Abstract: A processor may receive storage area information of a smart storage area. A processor may analyze the one or more objects associated with the smart storage area. A processor may determine a layout of the one or more objects. The layout may be based, at least in part, on one or more object parameters of the one or more objects and the storage area information. A processor may arrange the one or more objects in the layout.

Abstract: Disclosed are various embodiments for improving the resiliency and performance of clustered memory. A computing device can generate at least one parity page from at least a first local page and a second local page. The computing device can then submit a first write request for the first local page to a first one of a plurality of memory hosts. The computing device can also submit a second write request for the second local page to a second one of the plurality of memory hosts. Additionally, the computing device can submit a third write request for the parity page to a third one of the plurality of memory hosts.

Abstract: A stripe reassembling technique includes a stripe server that selects stripes; uses data chunks including valid data in the stripes S1, S2, and S3 as data chunks in a new stripe S4, and generates data of a parity chunk for data of the data chunks in S4 according to an erasure coding (EC) algorithm the same as that of S1, S2, and S3 ; and stores the parity data of the parity chunk on a parity storage node.

Abstract: In a disk array configured to distribute and store a plurality of data on a plurality of storage devices, a disk array control device is configured to calculate recovery data for a plurality of storage devices upon detecting an incoherency in a redundant configuration without receiving an abnormality report from a storage device having written predetermined data thereon and to identify the storage device, relating to the correct recovery data determined according to a majority logic, as a storage device inviting an unfinished-writing failure.

Abstract: A method for proactively rebuilding user data in a plurality of storage nodes of a storage cluster in a single chassis is provided. The method includes distributing user data and metadata throughout the plurality of storage nodes such that the plurality of storage nodes can read the user data, using erasure coding, despite loss of two of the plurality of storage nodes. The method includes determining to rebuild the user data for one of the plurality of storage nodes in the absences of an error condition. The method includes rebuilding the user data for the one of the plurality of storage nodes. A plurality of storage nodes within a single chassis that can proactively rebuild the user data stored within the storage nodes is also provided.

Abstract: Embodiments of the present disclosure relate to methods, devices and computer program products for writing data in a disk array in a storage system. The storage system comprises a disk array. The method comprises: in response to receiving a write request to write new data to a data block in at least one disk array group in a degraded mode within a disk array, reading old data stored in the data block and old parity information stored in a parity block associated with the data block. The method further comprises: determining new parity information associated with the new data based on the old data, the old parity information and the new data. The method further comprises: writing the new data and the new parity information into at least one cache page provided by a cache component in the storage system, the at least one cache page being allocated in a persistent memory in the cache component.

Abstract: A method of performing a reconstruction of data in a redundant array of independent disks (RAID) system with a protection pool of storage units includes receiving a request to perform a reconstruction of a first set of physical extents stored on a first physical disk of a set of physical disks. Each physical extent of the first set of physical extents is associated with an array of a second set of physical extents. The second set of physical extents is distributed across the set of physical disks. The method further includes allocating a third set of physical extents on one or more physical disks of the set of physical disks other than the first physical disk, and distributing data from each of the first set of physical extents of the first physical disk to a corresponding physical extent of the third set of physical extents.

Abstract: A storage control node receives data to be written to a striped volume, allocates first and second stripes, writes the data to at least one data strip of the first stripe, computes parity data based on the data written to the first stripe, and writes the parity data to the first stripe. The storage control node sends a copy command to a target storage node which comprises the at least one data strip of the first stripe to thereby cause the at least one data strip to be copied to a data strip of the second stripe which resides on the target storage node. The storage control node writes additional data to the second stripe, computes updated parity data based on the additional data and the parity data of the first stripe, writes the updated parity data the second stripe, and releases the first stripe for reuse.

Abstract: A nonvolatile memory device may include a plurality of memory planes and a plurality of plane-dedicated pad sets. The plurality of memory planes may include a plurality of memory cell arrays including nonvolatile memory cells and a plurality of page buffer circuits. Each of the plurality of page buffer circuits may be connected to ones of the nonvolatile memory cells included in each of the plurality of memory cell arrays through bitlines. A plurality of plane-dedicated pad sets may be connected to the plurality of page buffer circuits through a plurality of data paths respectively such that each of the plurality plane-dedicated pad sets is dedicatedly connected to each of the plurality of page buffer circuits. A bandwidth of a data transfer may be increased by reducing a data transfer delay and supporting a parallel data transfer, and power consumption may be decreased by removing data multiplexing and/or signal routing.

