Abstract: Techniques are provided for repairing a primary slice file, affected by a storage device error, by using one or more dead replica slice files. The primary slice file is used by a node of a distributed storage architecture as an indirection layer between storage containers (e.g., a volume or LUN) and physical storage where data is physically stored. To improve resiliency of the distributed storage architecture, changes to the primary slice file are replicated to replica slice files hosted by other nodes. If a replica slice file falls out of sync with the primary slice file, then the replica slice file is considered dead (out of sync) and could potentially comprise stale data. If a storage device error affects blocks storing data of the primary slice file, then the techniques provided herein can repair the primary slice file using non-stale data from one or more dead replica slice files.

Abstract: Various aspects of the subject technology relate to systems, methods, and machine-readable media for determining a confidence factor for a sensitive type. The method includes applying a set of matching procedures to cells in a structured data set, the structured data set comprising columns and/or rows. The method also includes counting hit counts for the cells, the hit counts corresponding to successful matches. The method also includes counting null counts for the cells, the null counts corresponding to cells having null or invalid values. The method also includes counting mishit counts for the cells, the mishit counts corresponding to cells that are not null and do not result in a match. The method also includes calculating the confidence factor based on the hit counts, the null counts, and the mishit counts, the confidence factor providing an effective probability that cells in the structured data set is of the sensitive type.

Abstract: A system groups multiple entities in a large distributed data store (DDS), such as directories and files, into a subset called a domain. The domain is treated as a unit for defining policies to detect and treat sensitive data. Sensitive data can be defined by enterprise or industry. Treatment of sensitive data may include quarantining, masking, and encrypting, of the data or the entity containing the data. Data in a domain can be copied as a unit, with or without the same structure, and with transformations such as masking or encryption, into parts of the same DDS or to a different DDS. Domains can be the unit of access control for organizations, and assigned tags useful for identifying their purpose, ownership, location, or other characteristics. Policies and operations, assigned at the domain level, may vary from domain to domain, but within a domain are uniform, except for specific exclusions.

Abstract: A system groups multiple entities in a large distributed data store (DDS), such as directories and files, into a subset called a domain. The domain is treated as a unit for defining policies to detect and treat sensitive data. Sensitive data can be defined by enterprise or industry. Treatment of sensitive data may include quarantining, masking, and encrypting, of the data or the entity containing the data. Data in a domain can be copied as a unit, with or without the same structure, and with transformations such as masking or encryption, into parts of the same DDS or to a different DDS. Domains can be the unit of access control for organizations, and assigned tags useful for identifying their purpose, ownership, location, or other characteristics. Policies and operations, assigned at the domain level, may vary from domain to domain, but within a domain are uniform, except for specific exclusions.

Abstract: Various aspects of the subject technology relate to systems, methods, and machine-readable media for determining a confidence factor for a sensitive type. The method includes applying a set of matching procedures to cells in a structured data set, the structured data set comprising columns and/or rows. The method also includes counting hit counts for the cells, the hit counts corresponding to successful matches. The method also includes counting null counts for the cells, the null counts corresponding to cells having null or invalid values. The method also includes counting mishit counts for the cells, the mishit counts corresponding to cells that are not null and do not result in a match. The method also includes calculating the confidence factor based on the hit counts, the null counts, and the mishit counts, the confidence factor providing an effective probability that cells in the structured data set is of the sensitive type.

Abstract: Various aspects of the subject technology relate to systems, methods, and machine-readable media for determining a confidence factor for a sensitive type. The method includes applying a set of matching procedures to cells in a structured data set, the structured data set comprising columns and/or rows. The method also includes counting hit counts for the cells, the hit counts corresponding to successful matches. The method also includes counting null counts for the cells, the null counts corresponding to cells having null or invalid values. The method also includes counting mishit counts for the cells, the mishit counts corresponding to cells that are not null and do not result in a match. The method also includes calculating the confidence factor based on the hit counts, the null counts, and the mishit counts, the confidence factor providing an effective probability that cells in the structured data set is of the sensitive type.

