Abstract: A system comprises a storage system comprising one or more storage devices and a storage controller operatively coupled to the storage system, the storage controller comprising a processing device, the processing device to receive first raw data from a first tenant of the storage system to a first non-volatile memory express (NVMe) input/output (I/O) queue of the storage system. The processing device further to determine that the first NVMe I/O queue corresponds to a first key, wherein the first key corresponds to the first tenant. The processing device further to encrypt the first raw data using the first key to generate first encrypted data. The processing device further to store the first encrypted data on the storage system.

Abstract: Deduplicating data based on recently reading the data, including: determining whether a calculated signature for write data matches a particular signature corresponding to data that was recently read from the storage device, wherein the signature is calculated using the write data as input; and after determining that the calculated signature for the write data matches the particular signature, obtaining the data that was recently read and comparing the data that was recently read to the write data.

Abstract: A computing or storage system constructs a table in memory, and constructs a summary table that summarizes the table. The summary table is for determining whether there is likely an entry for a value in the table. The summary table has buckets pointed to by address fields of values. The first bucket in the summary table is split into a second bucket and a third bucket. Prior to the split, the first bucket is pointed to by a first address field of a first value. After the split, the second bucket and the third bucket are pointed to by the first address field plus one extra bit derived from a remainder of the first value.

Abstract: Systems, methods, and computer readable storage mediums for performing remote replication including receiving, by a target storage system, an indication that a dataset stored on a source storage system will be replicated to the target storage system; identifying, by the target storage system, portions of the dataset that are not already stored on the target storage system; and initiating, by the target storage system, replication of one or more of the portions of the dataset that are not already stored on the target storage system from a source other than the source storage system.

Abstract: A storage system includes a central storage controller and a solid-state storage device operatively coupled to the central storage controller, the solid-state storage device including a processing device, the processing device to determine whether a die of the solid-state storage device is likely to fail. In response to determining that the die of the solid-state storage device is likely to fail, the processing device is further to mark the die of the solid-state storage device as likely to fail and transmit, to the central storage controller, an indication that the die of the solid-state storage device has been marked as likely to fail.

Abstract: A method of providing end-to-end encryption for data stored in a storage system, including: receiving a request to read encrypted data from a logical volume of a storage system; decrypting the encrypted data using a decryption key associated with at least one property of the storage system; performing at least one of a data operation to reconstitute the data; encrypting the data using an encryption key associated with at least one property of the data to generate new encrypted data; and providing a response to the request that includes the new encrypted data.

Abstract: Utilizing a non-repeating identifier to encrypt data, including: receiving a request to write data to a storage device; selecting a segment-offset pair where the data will be stored, where the selected segment-offset pair is unique to every other segment-offset pair utilized during the lifetime of the storage device; and encrypting the data in dependence upon an identifier of the segment-offset pair.

Abstract: A processor-based method for secret sharing in a computing system is provided. The method includes encrypting shares of a new secret, using a previous secret and distributing unencrypted shares of the new secret and the encrypted shares of the new secret, to members of the computing system. The method includes decrypting at least a subset of the encrypted shares of the new secret, using the previous secret and regenerating the new secret from at least a subset of a combination of the unencrypted shares of the new secret and the decrypted shares of the new secret.

Abstract: Systems and method for implementing deduplication process based on performance analyses. The system may include a processing device to determine a first performance metric associated with retrieving a second stored data block that is within a specified range of a duplicate of the first data block and a second performance metric associated with retrieving a hash value corresponding to the second stored data block. The processing device further to retrieve the second stored data block within a specified range of the duplicate of the first data block in response to the first performance metric not exceeding the second performance metric.

Abstract: Systems, methods, and computer readable storage mediums for replicating data to the cloud. A first dataset is replicated from a first storage subsystem to the cloud, with only the changes made to the first dataset since a previous replication event being replicated to the cloud. Additionally, the data may be deduplicated and compressed before being replicated from the first storage subsystem to the cloud. In some cases, the first dataset may be replicated to the cloud in a stream format which is not directly usable and then, at a later point in time, loaded onto a second storage subsystem from the cloud.

