Abstract: A system for effectively addressing the fast-producer and slow-consumer problem for persistent hybrid cloud caches. In particular, the system and associated methods ensure the integrity of data stored by persistent caches by utilizing a plurality of journals, including a user journal and a cloud journal. The user journal records operations conducted by users of the system in records. Before the records are transferred to a cloud storage system, the records are transferred to the cloud journal, which may be configured to be larger than the user journal. Once a record is transferred from the user journal to the cloud journal, the record may be released from the user journal, thereby increasing capacity of the user journal for subsequent operations to be recorded. Each record may then be transferred to the cloud storage system from the cloud journal, which may then cause each record to be released from the cloud journal.

Abstract: Systems and methods for simplifying and consolidating permission sets from multiple heterogeneous file storage systems are disclosed. An example method includes acquiring from the first file storage system a first set of file system permissions having a first set of permission semantics, and acquiring from a second file storage system a second set of file system permissions having a second set of permission semantics that are different from the first set of permission semantics. The first set of file system permissions and the second set of file system permissions are converted to a unified set of file system permissions having unified permission semantics that are different from the first set of permission semantics and the second set of permission semantics. The unified set of file system permissions can be analyzed to make a determination regarding security levels of the first file storage system and of the second file storage system.

Abstract: Systems and methods for identifying failed computing nodes are disclosed. An example system includes a plurality of computing nodes, where each computing node of the plurality of computing nodes includes, or has access to, at least one hardware processor. An example method includes generating a unique identifier particularly corresponding to a particular node. The example method also includes periodically updating a node record in a persistent storage location with the unique identifier, where the node record is associated with the particular node. The example method further includes accessing the persistent storage location at a first time and identifying a most recent update to the node record. The example method also includes determining that the most recent update to the node record occurred more than a threshold amount of time prior to the first time.

Abstract: Methods in a cloud object store facilitate strong data encryption, customer-management of object (encryption) keys, reductions in latency, globally-distributed object storage, and handling of streamed uploads. A method for encrypting objects stored in a cloud includes encrypting each object with a unique encryption (object) key. The plaintext object keys are generated in advance of uploads. The plaintext object keys can be stored in an object database in the cloud. Alternatively, the plaintext object keys can be provided to a customer's HSM, encrypted, and returned to the cloud, such that encrypted object keys, encrypted by the customer, are stored in the cloud. The cloud can alternatively encrypt the customer's object keys with a master key for the customer, which is then encrypted by the customer's HSM before being stored in the cloud. Proxies are also deployed for efficiently communicating with customer security modules.

Abstract: A system and methods for enhancing content collaboration by conflict detection and resolution. A hybrid cloud cache receives a request from a client to upload an object to the cloud. The hybrid cloud cache may perform an internal lookup to find the latest version of the object known to it. This lookup may return a local identifier or a cloud identifier. The cache may compare a client-provided identifier to the local identifier or to the cloud identifier that is mapped to the local identifier to determine if the client-provided identifier refers to the latest uploaded version of the object. The system may determine that a conflict exists if the client-provided identifier does not match either identifier. The system may generate an alternate name for the object and upload the renamed object to the cloud from the hybrid cloud cache.

Abstract: Systems and methods for progressively releasing features used in conjunction with a service in a computing environment are disclosed. The computing environment includes users and resources. A method includes providing access to the service to the plurality of users and providing a particular feature to be used in conjunction with the service. The method can additionally include maintaining a directory of the entities of the computing environment. The entities can include the users and/or the resources. The directory of the entities organizes the entities into groups. The example methods can also include assigning an access value associated with the particular feature to a particular group of the groups. The access value can indicates an assigned probability that the feature will be enabled with respect to a particular entity included in the particular group. The assigned probability can advantageously be greater than zero and less than one.

