Abstract: A method of data reduction in a partially encrypted volume includes receiving data to be stored on a storage array, decrypting the data using a first encryption key to generate first decrypted data, and decrypting the data using a second encryption key to generate second decrypted data. The method further includes comparing, by a storage array controller, a first compressibility value of the first decrypted data to a second compressibility value of the second decrypted data. The method further includes storing the first decrypted data if the first compressibility value is greater than or equal to the second compressibility value. The method further includes storing the second decrypted data if the second compressibility value is greater than the first compressibility value.

Abstract: Ensuring the appropriate utilization of system resources using weighted workload based, time-independent scheduling, including: receiving an I/O request associated with an entity; determining whether an amount of system resources required to service the I/O request is greater than an amount of available system resources in a storage system; responsive to determining that the amount of system resources required to service the I/O request is greater than the amount of available system resources in the storage system: queueing the I/O request in an entity-specific queue for the entity; detecting that additional system resources in the storage system have become available; and issuing an I/O request from an entity-specific queue for an entity that has a highest priority, where a priority for each entity is determined based on the amount of I/O requests associated with the entity and a weighted proportion of resources designated for use by the entity.

Abstract: A method of encryption management with host-side data reduction includes identifying data to be written to a storage array and compressing the data to generate compressed data. The method further includes encrypting the compressed data to generate an encrypted data packet. The method further includes adding, by a processing device of a host, a padding bit pattern to the encrypted data packet to generate a data block for storage. The method further includes sending the data block to the storage array.

Abstract: Ensuring the fair utilization of system resources using workload based, time-independent scheduling, including: receiving an I/O request associated with an entity; determining whether an amount of system resources required to service the I/O request is greater than an amount of available system resources in a storage system; responsive to determining that the amount of system resources required to service the I/O request is greater than the amount of available system resources in the storage system: queuing the I/O request in an entity-specific queue for the entity; detecting that additional system resources in the storage system have become available; and responsive to detecting that additional system resources in the storage system have become available, issuing an I/O request from an entity-specific queue for an entity that has a highest priority among entities with non-empty entity-specific queues.

Abstract: Ensuring the appropriate utilization of system resources using weighted workload based, time-independent scheduling, including: receiving an I/O request associated with an entity; determining whether an amount of system resources required to service the I/O request is greater than an amount of available system resources in a storage system; responsive to determining that the amount of system resources required to service the I/O request is greater than the amount of available system resources in the storage system: queueing the I/O request in an entity-specific queue for the entity; detecting that additional system resources in the storage system have become available; and issuing an I/O request from an entity-specific queue for an entity that has a highest priority, where a priority for each entity is determined based on the amount of I/O requests associated with the entity and a weighted proportion of resources designated for use by the entity.

Abstract: Ensuring the fair utilization of system resources using workload based, time-independent scheduling, including: determining whether an amount of system resource utilization in the storage system has reached a predetermined utilization threshold; and responsive to determining that the amount of system resource utilization in the storage system has reached a predetermined utilization threshold: determining whether one or more entities in the storage system have utilized system resources in excess of their fair share by a predetermined threshold during a time-independent period; and responsive to determining that one or more entities in the storage system have utilized system resources in excess of their fair share by the predetermined threshold during the time-independent period, freezing, at least partially, an amount by which the one or more entities in the storage system have utilized system resources in excess of their fair share.

Abstract: Ensuring the fair utilization of system resources using workload based, time-independent scheduling, including: determining whether an amount of available system resources in the storage system has reached a predetermined reservation threshold; and responsive to determining that the amount of available system resources in the storage system has reached the predetermined reservation threshold: determining whether one or more entities in the storage system have utilized system resources in excess of their fair share by a predetermined threshold during one or more time-independent periods; and responsive to determining that one or more entities in the storage system have utilized system resources in excess of their fair share by the predetermined threshold during the time-independent period, limiting the one or more entities from issuing additional I/O requests to the storage system.

Abstract: Ensuring the fair utilization of system resources using workload based, time-independent scheduling, including: receiving an I/O request associated with an entity; determining whether an amount of system resources required to service the I/O request is greater than an amount of available system resources in a storage system; responsive to determining that the amount of system resources required to service the I/O request is greater than the amount of available system resources in the storage system: queuing the I/O request in an entity-specific queue for the entity; detecting that additional system resources in the storage system have become available; and responsive to detecting that additional system resources in the storage system have become available, issuing an I/O request from an entity-specific queue for an entity that has a highest priority among entities with non-empty entity-specific queues.

Abstract: According to one or more embodiments of the present invention, a network cache intercepts data requested by a client from a remote server interconnected with the cache through one or more wide area network (WAN) links (e.g., for Wide Area File Services, or “WAFS”). The network cache stores the data and sends the data to the client. The cache may then intercept a first write request for the data from the client to the remote server, and determine one or more portions of the data in the write request that changed from the data stored at the cache (e.g., according to one or more hashes created based on the data). The network cache then sends a second write request for only the changed portions of the data to the remote server.

