Abstract: Illustrated is a system and method that includes a receiving module, which resides on a back end node, to receive a set of hashes that is generated from a set of chunks associated with a segment of data. Additionally, the system and method further includes a lookup module, which resides on the back end node, to search for at least one hash in the set of hashes as a key value in a sparse index. The system and method also includes a bid module, which reside on the back end node, to generate a bid, based upon a result of the search.

Abstract: One embodiment of the present invention provides a distributed, differential electronic-data storage system that includes client computers, component data-storage systems, and a routing component. Client computers direct data objects to component data-storage systems within the distributed, differential electronic-data storage system. Component data-storage systems provide data storage for the distributed, differential electronic-data storage system. The routing component directs data objects, received from the clients computers, through logical bins to component data-storage systems by a compression-enhancing routing method.

Abstract: One embodiment is a data processing apparatus that has a chunk store containing specimen data chunks, a manifest store containing a plurality of manifests, each of which represents at least a part of previously processed data and includes at least one reference to at least one of the specimen data chunks, and a sparse chunk index containing information on only some specimen data chunks. Input data is processed into a plurality of input data segments. Each manifest of the first set has at least one reference to one of said specimen data chunks that corresponds to one of the input data chunks of a first input data segment. Specimen data chunks corresponding to other input data chunks of the first input data segment are identified by using the identified first set of manifests and at least one manifest identified when processing previous data.

Abstract: Data processing apparatus comprising: a chunk store containing specimen data chunks, a manifest store containing at least one manifest that represents at least a part of a data set and that comprises at least one reference to at least one of said specimen data chunks, a sparse chunk index containing information on only those specimen data chunks having a predetermined characteristic, the processing apparatus being operable to process input data into input data chunks and to use the sparse chunk index to identify at least one of said at least one manifest that includes at least one reference to one of said specimen data chunks that corresponds to one of said input data chunks having the predetermined characteristic.

Abstract: A method, and associated apparatus, comprises calculating a first part of a message authentication function by a first processor, calculating a second part of the message authentication function by a second processor, and combining the first and second parts into the message authentication function by the first or second processor. The message authentication function can be used to authenticate data transmitted between the first processor and a third processor.

Abstract: Embodiments of the present invention relate to a system and method of document retention with policy-controlled deletion. Embodiments of the present invention comprise committing to a plurality of documents, deleting one of the plurality of documents, and providing a proof of authorized deletion of the one of the plurality of documents in response to an audit request.

Abstract: One embodiment of the present invention provides a distributed, differential electronic-data storage system that includes client computers, component data-storage systems, and a routing component. Client computers direct data objects to component data-storage systems within the distributed, differential electronic-data storage system. Component data-storage systems provide data storage for the distributed, differential electronic-data storage system. The routing component directs data objects, received from the clients computers, through logical bins to component data-storage systems by a compression-enhancing routing method.

Abstract: One embodiment of the present invention includes a method for routing a data object, comprising a sequence of data units, to a particular component data-storage system, or particular group of component data-storage systems, within a distributed, differential electronic-data storage system by selecting one or more subsequences of data units from the data object, computing a characteristic value from the selected subsequences, computing an index from the characteristic value; and directing the data object to the particular component data-storage system, or to the particular group component data-storage systems, identified by the computed index.

Abstract: A user profile is accessed. One or more items in the user profile are weighted and a score is determined. The user is eligible to be presented with data if the score satisfies a threshold.

Abstract: Embodiments of the present invention relate to a system and method of providing computer archive system accountability. In accordance with some embodiments of the present invention, the system and method may comprise receiving a plurality of documents and assigning document IDs to the plurality of documents, each of the document IDs corresponding to one of the received documents. Further, embodiments of the present invention may comprise building a hash-based directed acyclic graph (HDAG) specifying the received documents and their document IDs, the HDAG having a plurality of nodes, a root node, and a root hash, wherein the root hash depends on the HDAG and is a hash of the root node. Additionally, embodiments of the present invention may comprise making the root hash available, providing proofs that the received documents and document IDs are properly incorporated into the HDAG, and providing a copy of a particular document that corresponds to a given document ID on request.

Abstract: A method, and associated apparatus, comprises calculating a first part of a message authentication function by a first processor, calculating a second part of the message authentication function by a second processor, and combining the first and second parts into the message authentication function by the first or second processor. The message authentication function can be used to authenticate data transmitted between the first processor and a third processor.

Abstract: A network includes multiple segments and bridges interconnecting the segments, with hosts coupled to the segments. The bridges are smart bridges that each perform a host location initialization function. The host location initialization function in one bridge is performed in corporation with all other bridges in the bridged network via an instance through a propagation order spanning tree (POST). The initialization method includes obtaining prior host location information which is at least a partial representation of the host locations in the bridged network before the network topology change, obtaining hints on host location changes resulting from the network topology change, and modifying the prior host location information according to the hints to construct host location information for initialization. Location information for at least a portion of the hosts in the bridged network is preserved or discovered quickly each time when the network topology changes.

Abstract: The disclosed embodiments relate to a system and method of advertising. The method may comprise sending a targeted advertisement to at least one of a plurality of computers, wherein the targeted advertisement comprises a query. Further, the method may comprise receiving a proof after sending the targeted advertisement, wherein the proof relates to an earlier commitment of a profile of data stored on one of the plurality of computers, and using the proof to determine that the committed profile satisfied the query.

Abstract: The disclosed embodiments relate to a system and method of committing to a data set, comprising forming a directed acyclic graph adapted to encode the data set, the directed acyclic graph having a plurality of pointers and a plurality of nodes wherein at least one node has multiple parents, the directed acyclic graph having at least one root node and a plurality of leaf nodes. Further, disclosed embodiments comprise committing to the directed acyclic graph to produce a committed-to data set and producing a plurality of proofs about the committed-to data set such that a combination of the plurality of proofs does not reveal information about which nodes have multiple parents, each proof comprising a trace from one of the plurality of nodes to at least one different node, the trace comprising the identities of the nodes and pointers traversed.

Abstract: Preventing replay attacks on servers. At least one Bloom filter may be set up in a server for tracking requests received from clients. Identifying data may be generated for each request. The identifying data may be checked against the Bloom filter array. If a match is found, the message may be a replay and may be rejected. If a match is not found, the request identifying data may be added to the Bloom filter and the request may be processed.

Abstract: A system for protecting data integrity in a network attached block-device, such as a disk or a disk array, includes a capability issuer module coupled to a metadata server. The capability-issuer module creates capability data in accordance with a predetermined set of rules, and issues the capability data to the client over a secured channel. The capability data includes a group identifier, a capability identifier, a block-device identifier, a list of extents for specifying a range of blocks to which access is granted, an access mode for indicating the type of access allowed, and a cryptographic string for preventing forgery of capabilities by unauthorized parties. A capability checker module coupled to a network attached block-device verifies that the client's block access request is consistent with the capability data issued, and that the capability data is authentic. Upon verifying the client's capability data, the client's block access request is granted and executed at the network-attached block-device.