MAINTAINING RETENTION POLICIES IN A BLOCK STORAGE, MULTI-CLIENT DEDUP DOMAIN

    公开(公告)号:US20220237148A1

    公开(公告)日:2022-07-28

    申请号:US17160783

    申请日:2021-01-28

    摘要: One example method includes maintaining a deduplication data structure including one or more entries that each identify a respective fingerprint, and pointer, and also maintaining a ClientBlockList data structure comprising one or more entries that each identify a respective handle, retention date, and block, receiving a write request that identifies a handle, retention date, and block, computing a fingerprint of the block identified in the write request, determining, by the server, whether the fingerprint is in the deduplication data structure, and when the fingerprint is not in the deduplication data structure, storing the block identified in the write request at location ‘L’ in the deduplication data structure, and adding, to the deduplication data structure, an entry that identifies the fingerprint and the location ‘L,’ and adding, to the ClientBlockList data structure, an entry that identifies the handle, retention date, and fingerprint.

    DEDUPLICATION OF CLIENT ENCRYPTED DATA
    2.
    发明申请

    公开(公告)号:US20200213109A1

    公开(公告)日:2020-07-02

    申请号:US16236604

    申请日:2018-12-30

    IPC分类号: H04L9/08 H04L9/06 G06F16/215

    摘要: Plaintext data is encrypted to produce ciphertext which is transmitted along with a hash of the plaintext data and corresponding metadata comprising an initialization vector and information about the encryption key version used to encrypt the plaintext data to a backend storage system. The encrypted ciphertext is deduplicated at the backend storage system (without first decrypting it) using the hash and stored based upon the metadata.

    EFFICIENT AND SECURE DISTRIBUTED LEDGER MAINTENANCE

    公开(公告)号:US20200351104A1

    公开(公告)日:2020-11-05

    申请号:US16933416

    申请日:2020-07-20

    摘要: An apparatus in one embodiment includes at least one processing device comprising a processor coupled to a memory. The processing device is configured to implement a first ledger maintenance node. The first ledger maintenance node is configured to communicate over one or more networks with a plurality of additional ledger maintenance nodes, to identify a block for proposed addition to a distributed ledger collectively maintained by the first and additional ledger maintenance nodes, to apply a digital signature of the first ledger maintenance node to the block, and to receive digital signatures on the block from at least a subset of the additional ledger maintenance nodes. Responsive to receipt of sufficient digital signatures from respective ones of the additional ledger maintenance nodes to meet a specified quorum of digital signatures required for addition of the block to the distributed ledger, the first ledger maintenance node adds the block to the distributed ledger.

    Client-side user authentication control based on stored history of incorrect passwords

    公开(公告)号:US10819700B1

    公开(公告)日:2020-10-27

    申请号:US15893929

    申请日:2018-02-12

    发明人: Radia J. Perlman

    摘要: An apparatus in one embodiment comprises a client configured to perform client-side portions of one or more user authentication protocols carried out between the client and one or more authentication servers over a network. The client stores, for one or more instances of a given one of the user authentication protocols carried out for a particular user, an incorrect password history comprising identifiers of one or more passwords previously entered by the user and indicated as being incorrect passwords by at least one of the authentication servers, and determines, for an additional password entered by the user but not yet submitted by the client to the authentication servers, whether or not the additional password is part of the incorrect password history. Responsive to the additional password being part of the incorrect password history, the client generates an alert for presentation to the user to indicate that the additional password may be an incorrect password.

    Computer system employing challenge/response protocol with detection of non-unique incorrect responses

    公开(公告)号:US10764068B2

    公开(公告)日:2020-09-01

    申请号:US15883565

    申请日:2018-01-30

    摘要: A challenge/response authentication procedure determines whether a response is a correct response, a unique incorrect response, or a non-unique incorrect response, the unique incorrect response and non-unique incorrect response being differentiated by comparing the response value with a store of unique incorrect response values. For the correct response, client access to protected computer system resources is allowed, and the challenge value is discarded so as not to be used again. For the unique incorrect response, (1) when a predetermined limit of unique incorrect responses has not been reached, then the response value is added to the store of unique incorrect response values and the process is repeated with reuse of the challenge value, and (2) when the predetermined limit has been reached, then the client is locked out. For the non-unique incorrect response, the process is repeated with reuse of the challenge value.