Abstract: Various aspects of the subject technology relate to systems, methods, and machine-readable media for determining a confidence factor for a sensitive type. The method includes applying a set of matching procedures to cells in a structured data set, the structured data set comprising columns and/or rows. The method also includes counting hit counts for the cells, the hit counts corresponding to successful matches. The method also includes counting null counts for the cells, the null counts corresponding to cells having null or invalid values. The method also includes counting mishit counts for the cells, the mishit counts corresponding to cells that are not null and do not result in a match. The method also includes calculating the confidence factor based on the hit counts, the null counts, and the mishit counts, the confidence factor providing an effective probability that cells in the structured data set is of the sensitive type.

Abstract: A system groups multiple entities in a large distributed data store (DDS), such as directories and files, into a subset called a domain. The domain is treated as a unit for defining policies to detect and treat sensitive data. Sensitive data can be defined by enterprise or industry. Treatment of sensitive data may include quarantining, masking, and encrypting, of the data or the entity containing the data. Data in a domain can be copied as a unit, with or without the same structure, and with transformations such as masking or encryption, into parts of the same DDS or to a different DDS. Domains can be the unit of access control for organizations, and assigned tags useful for identifying their purpose, ownership, location, or other characteristics. Policies and operations, assigned at the domain level, may vary from domain to domain, but within a domain are uniform, except for specific exclusions.

Abstract: A system groups multiple entities in a large distributed data store (DDS), such as directories and files, into a subset called a domain. The domain is treated as a unit for defining policies to detect and treat sensitive data. Sensitive data can be defined by enterprise or industry. Treatment of sensitive data may include quarantining, masking, and encrypting, of the data or the entity containing the data. Data in a domain can be copied as a unit, with or without the same structure, and with transformations such as masking or encryption, into parts of the same DDS or to a different DDS. Domains can be the unit of access control for organizations, and assigned tags useful for identifying their purpose, ownership, location, or other characteristics. Policies and operations, assigned at the domain level, may vary from domain to domain, but within a domain are uniform, except for specific exclusions.

Abstract: Methods and systems for identifying sensitive information are provided. The method includes tokenizing labeled data into first word sequences, the labeled data including sensitive information. The method includes associating the labeled sensitive information with tags. The method includes determining that the first word sequences and the tags satisfy conditions defined by feature functions. The method includes calculating a local maximum of a likelihood function to determine a weight. The method includes tokenizing unlabeled data into second word sequences, the unlabeled data including sensitive information. The method includes executing each feature function based on their weights, the second word sequences, and tag sequences. The method includes selecting tag sequences that maximize probabilities of the second word sequences based on the likelihood function. The method includes identifying sensitive information in the unlabeled data based on the selected tag sequences.

Abstract: Methods and systems for tracking masking of one or more data elements in a datastore are disclosed. The methods involve monitoring one or more masking operations on the one or more data elements in the datastore. Thereafter, one or more metadata associated with the one or more masking operations are identified. Subsequent to identifying the one or more metadata, at least a part of the one or more metadata may be recorded. This metadata may then be transmitted to the destination when a copy (full/partial) of the original data is made, enabling the same information on masking to be obtained at the destination, as at the source.

Abstract: The present invention provides a method and system for providing a view of sensitive information across an enterprise. The method includes finding locations of data stores across the enterprise and thereafter searching for sensitive information within the data stores, based on policies. Upon identifying the sensitive information, the sensitive information is optionally quarantined, masked, or encrypted, again based on policies. Information about the locations of the data stores, the sensitive information associated with the data stores, and the masking steps taken, is saved in a repository, and can be tagged. A user may then query the repository to retrieve one or more views of the sensitive information, gaining an overview of the compliance posture of the enterprise relative to one or more data compliance regulations, and for potential data exposure risk areas be able to drill down for actionable level of details.

Abstract: A method and system for securing sensitive data content in big data stores is provided. In an example method, entities within the big data store that contain sensitive data are identified. Then, users who have entitlement to access these sensitive entities are identified, along with their level of entitlement. Access controls are then set, based on which users can operate on the sensitive entities. Access or attempts to access these entities is monitored on an ongoing basis. An example system maps entitlement to entities within the big data store that contain sensitive content, to monitor access to these entities and to set access controls for users accessing the big data store.