Abstract: Systems and methods for serving subject access requests (SARs) are disclosed. A network connection is established with a user. An SAR, including at least one piece of personal data corresponding to an entity associated with said user, is received from the user via the network connection. Text data is extracted from a plurality of data objects, the data objects including personal data associated with the user. The text data is then processed to identify instances of names and instances of personal data within the text data. Associations are generated between identified names and identified personal data. A subset of the identified personal data that corresponds to the entity is identified based on the associations. A response to the SAR is provided, based at least in part on the identified personal data corresponding to the entity.

Abstract: A computer-implemented method including accessing an electronically stored data set, generating a checksum of the accessed data, creating a payload including the generated checksum of the data set and an identifier for the data set and committing a transaction including the payload to a blockchain.

Abstract: Systems and methods for simplifying and consolidating permission sets from multiple heterogeneous file storage systems are disclosed. An example method includes acquiring from the first file storage system a first set of file system permissions having a first set of permission semantics, and acquiring from a second file storage system a second set of file system permissions having a second set of permission semantics that are different from the first set of permission semantics. The first set of file system permissions and the second set of file system permissions are converted to a unified set of file system permissions having unified permission semantics that are different from the first set of permission semantics and the second set of permission semantics. The unified set of file system permissions can be analyzed to make a determination regarding security levels of the first file storage system and of the second file storage system.

Abstract: Systems and methods for identifying failed computing nodes are disclosed. An example system includes a plurality of computing nodes, where each computing node of the plurality of computing nodes includes, or has access to, at least one hardware processor. An example method includes generating a unique identifier particularly corresponding to a particular node. The example method also includes periodically updating a node record in a persistent storage location with the unique identifier, where the node record is associated with the particular node. The example method further includes accessing the persistent storage location at a first time and identifying a most recent update to the node record. The example method also includes determining that the most recent update to the node record occurred more than a threshold amount of time prior to the first time.

Abstract: A system for handling Implicit transactions in a hybrid cloud cache. The hybrid cloud cache maintains folders in a metadata file system that includes a hierarchy of cached folders, and maintains a meta-file containing metadata of files and folders. The system obtains a meta-file from a cloud platform and compares that to a meta-file obtained from the hybrid cloud cache. An object associated with an Implicit metadata transaction is transferred to an internal namespace of the hybrid cloud cache if the comparison indicates that certain conditions are met. The system may perform a bottom-up traversal of the namespace and may abort the traversal if an outstanding explicit transaction for the object is present or the object exists in the cloud platform. An object may be moved to a temporary storage location if there is no explicit transaction on it and the object does not exist in the cloud platform.

Abstract: Systems and methods for serving subject access requests (SARs) are disclosed. A network connection is established with a user. An SAR, including at least one piece of personal data corresponding to an entity associated with said user, is received from the user via the network connection. Text data is extracted from a plurality of data objects, the data objects including personal data associated with the user. The text data is then processed to identify instances of names and instances of personal data within the text data. Associations are generated between identified names and identified personal data. A subset of the identified personal data that corresponds to the entity is identified based on the associations. A response to the SAR is provided, based at least in part on the identified personal data corresponding to the entity.

Abstract: A method for facilitating synchronization of a remote file system (RFS) and a local file system (LFS) includes maintaining a global revision identifier associated with the RFS, where the global revision identifier has a variable state, and responsive to the RFS being modified, updating metadata associated with one or more of the file system objects of the RFS based on a state of the global revision identifier. More particularly, the method includes updating the global revision identifier to a new state in response to the RFS modification and then updating the metadata of the folder(s) associated with the RFS modification. The RFS metadata is partitioned by folder and file to facilitate efficient searching based on a requested namespace view. Another method utilizes prior revision identifiers stored in the LFS to limit the RFS metadata returned to the local cloud during a rescan, by excluding the data set that has not changed, which improves the efficiency of the rescan synchronization.

