Abstract: A system and method for securing data by receiving encrypted data at a security appliance transmitted from a client, wherein at least a portion of the encrypted data is encrypted according to a first encryption protocol, and wherein the encrypted data is transmitted to the security appliance according to a first data transfer protocol. The encrypted data is then decrypted at the security appliance, wherein at least a portion of the decrypted data is re-encrypted according to a second encryption protocol at the security appliance. The re-encrypted data is transmitted from the security appliance to a storage device, wherein the re-encrypted data is transmitted according to a second data transfer protocol that is different than the first data transfer protocol.

Abstract: Exemplary embodiments provide various techniques and systems for identifying data objects stored on clustered logical data containers. In one embodiment, a method is provided for creating a backward data object handle. In this method, a request to create a file is received, and a redirector file is created on a first logical data container based on receipt of the request. A redirector handle resulting from the creation of the redirector file is received. A data object of the file is then created on a second logical data container using the redirector handle as an identifier of the data object. This redirector handle included in the identifier then becomes a backward data object handle that points from the data object to the redirector file. As such, the redirector file can be identified by referencing the identifier of the data object.

Abstract: A data security appliance intercepts out-of-band control traffic directed to a data storage device, wherein the out-of-band control traffic includes a command to change a configuration of the data storage device. The data security appliance is reconfigured in accordance with the command in order to conform with a new configuration of the data storage device.

Abstract: Encryption using copy-on-encrypt determines that plaintext data stored in a plaintext buffer is to be written out to an encrypted storage resource. In response to the determining, an encryption buffer is allocated. The plaintext data is copied from the plaintext buffer to the encryption buffer and the encryption buffer is encrypted. Encrypted data from the encryption buffer is written to the encrypted storage resource. The encryption buffer is de-allocated. Read or write requests from a client are satisfied by retrieving the plaintext data from the plaintext buffer.

Abstract: A network storage server system includes a presentation layer that presents multiple namespaces over the same data stored in an object store, allowing users to simultaneously access data over multiple protocols. The system supports object location independence of the stored data objects by introducing a layer of indirection between directory entries and storage locations of stored data objects. In one embodiment, the directory entry of a data object points to a redirector file that includes an object locator (e.g., an object handle or a global object ID) of the data object. The directory entries of data objects are stored in a directory namespace (e.g., NAS path namespace). In another embodiment, a global object ID of the data object is directly encoded within the directory entry of the data object.