Abstract: Systems and methods for providing structured query language (SQL) access to non-relational data stores are described. SQL access can be provided to a non-relational data store in one embodiment by mapping storage attributes of the data store to one or more virtual relational tables. The virtual tables can include a schema representation of data stored in a non-relational data store without actually including the data in the virtual tables. In some embodiments, these systems and methods therefore advantageously merge certain benefits of relational database architectures with the scalability benefits of certain non-relational data store architectures. Certain features of the systems and methods described herein can also be used with existing relational databases. For example, the systems and methods described herein can perform join or similar operations between a relational table in one data store and a data object in another data store.

Abstract: In one embodiment, a method is performed by a computer system. The method includes monitoring events in relation to files stored at multiple network nodes and, responsive to the monitoring, detecting that a new file has been created from an existing file. The method further includes accessing a stored file-family model of the existing file, the stored file-family model comprising interconnected nodes, wherein the interconnected nodes represent a plurality of overlapping file variants such that one of the interconnected nodes represents the existing file. In addition, the method includes logically connecting the existing file and the new file in the stored file-family model. The method also includes determining a primary file variant in the stored file-family model and, responsive to a determination that the existing file is not the primary file variant, notifying one or more users.

Abstract: In one embodiment, a method is executed by a computer system. The method includes receiving information related to a platform-portable workload, the information comprising a data security policy expressed as digitally signed metadata. The data security policy specifies one or more data security features that any platform executing the platform-portable workload should implement. The method further includes validating the digitally signed metadata as originating from an issuer of the platform-portable workload. In addition, the method includes, responsive to successful validation of the digitally signed metadata, automatically determining whether a particular platform can satisfy the data security policy based, at least in part, on a comparison of the digitally signed metadata with data security attributes of the particular platform.

Abstract: Systems and methods for detecting and evaluating data migrations over a network are described. More specifically, a Migration Manager is provided to detect data migrations over the network and determine whether the performance of the data migration is satisfactory. In situations where the current data migration is too slow, the Migration Manager may postpone or reschedule the data migration for another time.

Abstract: A privileged account management system can maintain a database that defines a normal amount of time that it takes to perform a task associated with a reason code. When an administrator requests admin credentials for accessing a server, the administrator can provide a reason code which defines a task that the administrator intends to accomplish. A PAM system can maintain a database that defines, for each reason code, a normal amount of time that is required to accomplish the task associated with the reason code. The PAM system can then monitor an elapsed time over which the admin credentials are checked out to an administrator to determine whether the elapsed time exceeds the corresponding normal amount of time. If the elapsed time exceeds the normal amount, the PAM system can take appropriate action to mitigate any potential harm to the server.

Abstract: Disclosed are systems and methods that allow a database engine to access a non-relational document database and dynamically apply a schema that maps documents comprising semi-structured data into a relational data structure. In embodiments, mapping may be accomplished by parsing and analyzing a set of sample documents to empirically generate a normalized tabular schema. In embodiments, the schema accommodates format evolution and variability of documents having different structures and different sets of attributes is automatically executed in a background process without requiring user involvement. This normalization process eliminates the need to create unique modeling languages for semi-structured data. In embodiments, an SQL dialect may be used to join query results and combine the resulting document data with tables from different dimensional or relational databases to generate a combined result without the need to create additional temporary tables for non-conforming documents.

Abstract: A privileged account management system can detect when credentials used to access one or more servers have been shared or otherwise compromised. This detection can occur through analysis of simultaneous actions that are performed via multiple sessions associated with the same administrator. When two or more sessions associated with the same administrator are opened, the interactions performed over each of the sessions can be monitored to identify whether such interactions could be performed by a single administrator. If it is determined that the interactions over the multiple sessions could not reasonably be performed by a single administrator, various actions can be taken to address the possible breach to the security of the one or more servers.

Abstract: Mechanisms are provided for maintaining variable size deduplication segments using fixed size extents. Variable size segments are identified and maintained in a datastore suitcase. Duplicate segments need not be maintained redundantly but can be managed by updating reference counts associated with the segments in the datastore suitcase. Segments are maintained using fixed size extents. A minor increase in storage overhead removes the need for inefficient recompaction when a segment is removed from the datastore suitcase. Fixed size extents can be reallocated for storage of new segments.

Abstract: Mechanisms are provided for performing network efficient deduplication. Segments are extracted from files received for deduplication at a host connected to a target over one or more networks and/or fabrics in a deduplication system. Segment identifiers (IDs) are determined and compared with segment IDs for segments already deduplicated. Segments already deduplicated need not be transmitted to a target system. References and reference counts are modified at a target system. Updating references and reference counts may involve modifying filemaps, dictionaries, and datastore suitcases for both already deduplicated and not already deduplicated segments.

Abstract: A system, method, and computer-readable medium for performing ambiguous utterances identification operations by extrapolating statements of the utterance using machine learning based linguistic analysis. More specifically, in certain embodiments, the ambiguous utterances identification operations are performed by generating an ambiguous utterance repository that is indexed by and contains individuals, regions, tweets, blogs, and latest trends. This ambiguous utterance repository is then linked to a lexicon engine that stores linguistic semantics for particular demographics. The ambiguous utterances identification operations also can capture the latest trends in ambiguous utterances occurring happening in certain demographics.