Abstract: A cloud-based data governance system includes a processing unit, a network adapter, and memory for storing data and code. The network adapter establishes a connection with a remote data storage system associated with a remote file system over a wide-area network (WAN). The code includes and event collection interface, a data governance service, and an enforcement service. The event collection interface is configured to capture an event from the remote data storage system. The event is indicative of a file system operation executed on a data object of the remote file system. The data governance service is configured to receive the event from the event collection interface and to process the event to determine whether the file system operation conflicts with a governance policy of the data governance system. The enforcement service executes a set of remediation actions, if the file system operation does conflict with the governance policy.

Abstract: Methods in a cloud object store facilitate strong data encryption, customer-management of object (encryption) keys, reductions in latency, globally-distributed object storage, and handling of streamed uploads. A method for encrypting objects stored in a cloud includes encrypting each object with a unique encryption (object) key. The plaintext object keys are generated in advance of uploads. The plaintext object keys can be stored in an object database in the cloud. Alternatively, the plaintext object keys can be provided to a customer's HSM, encrypted, and returned to the cloud, such that encrypted object keys, encrypted by the customer, are stored in the cloud. The cloud can alternatively encrypt the customer's object keys with a master key for the customer, which is then encrypted by the customer's HSM before being stored in the cloud. Proxies are also deployed for efficiently communicating with customer security modules.

Abstract: A system and methods for presenting a hybrid cloud cache as a file system. The system implements a set of standard file system command line interfaces that present the objects stored by the hybrid cloud cache to users of the system as if the users were viewing and interacting with a traditional file system. The system provides an interactive shell to the users to view the contents of the hybrid cloud cache. The system may be configured to operate on a live instance as well as on an on-disk structure of the hybrid cloud cache. The system may provide the ability to present partially cached cloud data as a file system via the interactive shell for the purposes of development, support, and troubleshooting.

Abstract: A novel system for performing valuations of file system objects include a processor configured to execute code and memory configured to store data and the code. The code includes an accumulator configured to accumulate secondary data associated with said file system objects, a data aggregator configured to arrange the secondary data in the memory, and a value generator configured to generate an object value indicative of the value of at least one of the file system objects to a particular entity. In a particular embodiment, the value generator creates a record in a valuation database to associate the object value with the at least one of the file system objects.

Abstract: A method for synchronizing a local file system (LFS) and a remote (cloud) file system (RFS) includes the step of storing events indicative of differences between the LFS and the RFS, where the events are associated with file system objects of the LFS and RFS. The method further includes the steps of prioritizing the events, generating file system operations for the events based at least in part on the prioritization of the events, and performing at least some of the file system operations to synchronize the LFS and RFS. Prioritizing the events includes defining a plurality of service classes (e.g., based on type of event, event attribute, etc.), assigning a priority to each of the service classes, and assigning each event to one of said service classes. Systems are also described. The invention allocates limited synchronization resources based on a predefined policy to synchronize important file system objects sooner.

Abstract: A system for resolving transient and localized errors in a hybrid cloud cache. The system may include a subsystem within a hybrid cloud cache that provides a way to handle errors associated with uploading files or folders to a cloud. The subsystem may be used to recover files and folders created by a user that could not be pushed to the cloud, while also ensuring that metadata and data are not lost. The subsystem may work with the transaction processing subsystem of the hybrid cloud cache to facilitate the release of transactions associated with the files and folders that could not be pushed to the cloud. By doing so, the subsystem assists in unblocking subsequent transactions or user operations and allows the hybrid cloud cache to upload files and folders to the cloud without interruption.

Abstract: Embodiments are directed to the protection and verification of documents. In some embodiments, this is achieved by generating checksum data describing a document and storing that and a time stamp on a publicly available blockchain. By recording a checksum of a document on a blockchain, the disclosed systems and methods may be used later to validate the integrity of the document. In one embodiment, this validation is performed by comparing the recorded checksum from a previous time when the document or files were stored to a recalculated checksum generated at the present time. If the checksums match, then it is assumed that the document has not been altered since the checksum data was first calculated.