Abstract: Systems, methods, and computer readable storage mediums for replicating data to the cloud. A first dataset is replicated from a first storage subsystem to the cloud, with only the changes made to the first dataset since a previous replication event being replicated to the cloud. Additionally, the data may be deduplicated and compressed before being replicated from the first storage subsystem to the cloud. In some cases, the first dataset may be replicated to the cloud in a stream format which is not directly usable and then, at a later point in time, loaded onto a second storage subsystem from the cloud.

Abstract: Systems, methods, and computer readable storage mediums for performing remote replication including receiving, by a target storage system, an indication that a dataset stored on a source storage system will be replicated to the target storage system; identifying, by the target storage system, portions of the dataset that are not already stored on the target storage system; and initiating, by the target storage system, replication of one or more of the portions of the dataset that are not already stored on the target storage system from a source other than the source storage system.

Abstract: A method of providing end-to-end encryption for data stored in a storage system, including: receiving a request to read encrypted data from a logical volume of a storage system; decrypting the encrypted data using a decryption key associated with at least one property of the storage system; performing at least one of a data operation to reconstitute the data; encrypting the data using an encryption key associated with at least one property of the data to generate new encrypted data; and providing a response to the request that includes the new encrypted data.

Abstract: An illustrative method includes a data protection system detecting a request to perform a restricted operation with respect to a recovery dataset configured to be used by a storage system to recover from a data corruption event within the storage system, monitoring, in response to the request, for an occurrence of a predetermined set of one or more authorization events performed with one or more hardware tokens, and preventing the restricted operation from being executed until the each of the one or more authorization events included in the predetermined set occurs.

Abstract: An illustrative method includes a data protection system identifying one or more input operations and one or more output operations performed between a source and a storage system, identifying an anomaly in a relationship between the one or more input operations and the one or more output operations, and determining, based on the identifying of the anomaly, that the storage system is possibly being targeted by a security threat.

Abstract: Systems and method for implementing deduplication process based on performance analyses. The system may include a processing device to determine a first performance metric associated with retrieving a second stored data block that is within a specified range of a duplicate of the first data block and a second performance metric associated with retrieving a hash value corresponding to the second stored data block. The processing device further to retrieve the second stored data block within a specified range of the duplicate of the first data block in response to the first performance metric not exceeding the second performance metric.

Abstract: An illustrative method includes a data protection system detecting a request to perform an operation with respect to a storage system, identifying one or more attributes of the request, determining, based on the one or more attributes, that the request is possibly related to a security threat against the storage system, and throttling, based on the determining that the request is possibly related to the security threat against the storage system, a performance of the operation.

Abstract: In one implementation, a method includes identifying a first content-dependent feature associated with a data sector. The method further includes determining a baseline data sector associated with the data sector. The method further includes determining, by a processing device, a content-dependent delta between the first content-dependent feature and a second content-dependent feature of the baseline data sector. The method further includes providing the content-dependent delta and an indicator to the baseline data sector for storage on a plurality of storage devices.

Abstract: A processor-based method for secret sharing in a computing system is provided. The method includes encrypting shares of a new secret, using a previous secret and distributing unencrypted shares of the new secret and the encrypted shares of the new secret, to members of the computing system. The method includes decrypting at least a subset of the encrypted shares of the new secret, using the previous secret and regenerating the new secret from at least a subset of a combination of the unencrypted shares of the new secret and the decrypted shares of the new secret.

Abstract: A system, apparatus, and product for allowing access to a partially replicated dataset, including: detecting, by a target storage system, that a dataset will be replicated from a source storage system to the target storage system; exposing, by the target storage system, the dataset for user operations prior to receiving the entire dataset; receiving, by the target storage system, a request to read a portion of the dataset that has not been received by the target storage system; and retrieving, by the target storage system, the portion of the dataset.