Abstract: Technology is described for a system that includes a power source, a first computing device, a second computing device and a host controller. The power source may provide a direct current (DC) voltage. The first computing device may perform a computing function in a computing environment. The second computing devices may be connected in series to the power source via the first computing device. The first computing device may be directly coupled to the power source and may receive the DC voltage from the power source, and the second computing device may receive a remaining amount of the DC voltage. The host controller may manage computing operations of the first computing device and the second computing device to control load impedance between first computing device and the second computing device.

Abstract: A distributed storage integrity system in a dispersed storage network includes a scanning agent and a control unit. The scanning agent identifies an encoded data slice that requires rebuilding, wherein the encoded data slice is one of a plurality of encoded data slices generated from a data segment using an error encoding dispersal function. The control unit retrieves at least a number T of encoded data slices needed to reconstruct the data segment based on the error encoding dispersal function. The control unit is operable to reconstruct the data segment from at least the number T of the encoded data slices and generate a rebuilt encoded data slice from the reconstructed data segment. The scanning agent is located in a storage unit and the control unit is located in the storage unit or in a storage integrity processing unit, a dispersed storage processing unit or a dispersed storage managing unit.

Abstract: Techniques for using erasure coding in a single region to reduce the likelihood of losing objects in a cloud object storage platform are provided. In one set of embodiments, a computer system can upload a plurality of data objects to a region of a cloud object storage platform, where the plurality of data objects including modifications to a data set. The computer system can further compute a parity object based on the plurality of data objects, where the parity object encodes parity information for the plurality of data objects. The computer system can then upload the parity object to the same region where the plurality of data objects was uploaded.

Abstract: Presented herein are methods, non-transitory computer readable media, and devices for selectively limiting the amount of data in a file system, which include: determining a reparity bit value for a write disk block range, wherein the reparity bit is configured to track a number of writes in progress to a stripe range; determining the reparity bit value; updating a threshold written disk block number as a highest disk block number of the reparity bit value; and initiating a RAID operation until it reaches the threshold written disk block number, wherein the threshold written disk block number comprises a maximum written disk block number representing the last disk block number written.

Abstract: A RAID parity data generation offload system includes a RAID storage controller device that determines that a RAID parity data storage device loading for a RAID parity data storage device exceeds a loading threshold, and then generates and transmits a RAID parity data generation offload command associated with a RAID parity data update required in response to a RAID primary data update. A first RAID primary data storage device receives the RAID parity data generation offload command, and then retrieves current parity data from the RAID parity data storage device, and performs an XOR operation using the current parity data, current primary data, and updated primary data associated with the RAID primary data update in order to generate updated parity data. The first RAID primary data storage device then provides the updated parity data for storage on the RAID parity data storage device in place of the current parity data.

Abstract: Embodiments of the present disclosure relate to a method, device and computer program product for managing storage systems. A method comprises, in response to receiving a command to recover a storage system, reading first configuration information from a first disk of the storage system to be recovered, the first configuration information indicating a first disk array group to which the first disk belongs. The method further comprises recovering the first disk array group based at least on the first configuration information. The method further comprises, in response to the first disk array group being recovered, reading second configuration information from the first disk array group, the second configuration information indicating a storage resource pool to which the first disk array group belongs. Additionally, the method further comprises recovering the storage resource pool based at least on the second configuration information.

Abstract: A method and apparatus for performing dynamic recovery management regarding a RAID are provided. The method includes: writing a first set of protected data into a first protected access unit of multiple protected access units of the RAID, and recording a first set of management information corresponding to the first set of protected data, for data recovery of the first set of protected data; and when any storage device of multiple storage devices of the RAID malfunctions, writing a second set of protected data into a second protected access unit of the protected access units, and recording a second set of management information corresponding to the second set of protected data, for data recovery of the second set of protected data. Any set of the first set of protected data and the second set of protected data includes data and multiple parity-check codes.