Abstract: A method and system for access-controlled decryption in big data stores is provided. In an implementation, a system provides a method for encryption that stores meta-information about sensitive data elements being encrypted in a big data store, such as a Hadoop system, in which the bulk of the data may remain unencrypted. In an implementation, the system reads the stored meta-information at decryption time to determine where the encrypted data is within a large and unencrypted file system, and to determine whether or not an individual user has access rights to decrypt a given element of sensitive data. The system allows fine-grain control over access rights to sensitive data during decryption.

Abstract: A system groups multiple entities in a large distributed data store (DDS), such as directories and files, into a subset called a domain. The domain is treated as a unit for defining policies to detect and treat sensitive data. Sensitive data can be defined by enterprise or industry. Treatment of sensitive data may include quarantining, masking, and encrypting, of the data or the entity containing the data. Data in a domain can be copied as a unit, with or without the same structure, and with transformations such as masking or encryption, into parts of the same DDS or to a different DDS. Domains can be the unit of access control for organizations, and assigned tags useful for identifying their purpose, ownership, location, or other characteristics. Policies and operations, assigned at the domain level, may vary from domain to domain, but within a domain are uniform, except for specific exclusions.

Abstract: A basic cell circuit architecture having plurality of cells with fixed transistors configurable for the formation of logic devices and single and dual port memory devices within a structured ASIC is provided. Different configurations of ensuing integrated circuits are achieved by forming variable interconnect layers above the fixed structures. The circuit architecture can achieve interconnection of transistors within a single cell or across multiple cells. The interconnection can be configured to form basic logic gates as well as more complex digital and analog subsystems. In addition, each cell contains a layout of transistors that can be variably coupled to achieve a memory device, such as a SRAM device. By having the capability of forming a logic circuit element, a memory device, or both, the circuit architecture is both memory-centric and logic-centric, and more fully adaptable to modern-day SoCs.

Abstract: A basic cell circuit architecture having plurality of cells with fixed transistors configurable for the formation of logic devices and single and dual port memory devices within a structured ASIC is provided. Different configurations of ensuing integrated circuits are achieved by forming variable interconnect layers above the fixed structures. The circuit architecture can achieve interconnection of transistors within a single cell or across multiple cells. The interconnection can be configured to form basic logic gates as well as more complex digital and analog subsystems. In addition, each cell contains a layout of transistors that can be variably coupled to achieve a memory device, such as a SRAM device. By having the capability of forming a logic circuit element, a memory device, or both, the circuit architecture is both memory-centric and logic-centric, and more fully adaptable to modern-day SoCs.

Abstract: An improved integrated circuit cell architecture is provided for configurability between a memory cell or logic elements. The cell architecture is configured on variable layers above a first layer of metal, with the first layer of metal and layers therebelow reserved as fixed layers. By coupling a maximum of two layout cells together, a single-port or dual-port memory cell is realized. Likewise, by interconnecting transistors within a single cell or transistors among two or more cells, a logic device is realized. Within each cell, the bit lines are arranged on a layer separate from the wordlines, and extend orthogonal to each other.

Abstract: A basic cell circuit architecture having plurality of cells with fixed transistors configurable for the formation of logic devices and/or single/dual port memory devices within a structured ASIC is provided. Different configurations of ensuing integrated circuits are achieved by forming variable interconnect layers above the fixed structures. The circuit architecture can achieve interconnection of transistors within a single cell and/or across multiple cells. The interconnection can be configured to form basic logic gates as well as more complex digital and analog subsystems. In addition, each cell contains a layout of transistors that can be variably coupled to achieve a memory device, such as a SRAM device. By having the capability of forming either a logic circuit element, a memory device, or both, the circuit architecture is both memory-centric and logic-centric, and more fully adaptable to modern-day SoCs.

Abstract: An improved integrated circuit cell architecture is provided for configurability between a memory cell or logic elements. The cell architecture is configured on variable layers above a first layer of metal, with the first layer of metal and layers therebelow reserved as fixed layers. By coupling a maximum of two layout cells together, a single-port or dual-port memory cell is realized. Likewise, by interconnecting transistors within a single cell or transistors among two or more cells, a logic device is realized. Within each cell, the bit lines are arranged on a layer separate from the wordlines, and extend orthogonal to each other.