Abstract: According to one embodiment, a computing cluster-wide shredding system includes a shredding device configured to shred multiple computing components of a computing cluster, such as a data center. The shredding device operates under control of a shredding controller. The shredding controller includes executable instructions that receives a trigger signal requesting that the computing cluster be shredded, and controls the shredding device to shred the computing cluster.

Abstract: Methods and systems are provided for managing a cloud deployment of software applications. A plurality of virtual machines of the cloud deployment that are used to operate the software applications are defined. Network communications between the virtual machines are monitored to measure bandwidth utilization by the virtual machines. Resource utilization by each of the virtual machines, such as memory, storage and processor usage, are also monitored. Availability constraints for the software applications are determined. A resource utilization function is defined for the deployment of the software applications for operation on some or all of the virtual machines within the availability constraints. The resource utilization function is solved to determine an updated cloud deployment of the software applications on a selected portion of the virtual machines. The cloud deployment is reconfigured to utilize the selected portion of the virtual machines, thus collapsing the resources utilized by the cloud deployment.

Abstract: Methods, apparatus, and processor-readable storage media for protecting data based on a context of data movement operations are provided herein. An example computer-implemented method includes identifying a context of a data movement operation based at least in part on a source and an indicated destination of data associated with the data movement operation; applying one or more data protection policies to the data movement operation based at least in part on the identified context, wherein a given data protection policy comprises one or more indications of one or more content scanners that are configured to detect data belonging to one or more regulated data classes; and in response to detecting data associated with the data movement operation that belongs to at least one of the regulated data classes, performing one or more automated remedial actions associated with the at least one regulated data class.

Abstract: Techniques are provided for authenticating communications between physical ports using knowledge of shared secrets. One method comprises receiving, by a first entity, a connection request to establish a communication between physical ports of the first entity and a second entity; providing a first pseudo-random value to the second entity; obtaining a shared secret for communications with the second entity; generating a first hash value based on the shared secret and the first pseudo-random value; obtaining a second hash value from the second entity based on the shared secret and the first second pseudo-random value; and authenticating the communication in response to the first entity validating the first hash value using the second hash value. An encryption key based on the shared secret can protect communications between the physical ports of the first and second entities.

Abstract: Methods, apparatus, and processor-readable storage media for determining migrations between geographically distributed data centers are provided herein. An example computer-implemented method includes obtaining information associated with data centers that are geographically distributed relative to one another, wherein the information includes: information related to migration factors specific to the respective geographic location of each of the data centers and information related to a respective set of processes of each of the data centers; automatically generating a migration schedule based at least in part on the obtained information, wherein the migration schedule comprises one or more times for migrating at least one of the processes of a first one of the data centers to a second one of the data centers; and automatically triggering at least one migration of the at least one process between the data centers based at least in part on the migration schedule.

Abstract: Methods, apparatus, and processor-readable storage media for coordinating storage system events are provided herein. An example method includes generating a representation of a set of components associated with a storage system comprising information corresponding to at least one data mirror in the set and at least one path associated with the set; obtaining a request from a given component in the set to perform an action that affects one or more of: at least one data mirror and at least one path; determining, based at least in part on the generated representation, whether the action will reduce a redundancy of the storage system to below a threshold level of redundancy specified for the storage system; and providing, to the given component, a response based at least in part on a result of the determining, wherein a performance of the action is controlled based at least in part on the response.

Abstract: Methods, apparatus, and processor-readable storage media for securing data transmissions using split messages are provided herein. An example computer-implemented method includes obtaining a plurality of messages including content to be transmitted from a host device to at least one storage system; dividing each of the plurality messages into two or more corresponding parts; and transmitting (i) a set of packets comprising the content over one or more communication channels, wherein the two or more corresponding parts of two or more of the plurality of messages are transmitted in different packets of the set, and (ii) information for reassembling the plurality of messages from the packets, wherein the information is identified using a mechanism specific to the at least one storage system.

Abstract: Methods, apparatus, and processor-readable storage media for protecting data based on a context of data movement operations are provided herein. An example computer-implemented method includes obtaining a list of carriers in response to a request to transfer data, stored on a storage system associated with a first location, to a second location, wherein each of the carriers is configured to physically move at least one mobile storage unit; scheduling at least two of the carriers to perform the transfer; transferring at least a portion of the data as data chunks from the first location to the second location, wherein each of the scheduled carriers transfers different data chunks via the corresponding at least one mobile storage unit; and transferring, over a network, at least one of: control information corresponding to the transfer and at least another portion of the data associated with the request.

Abstract: Methods, apparatus, and processor-readable storage media for protecting data based on a context of data movement operations are provided herein. An example computer-implemented method includes obtaining a list of carriers in response to a request to transfer data, stored on a storage system associated with a first location, to a second location, wherein each of the carriers is configured to physically move at least one mobile storage unit; scheduling at least two of the carriers to perform the transfer; transferring at least a portion of the data as data chunks from the first location to the second location, wherein each of the scheduled carriers transfers different data chunks via the corresponding at least one mobile storage unit; and transferring, over a network, at least one of: control information corresponding to the transfer and at least another portion of the data associated with the request.

Abstract: Methods and systems are provided for managing a cloud deployment of software applications. A plurality of virtual machines of the cloud deployment that are used to operate the software applications are defined. Network communications between the virtual machines are monitored to measure bandwidth utilization by the virtual machines. Resource utilization by each of the virtual machines, such as memory, storage and processor usage, are also monitored. Availability constraints for the software applications are determined. A resource utilization function is defined for the deployment of the software applications for operation on some or all of the virtual machines within the availability constraints. The resource utilization function is solved to determine an updated cloud deployment of the software applications on a selected portion of the virtual machines. The cloud deployment is reconfigured to utilize the selected portion of the virtual machines, thus collapsing the resources utilized by the cloud deployment.

