Abstract: Example implementations relate to encrypting data objects. In an example, data objects of a file system instance contained by a security domain are encrypted using a Data Encryption Key that is specific to the security domain and is wrapped by a Key Encryption Key shared exclusively within a cluster. A backup of the file system instance is created on a backup node. The backup includes at least some of the encrypted data objects. The DEK is sent to the backup node. The backup node cannot decrypt the backup unless the backup node is a member of the cluster and has access to the KEK to unwrap the DEK.

Abstract: In an example, a system may include an object store for storing objects, wherein each object is identified by an object signature generated according to a first cryptographic function, wherein the objects stored in the object store exhibit a hierarchical relationship from a root object. The system may receive a second cryptographic function for the object store, receive an I/O request affecting an object in the object store, encode the affected object according to the second cryptographic function, and persist the affected object alongside other objects in the object store encoded according to the first cryptographic function.

Abstract: Example implementations relate to encrypting data objects. In an example, data objects of a file system instance contained by a security domain are encrypted using a Data Encryption Key that is specific to the security domain and is wrapped by a Key Encryption Key shared exclusively within a cluster. A root object of the file system instance is encrypted using a Metadata Encryption Key. A backup of the file system instance is created on a backup node. The Data Encryption Key and the Metadata Encryption Key are sent to the backup node.

Abstract: In example implementations, a system may receive an input/output (I/O) operation in an object store storing a first object, determine objects represented in the object store affected by storing the first object, transcode the I/O operation into a transaction including the linked list of updates to objects represented in the object store, determine a persistent storage for storing the transaction and persist the transaction to the persistent storage according to a data structure determined by the type of persistent storage.

Abstract: Example implementations relate to backups to a secondary storage system of a file system instance that hierarchically relates data objects by content-based signatures to a root object and includes subtrees that correspond to respective inodes. In an example, a list of the content-based signatures is sent to the secondary storage system. Metadata and data of a subtree is stored into an item in the secondary storage system designated for the subtree.

Abstract: In an example, a system may modify an object stored in an object store for storing objects to include augmented metadata. The system may encode a signature of the modified object such that the signature is identical to a signature of the object prior to being modified to include the augmented metadata.

Abstract: In an example, a system includes network nodes implementing an object store. The system may determine reference count updates for objects stored on the object store, and delay persisting the reference count updates to a persistent storage. The system may cancel reference count updates that increments and decrement between the determined reference count update and another reference count update received during the delay in persisting the reference count update to the persistent storage to minimize writing to the object record.

Abstract: Example implementations relate to allocating an I/O request. In an example, a demultiplexer may forward an I/O request to a file system instance to which the I/O request belongs. The file system instance may tag the I/O request with a file system instance identifier associated with that file system instance. A volume manager may identify an extent pool to which the I/O request is to be allocated from among a plurality of extent pools of a storage based on the file system instance identifier tagged to the I/O request.

Abstract: Example implementations relate to encrypting data objects. In an example, data objects of a file system instance contained by a security domain are encrypted using a Data Encryption Key that is specific to the security domain and is wrapped by a Key Encryption Key shared exclusively within a cluster. A root object of the file system instance is encrypted using a Metadata Encryption Key. A backup of the file system instance is created on a backup node. The Data Encryption Key and the Metadata Encryption Key are sent to the backup node.

Abstract: Example implementations relate to encrypting data objects. In an example, data objects of a file system instance contained by a security domain are encrypted using a Data Encryption Key that is specific to the security domain and is wrapped by a Key Encryption Key shared exclusively within a cluster. A backup of the file system instance is created on a backup node. The backup includes at least some of the encrypted data objects. The DEK is sent to the backup node. The backup node cannot decrypt the backup unless the backup node is a member of the cluster and has access to the KEK to unwrap the DEK.

Abstract: A system and method for an object cache candidate filter comprising identifying a first portion and a second portion of an object signature, determining a bucket of a candidate data structure to associated with the object signature based on a first portion of the object signature, comparing the second portion of the object signature to each of a plurality of entries of the determined bucket of the candidate data structure, and, in response to determining no entry of the plurality of entries matches the second portion of the signature, the candidate filter storing the second portion of the object signature in an open entry of the determined bucket.

Abstract: Example implementations relate to partial file system instances. In an example, a subset of objects of a source file system instance on a source system are replicated to a target system to form a partial file system instance on the target system comprised of the subset of objects. Each of the objects of the source file system instance is identified by a signature based on content of each of the objects and the objects exhibit a hierarchical relationship to a root object in the file system instance. An unmaterialized object is dynamically added to the partial file system instance by replicating the corresponding object from the source file system instance. The target system is asynchronously updated from the source file system instance based on a comparison of the partial file system instance to the source file system instance.

Abstract: In an example, a system includes network nodes implementing an object store. The system may determine reference count updates for objects stored on the object store, and delay persisting the reference count updates to a persistent storage. The system may cancel reference count updates that increments and decrement between the determined reference count update and another reference count update received during the delay in persisting the reference count update to the persistent storage to minimize writing to the object record.

Abstract: In an example, a system includes network nodes implementing an object store. The system may determine reference count updates for objects stored on the object store, and delay persisting the reference count updates to a persistent storage. The system may cancel reference count updates that increments and decrement between the determined reference count update and another reference count update received during the delay in persisting the reference count update to the persistent storage to minimize writing to the object record.

Abstract: Example implementations relate to objects in extents on a storage resource. In an example, an extent identifier is persisted to a storage allocation table, where the extent identifier locates an extent on a storage resource. An extent map tracks which objects in the extent are deallocated. A virtual block address is generated allocating an object to store data. The virtual block address may include a storage allocation table key that locates the extent identifier in the storage allocation table and an extent offset to locate the object within the extent.

Abstract: In example implementations, a system may receive an input/output (I/O) operation in an object store storing a first object, determine objects represented in the object store affected by storing the first object, transcode the I/O operation into a transaction including the linked list of updates to objects represented in the object store, determine a persistent storage for storing the transaction and persist the transaction to the persistent storage according to a data structure determined by the type of persistent storage.

Abstract: Example implementations relate to objects in extents on a storage resource. In an example, an extent identifier is persisted to a storage allocation table, where the extent identifier locates an extent on a storage resource. An extent map tracks which objects in the extent are deallocated. A virtual block address is generated allocating an object to store data. The virtual block address may include a storage allocation table key that locates the extent identifier in the storage allocation table and an extent offset to locate the object within the extent.

Abstract: In an example, a system includes network nodes implementing an object store. The system may determine reference count updates for objects stored on the object store, and delay persisting the reference count updates to a persistent storage. The system may cancel reference count updates that increments and decrement between the determined reference count update and another reference count update received during the delay in persisting the reference count update to the persistent storage to minimize writing to the object record.

Abstract: In an example, a system may modify an object stored in an object store for storing objects to include augmented metadata. The system may encode a signature of the modified object such that the signature is identical to a signature of the object prior to being modified to include the augmented metadata.

Abstract: Example implementations relate to allocating an I/O request. In an example, a demultiplexer may forward an I/O request to a file system instance to which the I/O request belongs. The file system instance may tag the I/O request with a file system instance identifier associated with that file system instance. A volume manager may identify an extent pool to which the I/O request is to be allocated from among a plurality of extent pools of a storage based on the file system instance identifier tagged to the I/O request.