computer system to detect degradation in a remote storage device. During operation, the system monitors performance parameters from a host computer system which accesses the remote storage device, wherein the performance parameters relate to the interactions between the host computer system and the remote storage device. The system then determines whether the monitored performance parameters have deviated from predicted values for the performance parameters. If so, the system generates a signal indicating that the remote storage device has degraded.

Abstract: One embodiment of the present invention provides a system that facilitates securely forgetting a secret. During operation, the system obtains a set of secrets which are encrypted with a secret key Si, wherein the set of secrets includes a secret to be forgotten and other secrets which are to be remembered. Next, the system decrypts the secrets to be remembered using Si, and also removes the secret to be forgotten from the set of secrets. The system then obtains a new secret key Si+1, and encrypts the secrets to be remembered using Si+1. Finally, the system forgets Si.

Abstract: A computer system that forwards data packets is described. During operation, the system receives a data packet on a first interface and classifies the data packet to determine a corresponding destination. This classification is based on dynamically configured classification rules that include multiple attributes corresponding to multiple layers in an Open System Interconnect (OSI) Reference model. Then, the system provides the data packet on a second interface corresponding to the destination.

Abstract: One embodiment of the present invention provides a system that facilitates receiving content from a primary peer and forwarding it to a secondary peer, wherein blocks of the content are sent to the secondary peer prior to all of the blocks of the content being received from the primary peer. The system starts by receiving an encrypted list of checksums from a server, wherein each checksum in the list is associated with a corresponding block of the content. Next, the system decrypts the encrypted list of checksums to form a list of decrypted checksums. The system then receives a block of the content from the primary peer and calculates a checksum for the block of the content. The system subsequently compares the calculated checksum with a corresponding checksum from the list of decrypted checksums received from the server. If the calculated checksum matches the corresponding checksum, the system sends the block of the content to the secondary peer.

Abstract: Techniques to assign nodes in a network to groups of nodes are described. The techniques include representing hosts in the network by property vectors that encode information about the hosts, identifying properties of the property vector by integers in the property vector for the host and determining proximity of hosts according to the property vectors and grouping the hosts according to the determined proximity.

Abstract: One embodiment of the present invention provides a system that facilitates bulk lock-unbiasing for objects within an object-based computing system. The system maintains an epoch, which is a field containing a timestamp, for a biasable object class and each instance of the biasable object class. If the epoch for the biasable object class matches the epoch for a specific instance of the biasable object class, the system knows that any bias for that specific instance is currently valid. When the system receives a signal to perform a bulk lock-unbiasing operation for instances of the biasable object class, it responds by stopping all threads in the object-based computing system at a safe point. Then, the system performs a bulk lock-unbiasing operation for unlocked instances of the biasable object class by incrementing the epoch for the biasable object class and by incrementing corresponding epochs for locked instances of the biasable object class.

Abstract: An Operations Manager subsystem decouples the generation of operational events from an associated behavior triggered by those events. The Operations Manager subsystem allows changing the associated behavior without requiring rebuilds or recompilations of the source code. In addition, changes to policies are possible even at runtime in order to enable more agile debugging and better application supportability. The Operations Manger subsystem includes separate reporting and subscription services. The reporting services provide an API defining operational code for the generation of operational events. The subscription services include a file system and an API that support multiple user subscriptions to the various code operational events defining the behavior associated with those events.

Abstract: A system that fabricates a semiconductor chip. The system places patterns for components which require fine line-widths within a high resolution region of a reticle, wherein the high resolution region provides sharp focus for a given wavelength of light used by the lithography system. At the same time, the system places patterns for components which do not require fine line-widths outside of the high-resolution region of the reticle, thereby utilizing the region outside of the high-resolution region of the reticle instead of avoiding the region. Note that the coarseness for components placed outside of the high resolution region of the reticle is increased to compensate for the loss of optical focus outside of the high resolution region.

Abstract: One embodiment of the present invention provides a system that uses a password-derived prime number to facilitate a secure key exchange between a client and a server across a network. During operation, the client receives a password from a user. Next, the client uses the password to determine a prime number P associated with the password. The client then uses the prime number P to determine a generator g associated with P. The client uses this prime number to calculate X=gx mod P, wherein x is a random number generated by the client. Next, the client sends X to the server. The client also receives Y=gy mod P from the server, wherein y is a random number generated by the server. The client then computes a secret key Ks=Yx mod p at the client, which the server can similarly obtain by computing Ks=Xy mod p. In this way, the client and the server can both obtain the same secret key Ks through insecure communications over the network.

Abstract: One embodiment of the present invention provides a memory-management system that supports both address-referenced objects and identifier-referenced objects, wherein an address-referenced object is accessed through a reference containing an address of the object, and wherein an identifier-referenced object is accessed through a reference containing an object identifier (OID) for the object. During operation, the system receives a request to access an object. Next, the system determines if the object is an address-referenced object or an identifier-referenced object. If the object is an address-referenced object, the system accesses the object using the associated address for the object. If the object is an identifier-referenced object, the system accesses the object by using the associated OID for the object to look up the address for the object, and then using the address to access the object.