Abstract: A distributed storage integrity system in a dispersed storage network includes a scanning agent and a control unit. The scanning agent identifies an encoded data slice that requires rebuilding, wherein the encoded data slice is one of a plurality of encoded data slices generated from a data segment using an error encoding dispersal function. The control unit retrieves at least a number T of encoded data slices needed to reconstruct the data segment based on the error encoding dispersal function. The control unit is operable to reconstruct the data segment from at least the number T of the encoded data slices and generate a rebuilt encoded data slice from the reconstructed data segment. The scanning agent is located in a storage unit and the control unit is located in the storage unit or in a storage integrity processing unit, a dispersed storage processing unit or a dispersed storage managing unit.

Abstract: A storage apparatus includes a plurality of storage devices, and a processor coupled to the plurality of storage devices and configured to generate, when detecting a failure of a storage device belonging to a first volume that is generated with the plurality of storage devices, a second volume having a remaining operating rate equal to or larger than an access frequency of the first volume and satisfying a required capacity of the first volume, with a storage device in an operating state of the plurality of storage devices, and move data arranged in the first volume to the second volume generated.

Abstract: A method for proactively rebuilding user data in a plurality of storage nodes of a storage cluster in a single chassis is provided. The method includes distributing user data and metadata throughout the plurality of storage nodes such that the plurality of storage nodes can read the user data, using erasure coding, despite loss of two of the plurality of storage nodes. The method includes determining to rebuild the user data for one of the plurality of storage nodes in the absences of an error condition. The method includes rebuilding the user data for the one of the plurality of storage nodes. A plurality of storage nodes within a single chassis that can proactively rebuild the user data stored within the storage nodes is also provided.

Abstract: A method includes: receiving, at a cluster controller of a first cluster, a request for pairing a first datastore of the first cluster to a second datastore of a second cluster, wherein each of the first cluster and the second cluster includes a plurality of datastores; determining whether the first datastore is available for pairing; in response to determining that the first datastore is available for pairing, generating an entry in a mapping table indicating that the first datastore is paired with the second datastore; receiving information associated with the second datastore; and in response to receiving the information, storing the information in the first datastore. The second cluster performs similar operations as those performed by the first cluster to achieve a bidirectional reservation between the first cluster and the second cluster.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for service oriented software-defined security framework are disclosed. In one aspect, a system includes a security control device, one or more assets, and a security controller that communicates with the security control device and the one or more assets. The security controller includes a processing engine configured to register the security control device by creating a physical-logical attribute mapping for the security control device, and generating a security service description associated with the security control device. The processing engine is further configured to register the one or more assets by creating a physical-logical attribute mapping for each of the one or more assets, and generating security service requirements for each of the one or more assets. The processing engine is further configured to generate a security service binding based on a request for service.

Abstract: A method for managing physical-to-logical address information in a memory system includes determining whether a memory fragment of a memory block is a last memory fragment of the memory block. The method also includes, in response to a determination that the memory fragment is not the last memory fragment of the memory block: performing a write operation on the memory fragment; storing, in cache associated with the memory system, physical-to-logical address information associated with the memory fragment; and, in response to a determination that the cache is full, writing, to a next memory fragment of the memory block, control metadata associated with physical-to-logical address information stored in the cache.

Abstract: A storage system comprises a cache device and a storage device group. A technique involves: the cache device of the storage system receiving from a host an input/output (I/O) request for the storage system; and upon determining that the storage system is just recovered from a hardware failure and the storage device group in the storage system is in a ready but degraded state, safely performing data write/read by sending a new Recover State I/O request to the storage device group. Such a technique may be used to reduce a Data Lost window, reduce or avoid data loss. In addition, such a technique may be implemented in a current RAID technology, namely, can be used in combination with the current RAID technology.

Abstract: Methods, non-transitory computer readable media, and computing devices that determine when a storage element of a data storage device has failed. Address(es) mapped to the failed storage element are identified, when the determining indicates that the storage element has failed. Data corresponding to the address(es) is regenerated according to a data loss protection and recovery scheme (e.g., a RAID scheme). The regenerated data is written to other storage element(s) of the data storage device in order to remap the address(es) to the other storage element(s). This technology allows a data storage device (e.g., an SSD) to be repaired in-place following a failure of storage element(s) (e.g., a die) of the data storage device. Advantageously, entire data storage devices do not have to be failed with this technology as a result of a failure of an individual storage element, thereby reducing data storage device failure rates and associated overhead.