Abstract: Embodiments deploy delayering techniques, and the relationships between successive versions of a rich-media file become apparent. With this, modified rich-media files suddenly present far smaller storage overhead as compared to traditional application-unaware snapshot and versioning implementations. Optimized file data is stored in suitcases. As a file is versioned, each new version of the file is placed in the same suitcase as the previous version, allowing embodiments to employ correlation techniques to enhance optimization savings.

Abstract: A firewall system determines whether a protocol used by an incoming data packet is a standard protocol compliant with Request For Comment (RFC) standards. In the event the protocol is RFC compliant, the firewall transmits the packet to the recipient according to firewall policies regarding the standard protocol. If the protocol is not that of an RFC standard, the firewall determines whether the protocol matches an RFC-exception protocol in a RFC-exception protocol database. If the protocol does match an RFC-exception, the firewall may transmit the packet to the recipient according to firewall policies regarding the RFC-exception protocol. If it does not match an RFC-exception, the firewall may transmit the packet or protocol to a support system where it may be quarantined until it is approved based on a decision that the protocol is safe and/or widely adopted.

Abstract: Deduplication dictionaries are used to maintain data chunk identifier and location pairings in a deduplication system. When access to a particular data chunk is requested, a deduplication dictionary is accessed to determine the location of the data chunk and a datastore is accessed to retrieve the data chunk. However, deduplication dictionaries are large and typically maintained on disk, so dictionary access is expensive. Techniques and mechanisms of the present invention allow prefetches or read aheads of datastore (DS) headers. For example, if a dictionary hit results in datastore DS(X), then headers for DS(X+1), DS(X+2), DS(X+read-ahead-window) are prefetched ahead of time. These datastore headers are cached in memory, and indexed by datastore identifier. Before going to the dictionary, a lookup is first performed in the cached headers to reduce deduplication data access request latency.

Abstract: Techniques and mechanisms are provided to allow for selective optimization, including deduplication and/or compression, of portions of files and data blocks. Data access is monitored to generate a heat index for identifying sections of files and volumes that are frequently and infrequently accessed. These frequently used portions may be left non-optimized to reduce or eliminate optimization I/O overhead. Infrequently accessed portions can be more aggressively optimized.

Abstract: Techniques and mechanisms are provided for storing data in a backup storage system. According to various embodiments, a first blockmap in a backup storage system may be identified. The first blockmap may correspond with a first restore point. The first blockmap may identify a first plurality of data segments. Each of the first plurality of data segments may have associated therewith a respective storage location in the backup storage system. The first blockmap may be compared with a designated storage system state to identify a subset of the first plurality of data segments that each correspond with a respective matching data segment in the designated storage system state. A second blockmap may be stored in the backup storage system. The second blockmap may correspond with a second restore point. The second blockmap may include the identified subset of the first plurality of data segments.

Abstract: The present invention is generally related to a network computing device including a first processor communicating with a second processor as a proxy for a client device when authenticating access privileges of the client device. The present invention may include more than two processors where at least one of the multiple processors may be optimized for performing one or more control functions and one or more other processors may be optimized for transferring data or administrating the transfer of data through a gateway or firewall.

Abstract: One or more user service tickets are obtained (i.e. pre-fetched) from an authentication server and stored in a ticket cache. The user service tickets facilitate a login device communicating with one or more users or group members associated with the login device. Login credentials for the users or group members may be subsequently authenticated against the user service tickets within the ticket cache thereby eliminating the need for immediate access to the authentication server or a previous login session by the users or group members. The user service tickets within the ticket cache may be refreshed as needed. In one embodiment, the user service tickets are refreshed daily and also in response to login attempts if the authentication service is readily accessible.

Abstract: An identification module receives a password request for a specified user and communicates an encrypted password field in response thereto, wherein the encrypted password field references a directory object corresponding to the specified user. The present invention also teaches an authentication module that communicates the password request to the identification module and receives the encrypted password field therefrom. Upon receiving the encrypted password field, the authentication module authenticates the specified user against the referenced directory object. In some embodiments, the encrypted password field is stored in an identification data store of an identification server and the directory object is stored in an authentication data store of an authentication server.

Abstract: One or more user service tickets are obtained (i.e. pre-fetched) from an authentication server and stored in a ticket cache. The user service tickets facilitate a login device communicating with one or more users or group members associated with the login device. Login credentials for the users or group members may be subsequently authenticated against the user service tickets within the ticket cache thereby eliminating the need for immediate access to the authentication server or a previous login session by the users or group members. The user service tickets within the ticket cache may be refreshed as needed. In one embodiment, the user service tickets are refreshed daily and also in response to login attempts if the authentication service is readily accessible.

Abstract: Systems and methods for extending the capability of a directory processor by, for example, registering a control are presented. This control can be a non-native control, or a modification to a native control. Further, this disclosure describes example of systems and methods for performing a directory operation, which may include one or more controls. At least some of the one or more controls may be non-native or dynamic controls. In some cases, some of the controls may be native controls.