Abstract: One embodiment of the present invention provides a system that facilitates adjusting an audit state in a computing environment. During operation the system receives a key from a third-party at an audit system. Note that the key is associated with a corresponding audit-control profile. Next, the system validates the key, thereby authenticating the third-party. The system then identifies the audit-control profile that is associated with the key provided by the third-party. Finally, the system audits the target system in accordance with the corresponding audit-control profile.

Abstract: One embodiment of the present invention provides a system that identifies network switches along a path. During operation, the system receives an address of a source node and an address of a destination node. The system maintains a set of topology information for a network. The system further simulates a data packet originated at the source node and destined for the destination node. During the simulation, the system determines whether a current-hop node performs layer-3, layer-2, or sub-layer-2 switching. The system sends a query to the current-hop node over a separate control channel to determine the status of the current-hop node and discover a next-hop node. The system then receives a reply. The system determines the next-hop node based on the reply and sets the next-hop node as the current-hop node.

Abstract: One embodiment of the present invention provides a method for fabricating a high-quality metal substrate. During operation, the method involves cleaning a polished single-crystal substrate. A metal structure of a predetermined thickness is then formed on a polished surface of the single-crystal substrate. The method further involves removing the single-crystal substrate from the metal structure without damaging the metal structure to obtain the high-quality metal substrate, wherein one surface of the metal substrate is a high-quality metal surface which preserves the smoothness and flatness of the polished surface of the single-crystal substrate.

Abstract: One embodiment of the present invention provides a system that mitigates the effects of multiple vibration sources on a set of hard disk drives (HDDs) within a computer system. During operation, the system identifies a target HDD in the set of HDDs, wherein the performance of the target HDD is affected by mechanical vibrations. The system also identifies one or more primary vibration sources from the multiple vibration sources that affect the performance of the target HDD. Next, for each of the primary vibration sources, the system measures a first time-domain signal associated with the operation of the primary vibration source using a first vibration transducer associated with the primary vibration source. The system also measures a second time-domain signal associated with the target HDD using a second vibration transducer associated with the target HDD.

Abstract: A system includes a plurality of collector devices that are disposed to collect statistical information on packets that are sent between nodes on a network. The system also includes a stackable aggregator that receives network data from the plurality of collector devices, and which produces a connection table that maps each node on the network to a record that stores information about traffic to or from the node. The stackable aggregator includes a manager blade, a database blade, and two or more, analyzer blades.

Abstract: One embodiment of the present invention provides a system that facilitates single sign-on of a client, wherein single sign-on allows the client to provide authentication credentials once during a computing session and to access multiple resources without re-authenticating. The system operates by receiving a domain cookie forwarded from the client by an application server at a single sign-on server, wherein the domain cookie includes a domain identifier and an encrypted secret path, and wherein the domain cookie can only be retrieved by servers whose domain matches the domain identifier in the domain cookie. The system then decrypts the encrypted secret path to reveal an unencrypted secret path. Next, the system redirects the client to the unencrypted secret path, wherein the unencrypted secret path is a path that terminates on the single sign-on server.

Abstract: One embodiment of the present invention provides a system that can expire encrypted-data. During operation, the system receives an expiry-request that includes object-identifying information, which can be used to identify a set of database objects that contain the encrypted-data, wherein a database object can be a table, a partition, a row, or a column in a row. Furthermore, a database object can have an expiration time, and it can be stored in an archive, which is typically used to store large amounts of data for long periods using a slower, but cheaper storage medium than the storage medium used by the database. The system then identifies a set of keys for the encrypted-data using the object-identifying information. Next, the system deletes the set of keys, thereby expiring the encrypted-data. Note that, deleting the set of keys ensures that the secure key repository does not contain any stale keys associated with expired encrypted-data.

Abstract: We present technology that allows layman computer users to simply create, provision, and maintain secured infrastructure—an instant PKI. This technology can be used in a wide variety of applications including enabling secure communications to components of a vehicle, and enabling secure communications between the vehicle and associated infrastructure.

Abstract: One embodiment of the present invention provides a system that provides heterogeneous resources for client systems. During operation, the system maintains a stateful resource database that tracks heterogeneous resources in a given environment. The system receives requests from client systems, and in response to the requests searches for a heterogeneous resource in the stateful resource database that matches the request. If the system finds an available heterogeneous resource that matches the request, it proceeds to submit the request to the resource. Maintaining and using the stateful resource database facilitates efficiently sharing scarce heterogeneous resources across a number of client systems.

Abstract: One embodiment of the present invention provides a system that facilitates automatically organizing digital images using metadata which is embedded in the digital images. The system operates by receiving a digital image with embedded metadata, wherein the embedded metadata includes Global Positioning System (GPS) data. The system uses the embedded metadata, including the GPS data, to identify additional metadata associated with the digital image. The system then saves the digital image on a storage medium. In addition, the system saves the embedded metadata and the additional metadata on the storage medium in a searchable format.