Abstract: An information processing system including a processor, a memory, and a plurality of drives, wherein when a write request of new data is received, the processor stores the new data in the memory, transmits a response for the write request to a transmission source of the write request, reads old data updated by the new data from a first drive of the plurality of drives and old parity related to the old data from a second drive of the plurality of drives according to transmission of the response, store the old data and the old parity in the memory, generates new parity related to the new data from the new data, the old data, and the old parity stored in the memory, and stores the new data in the first drive to store the new parity in the second drive.

Abstract: Aspects of the present disclosure configure a memory sub-system to track error-correction parity calculations in the memory sub-system. For example, a memory sub-system controller of the memory sub-system can generate and use a first data structure to map one or more data chunks of an open data block to one or more buffers in a set of buffers for temporary storage of partial parity calculation results for the one or more data chunks, and generate and use a second data structure to map one or more data chunks of an open data block to one or more memory locations on non-volatile memory space (implemented by a set of memory components) for persistent storage of partial panty calculation results for the one or more data chunks.

Abstract: Distributed storage reservation for distributed data recovery is described. A system identifies a total number of connected computers, a storage capacity of each connected computer, and a maximum storage capacity of the identified storage capacities of the connected computers. The system determines a reserved storage capacity based on the maximum storage capacity and a reduced total number of the connected computers. The system provisions the reserved storage capacity in each connected computer. The system stores replicas of a database on the connected computers and on multiple computers, the multiple computers being the same as or different than the connected computers. The system identifies that a connected computer storing a replica of the database is unavailable. The system restores a replica of the database from at least one computer storing one replica to the reserved storage capacity in each of multiple available connected computers.

Abstract: A controller is configured to receive a write request from a host, and send an intermediate parity generation command corresponding to a specified address indicated by the write request to a first storage device in storage devices. The intermediate parity generation command instructs generation of an intermediate parity from new data at the specified address and old data that is updated to the new data. The intermediate parity generation command includes a first address in the memory area at which the new data is stored and a second address in the memory area for storing the intermediate parity. The first storage device is configured to receive the intermediate parity generation command, acquire the new data from the first address, generate the intermediate parity from the new data and the old data stored in the first storage device, and store the intermediate parity at the second address.

Abstract: A magazine-based data storage library in connection with a disk drive-based archive storage system is described that essentially generates parity data for tape formatted data streams (stored to tape cartridges) that do not align by way of data blocks or file marks. Data streams intended for tape storage sent to tape cartridges are also sent to a disk drive storage system via an encoder where parity of the data streams can be generated. More specifically, the encoder digitally formats tape blocks and tape marks (as well as other tape formatted structure) in a digital stream of data that can be added to other encoded digital streams of data to generate parity. To reconstruct a specific tape cartridge from a tape set, the encoded data from each of the tapes in the tape set are subtracted from the parity data and the remaining encoded data is decoded and sent to a designated tape cartridge.

Abstract: The present application discloses a storage device and a block storage method based on the storage device, wherein disk space of the storage device includes a data area having a plurality of end-to-end adjacent data block units, each of which includes a metadata block and a data block adjacent to each other; wherein the data block with a first preset capacity is configured to store target data, and the metadata block with a second preset capacity is configured to store information of the target data. With the storage device, metadata is stored in a distributed manner, wherein each of the metadata blocks and the data blocks are stored as a whole. The address offset of updating metadata after writing data is thus reduced, and the metadata update efficiency, as well as the overall storage performance of the storage device are improved.

Abstract: Systems and Methods for data storage in a distributed storage network are disclosed. Unexpected errors can adversely affect consistency of both the content of a write (including the slice data), and the synchronicity between the written slices and metadata structures. To maintain consistency between these data structures, a sequencing of the order of writes and flushes to the memory devices for the different data structures may be enforced as follows: First: Slice content data is first written to the volatile memory (e.g. a cache memory) of a DS unit; Second: the Slice content data stored in volatile memory is “flushed” to a non-volatile bin (which bin is associated with a group of physical memory blocks in non-volatile memory); Third: after the flush of the slice content data to the bin (i.e. data is durable on the media device): metadata relating to the data is written.

Abstract: Example implementations relate to a storage system. An example implementation includes a storage system including a controller coupled to a storage medium. The controller is to receive block priority information from a file system via a communication agent. The block priority information and the file system are associated with the storage medium. Based on the block priority information, the controller is to selectively perform an operation on the storage medium. The operation includes a reconstruction operation, a data scrubbing operation, and a data migration operation.