Abstract: Methods, system, and non-transitory processor-readable storage medium for distributed and multi-level server authentication are provided herein. An example method includes receiving, by a plurality of second servers, a plurality of authentication secret slices, where a first server transmits each of the plurality of authentication secret slices to a respective second server of the plurality of second servers, receiving, by the first server, an authentication confirmation from each of the plurality of second servers and confirming, by the first server to a client, that an authentication request has succeeded.

Abstract: Methods, apparatus, and processor-readable storage media for providing an automated services exchange are described herein. An example computer-implemented method includes obtaining provider requests from one or more service providers, wherein each of the provider requests comprises an indication of at least one type of service provided by the corresponding service provider and attributes associated with the at least one type of the service; processing the provider requests, wherein the processing for a respective one of the provider requests comprises generating a corresponding set of metrics associated with the at least one type of service and the attributes of the respective provider request; and matching a given one of the provider requests to at least one consumer request based at least in part on: the processing and constraints identified in the at least one consumer request with respect to at least a portion of the attributes of the given provider request.

Abstract: Methods, apparatus, and processor-readable storage media for managing initiator identities are provided herein. An example computer-implemented method includes monitoring one or more port identifiers used by respective ones of a plurality of host initiators for accessing one or more storage components of a storage system; detecting, based on the monitoring, anomalous behavior of at least a first one of the host initiators, wherein the detecting comprises identifying that the first host initiator is using at least one same port identifier as a second one of the host initiators to access a particular one of the storage components; and performing at least one automated action in response to the detecting.

Abstract: Methods, apparatus, and processor-readable storage media for determining migrations between geographically distributed data centers are provided herein. An example computer-implemented method includes obtaining information associated with data centers that are geographically distributed relative to one another, wherein the information includes: information related to migration factors specific to the respective geographic location of each of the data centers and information related to a respective set of processes of each of the data centers; automatically generating a migration schedule based at least in part on the obtained information, wherein the migration schedule comprises one or more times for migrating at least one of the processes of a first one of the data centers to a second one of the data centers; and automatically triggering at least one migration of the at least one process between the data centers based at least in part on the migration schedule.

Abstract: Methods, apparatus, and processor-readable storage media for tracking data mirror differences are provided herein. An example computer-implemented method includes obtaining a request to start tracking data differences between a plurality of data mirror volumes of a storage system, wherein the storage system is configured to apply at least a first data tracking technique that tracks the data differences using one or more bitmap records and a second data tracking technique that tracks the data differences using or more journal records; selecting at least one of the first data tracking technique and the second data tracking technique using one or more selection criteria; and tracking the data differences in accordance with the selected at least one data tracking technique.

Abstract: Methods, apparatus, and processor-readable storage media for tracking data mirror differences are provided herein. An example computer-implemented method includes obtaining a request to start tracking data differences between a plurality of data mirror volumes of a storage system, wherein the storage system is configured to apply at least a first data tracking technique that tracks the data differences using one or more bitmap records and a second data tracking technique that tracks the data differences using or more journal records; selecting at least one of the first data tracking technique and the second data tracking technique using one or more selection criteria; and tracking the data differences in accordance with the selected at least one data tracking technique.

Abstract: Methods, apparatus, and processor-readable storage media for protecting data based on a context of data movement operations are provided herein. An example computer-implemented method includes identifying a context of a data movement operation based at least in part on a source and an indicated destination of data associated with the data movement operation; applying one or more data protection policies to the data movement operation based at least in part on the identified context, wherein a given data protection policy comprises one or more indications of one or more content scanners that are configured to detect data belonging to one or more regulated data classes; and in response to detecting data associated with the data movement operation that belongs to at least one of the regulated data classes, performing one or more automated remedial actions associated with the at least one regulated data class.

Abstract: Techniques are provided for authenticating communications between physical ports using knowledge of shared secrets. One method comprises receiving, by a first entity, a connection request to establish a communication between physical ports of the first entity and a second entity; providing a first pseudo-random value to the second entity; obtaining a shared secret for communications with the second entity; generating a first hash value based on the shared secret and the first pseudo-random value; obtaining a second hash value from the second entity based on the shared secret and the first second pseudo-random value; and authenticating the communication in response to the first entity validating the first hash value using the second hash value. An encryption key based on the shared secret can protect communications between the physical ports of the first and second entities.

Abstract: Data access threat detection and prevention modules are implemented proximate to data storage, e.g. in disk array controllers. The modules may be implemented in hardware or firmware. The modules monitor IOs from the disk array controllers to access managed drives. IOs exhibiting access parameters that deviate from a whitelist or match a blacklist are deemed to be suspicious. The whitelist may be created from monitoring normal, safe IOs and storing associated access patterns. In response to detection of suspicious activity the modules may halt or slow subsequent IOs, e.g. IOs to the same data, all data, an associated logical device, or the managed drive.

Abstract: Transferring an application from a first site to a second site includes determining that the second site is a destination site for the application, causing writes by the application at the first site to be propagated synchronously to the second site, transferring storage data from the first site to the second site, suspending operation of the application on the first site, and resuming operation of the application on the second site. The application may be a virtual machine or a host cluster capable of transitioning applications between cluster nodes. The virtual machine may be transferred from the first site to the second site by transferring an image of the virtual machine from the first site to the second site. The destination site may be selected by a user. The second site may be located remotely from the first site across an asynchronous distance.