Abstract: A system and apparatus for data confidentiality in a distributed ledger are disclosed. The system and apparatus preserve qualities of distributed ledgers, such as transparency, integrity, and redundancy, while also providing confidentiality, scalability, and security not previously available in distributed ledgers. The system includes a data confidentiality module that exploits a trusted execution environment for both transaction processing and key synchronization. The apparatus accessing the distributed ledger provides for new nodes joining the network, sending transactions to the ledger by existing nodes, securely processing the transaction using the trusted execution environment, securing transmission to the logic layer for application of business logic, reading and writing data to local storage, and reading encrypted transactions.

Abstract: A file layout and encryption scheme to protect a data file are introduced. A system, computer-readable medium, and method are provided for selecting an encrypted data node of a data file for writing data, generating a node encryption key for the selected encrypted node, encrypting the selected encrypted node with the node encryption key, saving the node encryption key and a node integrity check value for the node encryption key in a parent encrypted cryptographic node, selecting an ancestor encrypted cryptographic node as the selected encrypted node, and repeating the generating, encrypting, saving, and selecting the ancestor encrypted cryptographic node until the selected ancestor encrypted cryptographic node is a root encrypted cryptographic node for the data file. Encrypting a data node with the node encryption key further saves the data to be written to the encrypted data node.

Abstract: A system and apparatus for data confidentiality in a distributed ledger are disclosed. The system and apparatus preserve qualities of distributed ledgers, such as transparency, integrity, and redundancy, while also providing confidentiality, scalability, and security not previously available in distributed ledgers. The system includes a data confidentiality module that exploits a trusted execution environment for both transaction processing and key synchronization. The apparatus accessing the distributed ledger provides for new nodes joining the network, sending transactions to the ledger by existing nodes, securely processing the transaction using the trusted execution environment, securing transmission to the logic layer for application of business logic, reading and writing data to local storage, and reading encrypted transactions.

Abstract: A file layout and encryption scheme to protect a data file are introduced. A system, computer-readable medium, and method are provided for selecting an encrypted data node of a data file for writing data, generating a node encryption key for the selected encrypted node, encrypting the selected encrypted node with the node encryption key, saving the node encryption key and a node integrity check value for the node encryption key in a parent encrypted cryptographic node, selecting an ancestor encrypted cryptographic node as the selected encrypted node, and repeating the generating, encrypting, saving, and selecting the ancestor encrypted cryptographic node until the selected ancestor encrypted cryptographic node is a root encrypted cryptographic node for the data file. Encrypting a data node with the node encryption key further saves the data to be written to the encrypted data node.

Abstract: Methods and systems for improving performance in a storage system utilizing snapshots are disclosed by using metadata management of snapshot data. Specifically, various metadata structures associated with snapshots are utilized to reduce the number of IO operations required to locate data within any specific snapshot. The number of IO operations are reduced by allowing the various metadata structures associated with the temporally current snapshot to locate data directly within any temporally earlier snapshot or on the original root volume.

Abstract: Methods and apparatuses are provided for active-active support of virtual storage management in a storage area network (“SAN”). When a storage manager (that manages virtual storage volumes) of the SAN receives data to be written to a virtual storage volume from a computer server, the storage manager determines whether the writing request may result in updating a mapping of the virtual storage volume to a storage system. When the writing request does not involve updating the mapping, which happens most of the time, the storage manager simply writes the data to the storage system based on the existing mapping. Otherwise, the storage manager sends an updating request to another storage manager for updating a mapping of the virtual storage volume to a storage volume. Subsequently, the storage manager writes the data to the corresponding storage system based on the mapping that has been updated by the another storage manager.

Abstract: Methods and systems for improving performance in a storage system utilizing snapshots are disclosed by using metadata management of snapshot data. Specifically, various metadata structures associated with snapshots are utilized to reduce the number of IO operations required to locate data within any specific snapshot. The number of IO operations are reduced by allowing the various metadata structures associated with the temporally current snapshot to locate data directly within any temporally earlier snapshot or on the original root volume.

Abstract: Methods and apparatuses are provided for active-active support of virtual storage management in a storage area network (“SAN”). When a storage manager (that manages virtual storage volumes) of the SAN receives data to be written to a virtual storage volume from a computer server, the storage manager determines whether the writing request may result in updating a mapping of the virtual storage volume to a storage system. When the writing request does not involve updating the mapping, which happens most of the time, the storage manager simply writes the data to the storage system based on the existing mapping. Otherwise, the storage manager sends an updating request to another storage manager for updating a mapping of the virtual storage volume to a storage volume. Subsequently, the storage manager writes the data to the corresponding storage system based on the mapping that has been updated by the another storage manager.