Abstract: A method for data stripping, allocation and reconstruction in an active drive storage system including a plurality of active object storage devices, each of the plurality of active object storage devices including one or more storage devices and a controller is provided. The method includes the controller of the identified one of the plurality of active object storage devices segmenting the received data into a plurality of data chunks and generating one or more parity chunks in response to the plurality of data chunks. The method further includes the controller of the identified one of the plurality of active object storage devices reorganizing the plurality of data chunks and the one or more parity chunks in response to a number of the plurality of data chunks and a number of the one or more of the plurality of active object storage devices into which the received data is to be stored.

Abstract: A storage system includes storage apparatuses and a second transmission path. The storage apparatuses each include a control device, and memory devices coupled in series with the control device through a first transmission path having the control device at a beginning. The memory devices are accessed by the control device. The second transmission path couples the storage apparatuses in a loop to allow communications between the control devices. The second transmission path includes the first transmission paths included in the respective storage apparatuses. The second transmission path is formed such that an ending of the first transmission path included in a first storage apparatus of the storage apparatuses is connected to the beginning of the first transmission path included in a second storage apparatus subsequent to the first storage apparatus on the second transmission path.

Abstract: One or more techniques and/or systems are provided for cluster configuration information replication, managing cluster-wide service agents, and/or for cluster-wide outage detection. In an example of cluster configuration information replication, a replication workflow corresponding to a storage operation implemented for a storage object (e.g., renaming of a volume) of a first cluster may be transferred to a second storage cluster for selectively implementation. In an example of managing cluster-wide service agents, cluster-wide service agents are deployed to nodes of a cluster storage environment, where a master agent actively processes cluster service calls and standby agents passively wait for reassignment as a failover master in the event the master agent fails. In an example of cluster-wide outage detection, a cluster-wide outage may be determined for a cluster storage environment based upon a number of inaccessible nodes satisfying a cluster outage detection metric.

Abstract: Performing failover processing between a production host and a backup host, a storage system is connected to the production host and the backup host. In response to a failure of the production host, metadata is obtained of data blocks that have been cached from an elastic space located in a fast disk of the storage system. A storage capacity of the elastic space is expanded. Data blocks are obtained to which the metadata corresponds according to the metadata and the storage capacity of the expanded elastic space, and storing the same in the expanded elastic space. In response the backup host requesting the data blocks to which the metadata corresponds, and the data blocks to which the metadata corresponds have already been stored in the expanded elastic space, data blocks are obtained to which the metadata corresponds from the expanded elastic space and transmitting the same to the backup host.

Abstract: A host device is provided. The host device includes a processor and an interface. The processor generates a physical block address and a solid state disk (SSD) identification code according to a logical block address of an access operation. The interface is coupled to the processor. The processor indicates one of a plurality of SSDs through the interface according to the SSD identification code to access data at the physical block address.

Abstract: A cold storage system includes data storage devices and parity storage devices. The data storage devices and the parity storage devices form a multiple dimensional matrix which has multiple rows and multiple columns. A controller receives a data write request, selects a data storage device for storing a plurality of data blocks, and writes the data blocks sequentially into memory blocks of the selected data storage device, each data block belonging to a row stripe distributed over one row of the matrix and to a column stripe distributed over one column of the matrix. The controller also generates a row protection block for the row stripe and a column protection block for the column stripe, and writes the row protection block and the column protection block to parity storage devices in the system.

Abstract: Methods, systems, and devices are described for displaying information on a visual display of a data storage device. The device may be an internal data storage device and may display information associated with various operation parameters or states of the data storage device. The data storage device may display, on the visual display, an indication that a data storage medium of the data storage device has been securely erased. The data storage medium may be securely erased by erasing an encryption key used to encrypt data stored on the data storage medium. The visual display may be electronic paper, mechanical, or chemical such that the information is displayed without power being applied to the data storage device.

Abstract: An optical disc device includes: an optical disc drive that reads data from a plurality of optical discs in which user data is recorded while distributed in the plurality of optical discs; a memory unit in which data read from an optical disc of a first group that is a part of the plurality of optical discs is recorded through the optical disc drive; and a controller that reproduces the user data from data of a remaining optical disc except for the first group, the data of the remaining optical disc being read through the optical disc drive, and the data recorded in the memory unit.