Abstract: A technique for eliminating duplicate data is provided. Upon receipt of a new data set, one or more anchor points are identified within the data set. A bit-by-bit data comparison is then performed of the region surrounding the anchor point in the received data set with the region surrounding an anchor point stored within a pattern database to identify forward/backward delta values. The duplicate data identified by the anchor point, forward and backward delta values is then replaced in the received data set with a storage indicator.

Abstract: A system and method for securing data by receiving encrypted data at a security appliance transmitted from a client, wherein at least a portion of the encrypted data is encrypted according to a first encryption protocol, and wherein the encrypted data is transmitted to the security appliance according to a first data transfer protocol. The encrypted data is then decrypted at the security appliance, wherein at least a portion of the decrypted data is re-encrypted according to a second encryption protocol at the security appliance. The re-encrypted data is transmitted from the security appliance to a storage device, wherein the re-encrypted data is transmitted according to a second data transfer protocol that is different than the first data transfer protocol.

Abstract: A data security appliance intercepts out-of-band control traffic directed to a data storage device, wherein the out-of-band control traffic includes a command to change a configuration of the data storage device. The data security appliance is reconfigured in accordance with the command in order to conform with a new configuration of the data storage device.

Abstract: According to one or more embodiments of the present invention, a network cache intercepts data requested by a client from a remote server interconnected with the cache through one or more wide area network (WAN) links (e.g., for Wide Area File Services, or “WAFS”). The network cache stores the data and sends the data to the client. The cache may then intercept a first write request for the data from the client to the remote server, and determine one or more portions of the data in the write request that changed from the data stored at the cache (e.g., according to one or more hashes created based on the data). The network cache then sends a second write request for only the changed portions of the data to the remote server.

Abstract: A system and method for “on-the-fly” de-duplication of data before storing the data in a storage system. A data de-duplication module illustratively cooperates with protocol servers and a file system of a storage operating system executing on the storage system to implement the novel de-duplication technique. The de-duplication module illustratively generates a block store, an index file and a hash table on storage space provided by the storage system. The hash table is utilized for tracking fingerprints and locations of blocks within the block store. The index file is utilized for storing directory information identifying the contents of data containers stored on the storage system, while the block store is utilized to store raw data blocks that comprise the data containers.

Abstract: Described is a process for encrypting and compressing data for storage by computing systems. A data stream received by a computing system is separated into data chunks for storage on a storage device using a data layout format. Each data chunk is examined and if possible, compressed to produce a compressed data chunk. Whether or not the data chunk can be compressed, the data chunk is encrypted and stored on the storage device in addition to metadata that describes the data chunk. When reading the stored data chunk from the storage device, the metadata identifies the starting location of the stored data chunk and provides metadata information to the computing system for decryption and decompression processing.

Abstract: A technique for eliminating duplicate data is provided. Upon receipt of a new data set, one or more anchor points are identified within the data set. A bit-by-bit data comparison is then performed of the region surrounding the anchor point in the received data set with the region surrounding an anchor point stored within a pattern database to identify forward/backward delta values. The duplicate data identified by the anchor point, forward and backward delta values is then replaced in the received data set with a storage indicator.

Abstract: According to one or more embodiments of the present invention, a network cache intercepts data requested by a client from a remote server interconnected with the cache through one or more wide area network (WAN) links (e.g., for Wide Area File Services, or “WAFS”). The network cache stores the data and sends the data to the client. The cache may then intercept a first write request for the data from the client to the remote server, and determine one or more portions of the data in the write request that changed from the data stored at the cache (e.g., according to one or more hashes created based on the data). The network cache then sends a second write request for only the changed portions of the data to the remote server.

Abstract: A system and method for signature based data container recognition is provided. When a new data container, such as a lun, is created, a security appliance generates a signature of the data container, by, e.g., examining the contents of one or more data blocks of the data container. The generated signature is then associated with the appropriate encryption key for the data container and is stored either within a configuration database of the security appliance or on a key management system operating within a security appliance environment. To identify the encryption key associated with a data container, the security appliance generates a signature of the data container and compares the generated signature with the stored signatures. Should there be a matching signature, the security appliance utilizes the encryption key associated with the matching signature to process data access requests to/from the data container.

Abstract: A technique for eliminating duplicate data is provided. Upon receipt of a new data set, one or more anchor points are identified within the data set. A bit-by-bit data comparison is then performed of the region surrounding the anchor point in the received data set with the region surrounding an anchor point stored within a pattern database to identify forward/backward delta values. The duplicate data identified by the anchor point, forward and backward delta values is then replaced in the received data set with a storage indicator.

Abstract: Embodiments of the present invention provide mechanisms for improving storage consumption on a sequential access medium, such as a physical tape, by preferably storing one instance of a data block of a backup data set on the tape media. When another instance of a data block is received having the same pattern as the stored data block, rather than storing the data block itself, a reference to the data block is stored on the sequential access medium. When data are restored, data blocks are cached at a block store on a storage device(s) having a faster seek time than the tape. When a reference to a previously stored data block is read from the tape, rather than re-winding the tape to search for the data block on the tape (which might take a long time to locate), the referenced data block can be found on the storage device having a faster seek time than the tape media.