    Preventing malicious lockout of user accounts

    公开(公告)号:US11042629B2

    公开(公告)日:2021-06-22

    申请号:US16154996

    申请日:2018-10-09

    IPC分类号: G06F21/45 G06F21/64

    摘要: An authentication server in an illustrative embodiment is configured to communicate with one or more client devices over a network. Responsive to a successful login to a user account by a client device, the authentication server provides the client device with a login cookie for the user account for potential utilization in one or more subsequent logins to the user account. The authentication server initializes a cookie-specific counter for the login cookie, and increments the cookie-specific counter for each of one or more unsuccessful logins to the user account made utilizing the login cookie. Responsive to the cookie-specific counter reaching a specified value, the authentication server locks the user account for any subsequent logins to the user account made utilizing the login cookie. The authentication server resets the cookie-specific counter responsive to a successful login to the user account made utilizing the login cookie. The authentication server also maintains a non-cookie counter for counting failed logins made without utilizing a valid login cookie.

    Incremental data validation
    7.
    发明授权

    公开(公告)号:US10394646B1

    公开(公告)日:2019-08-27

    申请号:US14984749

    申请日:2015-12-30

    IPC分类号: G06F11/10

    摘要: Described are techniques for performing data validation processing. An expected sequence of characters is determined that includes a plurality of groups. Each of the plurality of groups includes a first expected sequence of one or more characters representing encoded information and a second expected sequence of one or more data validation characters determined in accordance with a corresponding portion of the expected sequence. The portion includes at least the first expected sequence of one or more characters of the group. Data validation processing is incrementally performed as data for each of the plurality of groups is received. The data validation processing performed as data for each group is received uses a received sequence of one or more data validation characters corresponding to the second expected sequence of one or more data validation characters of each group.

    COMPUTER SYSTEM EMPLOYING CHALLENGE/RESPONSE PROTOCOL WITH DETECTION OF NON-UNIQUE INCORRECT RESPONSES

    公开(公告)号:US20190238346A1

    公开(公告)日:2019-08-01

    申请号:US15883565

    申请日:2018-01-30

    摘要: A challenge/response authentication procedure determines whether a response is a correct response, a unique incorrect response, or a non-unique incorrect response, the unique incorrect response and non-unique incorrect response being differentiated by comparing the response value with a store of unique incorrect response values. For the correct response, client access to protected computer system resources is allowed, and the challenge value is discarded so as not to be used again. For the unique incorrect response, (1) when a predetermined limit of unique incorrect responses has not been reached, then the response value is added to the store of unique incorrect response values and the process is repeated with reuse of the challenge value, and (2) when the predetermined limit has been reached, then the client is locked out. For the non-unique incorrect response, the process is repeated with reuse of the challenge value.

    Maintaining retention policies in a block storage, multi-client dedup domain

    公开(公告)号:US11989158B2

    公开(公告)日:2024-05-21

    申请号:US17160783

    申请日:2021-01-28

    摘要: One example method includes maintaining a deduplication data structure including one or more entries that each identify a respective fingerprint, and pointer, and also maintaining a ClientBlockList data structure comprising one or more entries that each identify a respective handle, retention date, and block, receiving a write request that identifies a handle, retention date, and block, computing a fingerprint of the block identified in the write request, determining, by the server, whether the fingerprint is in the deduplication data structure, and when the fingerprint is not in the deduplication data structure, storing the block identified in the write request at location ‘L’ in the deduplication data structure, and adding, to the deduplication data structure, an entry that identifies the fingerprint and the location ‘L,’ and adding, to the ClientBlockList data structure, an entry that identifies the handle, retention date, and fingerprint.

    Ensuring data authenticity using notary as a service

    公开(公告)号:US11435907B2

    公开(公告)日:2022-09-06

    申请号:US16455320

    申请日:2019-06-27

    IPC分类号: G06F3/06 H04L9/32

    摘要: One example method includes accessing stored data, associating a unique identifier with the data, creating a hash by hashing a combination that comprises the unique identifier and the data, transmitting the hash to a notary service, receiving, from the notary service, a digital signature that corresponds to the hash, appending the digital signature to the data, and storing, as an object, a combination that comprises the digital signature, the data, and the unique identifier.