Abstract: Disclosed are solutions for resolving a redundant array of independent disks (RAID) write hole, or a parity-based fault scenario that occurs when a power failure and a drive failure occur at or close to the same time. Drive array controller logic assigns a sequence number to write operations received from a computing system and converts respective write operations, including corresponding sequence numbers, to a multiple-drive write to a series of RAID drives. A microcontroller at each drive writes, to a history log (HLOG) on the drive, a logical-to-physical address mapping of a prior sector of the drive that was written along with a corresponding sequence number. Upon receipt of a new write to the mapped logical address, the microcontroller removes the HLOG entry for the logical address, and writes a new entry to the HLOG with a new physical address mapping to the logical address with a new sequence number.

Abstract: Processing a file system operation is disclosed. An indication of a desired operation of a distributed file system is received. A metadata node for the desired operation is identified. It is indicated to the identified metadata node to process the desired operation. In the event the identified metadata node becomes not fully functional before the processing by the identified metadata node is confirmed, the distributed file system is analyzed to determine whether to indicate again to process the desired operation.

Abstract: A system, computer program product, and computer-executable method of implementing a redundant array of independent disk (RAID) system wherein the RAID, the computer-executable method comprises storing data storage blocks arranged in a first plurality of data rows and a second plurality of data columns and storing parity data in defined parity blocks, wherein a portion of the defined parity blocks include column parity data.

Abstract: A compute cluster including multiple compute nodes may implement distributed lock management using conditional updates to a distributed key value data store. It may be determined, at one or more compute nodes of a compute cluster, that particular lock is available based on a respective lock entry for the particular lock maintained in a lock manager table at a key value data store. The key value data store may be configured to perform conditional write requests for updates to data store at the key value, and may maintain data according to a distributed durability scheme. Compute nodes that determine that a lock is available may send a conditional write request to the key value data store in order to acquire the particular lock. The compute node that acquired the particular lock may be identified based on the successfully completed conditional write request to the respective lock entry.

Abstract: There are provided: a distribution storage processing unit for distributing and storing a plurality of fragment data including division data obtained by dividing storage target data into a plurality of pieces and redundant data into a plurality of storing unit; an operation status detecting unit for detecting operation statuses of the respective storing unit; and a data regenerating unit for, in accordance with a result of the detection by the operation status detecting unit, when any of the storing unit goes down, regenerating the fragment data having been stored in the down storing unit based on the other fragment data stored in the other storing unit different from the down storing unit. Moreover, the data regenerating unit has a function of transferring and storing the fragment data stored in the storing unit previously scheduled to go down into the other storing unit before the storing unit goes down.

Abstract: A method, for migrating newly allocated data into a second storage tier, includes receiving a request to store a data item. The method includes allocating an extent to a first storage tier to store the new data item. The method includes determining whether an extent is newly allocated on the first storage tier. The method includes migrating, by avoiding a learning phase, the newly allocated extent to the second storage tier from the first storage tier.

Abstract: The present disclosure relates to techniques for providing data redundancy after reducing memory writes. In one example implementation according to aspects of the present disclosure, a storage controller receives a storage command for providing data redundancy in accordance with a first data redundancy scheme. The storage controller then translates the storage command for providing the data redundancy in accordance with a second data redundancy scheme.

Abstract: The embodiments herein provide a method and system for polling and processing data. The method comprises computing a maximum time from a source after a last update time, waiting for a preset time to ensure that all transactions with respect to a change in a data is completed, querying for a plurality of changes after an elapse of the preset waiting time since the last update time and up to the maximum time, generating a time window, collecting a list of changes occurred within the generated time window, sending the collected list of changes for processing; and updating the processed data at the destination. The time window comprises a time interval between the last update time and the maximum time.

Abstract: A method, for migrating newly allocated data into a second storage tier, includes receiving a request to store a data item. The method includes allocating an extent to a first storage tier to store the new data item. The method includes determining whether an extent is newly allocated on the first storage tier. The method includes migrating, by avoiding a learning phase, the newly allocated extent to the second storage tier from the first storage tier.

Abstract: A method of policy management in a Data Loss Prevention (DLP) system uses a policy model that associates a user with one or more DLP endpoints. When an endpoint is added to the system, a set of policies for that endpoint are determined using an identity of the user that is associated with the endpoint and a list of roles or groups for that user. At policy distribution time, the method determines a set of endpoints to which the policy is to be distributed.