The present invention relates generally to maintaining the compliance of data in a network and more particularly to encrypting data in a network memory architecture.
To allow remote employees access to an enterprise's information systems, organizations typically choose between two networking approaches: centralized servers or distributed servers. Centralized server implementations have the advantage of simplicity since an information technology (IT) professional centrally manages, maintains, and enforces policies for the organization's data.
An issue that arises in allowing remote access to information is that unauthorized users may also gain access to the organization's data. Additionally, legislation in the United States and individual states requires that certain information is encrypted and/or make the organization civilly liable for injuries resulting from data breaches. Two examples of federal legislation requiring compliance include the Health Insurance Portability and Accountability Act (HIPAA) and the Sarbanes-Oxley Act. To secure the data and memory against theft, viruses, and hackers, the data is encrypted using an algorithm such as Advanced Encryption Scheme (AES), Data Encryption Scheme (DES), or Triple DES. However, two issues arise when encrypting data on a network. First, encryption can negatively affect performance. Second, when not encrypted, data is still vulnerable to unauthorized use.
Many organizations select the distributed server implementation to mitigate some of the problems with the centralized server implementation.
In the distributed server system 100, the branch servers 140 (e.g., email servers, file servers and databases) are placed locally in the branch office 110, rather than solely in the central office 120. The branch servers 140 typically store all or part of the organization's data. The branch servers 140 generally provide improved application performance and data access for the computers 160. The branch servers 140 respond to a request for the organization's data from the local data. For each request for the data, the central servers 170 potentially do not need to transfer the data over the communication network 130 (i.e., the WAN), via router 180 and router 150. Synchronization and backup procedures are implemented to maintain the coherency between the local data in the branch office 110 and the data in the central office 120.
Unfortunately, managing the distributed server system 100 is complex and costly. From a physical point of view, the distributed server system 100 with one hundred branch offices requires an order of one hundred times more equipment than a centralized server approach. Each piece of the equipment not only needs to be purchased, but also installed, managed, and repaired, driving significant life cycle costs. The branch office 110 may need additional local IT personnel to perform operations because of this “Server Sprawl”. Furthermore, the multiplication of managed devices means additional license costs, security vulnerabilities, and patching activities.
In distributed server implementations (e.g., the distributed server system 100), the data, including the “golden copy” or most up-to-date version of mission critical data, is often stored (at least temporarily) only on the branch servers 140 in the branch office 110. Organizations implement complex protocols and procedures for replication and synchronization to ensure that the mission critical data is backed up and kept in-sync across the WAN with the central servers 170.
Security vulnerabilities are a particular problem in providing compliance to the distributed server system 100. As the “golden copy” is stored on a local server and backed up locally, this computer or storage may be stolen, infected with viruses, or otherwise compromised. Having multiple servers also increases the overall exposure of the system to security breaches. Additionally, locally encrypting the data or the system further complicates the replication and synchronization of central servers 170 and decreases performance. Therefore, data in a distributed server implementation is vulnerable and maintaining compliance can be difficult.
Typically, the central servers 260 in the central office 220 store the organization's data. Computers 240 make requests for the data from the central servers 260 over the communication network 230. The central servers 260 then return the data to the computers 240 over the communication network 230. Typically, the central servers 260 are not encrypted. The central servers 260 are usually maintained in a secure location such as a locked building requiring a hand scan or an iris scan for entry to prevent theft of the hard disks on which data is stored. This is a more secure system because the computers 240 contain only a small amount of unencrypted data that can be breached if, for example, the computer is stolen, resold, or infected by a virus.
The communication network 230 typically comprises a private network (e.g., a leased line network) or a public network (e.g., the Internet). The connections to the communication network 230 from the branch office 210 and the central office 220 typically cause a bandwidth bottleneck for exchanging the data over the communication network 230. The exchange of the data between the branch office 210 and the central office 220, in the aggregate, will usually be limited to the bandwidth of the slowest link in the communication network 230.
For example, the router 250 connects to the communication network 230 by a T1 line, which provides a bandwidth of approximately 1.544 Megabits/second (Mbps). The router 270 connects to the communication network 230 by a T3 line, which provides a bandwidth of approximately 45 Megabits/second (Mbps). Even though the communication network 230 may provide an internal bandwidth greater than 1.544 Mbps or 45 Mbps, the available bandwidth between the branch office 210 and the central office 220 is limited to the bandwidth of 1.544 Mbps (i.e., the T1 connection). Connections with higher bandwidth to relieve the bandwidth bottleneck across the communication network 230 are available, but are generally expensive and have limited availability.
Moreover, many applications do not perform well over the communication network 230 due to the limited available bandwidth. Developers generally optimize the applications for performance over a local area network (LAN) which typically provides a bandwidth between 10 Mbps to Gigabit/second (Gbps) speeds. The developers of the applications assume small latency and high bandwidth across the LAN between the applications and the data. However, the latency across the communication network 130 typically will be 100 times that across the LAN, and the bandwidth of the communication network 230 will be 1/100th of the LAN.
Furthermore, although
As well as implementing centralized servers or distributed servers, organizations also implement mechanisms for caching to improve application performance and data access. A cache is generally used to reduce the latency of the communication network (e.g., communication network 230) forming the WAN (i.e., because the request is satisfied from the local cache) and to reduce network traffic over the WAN (i.e., because responses are local, the amount of bandwidth used is reduced).
Web caching, for example, is the caching of web documents (i.e., HTML pages, images, etc.) in order to reduce web site access times and bandwidth usage. Web caching typically stores unencrypted local copies of the requested web documents. The web cache satisfies subsequent requests for the web documents if the requests meet certain predetermined conditions.
One problem with web caching is that the web cache is typically only effective for rarely modified static web documents. For dynamic documents, there is a difficult tradeoff between minimizing network traffic and the risk of the web cache serving up stale data. The web cache may serve stale data because the web cache responds to requests without consulting the server.
Another problem is that the web cache does not recognize that two otherwise identical documents are the same if they have a different Uniform Resource Locator (URL). The web cache does not consider the content or context of the documents. Thus, the web cache caches the documents by URL or filename without a determination of the content or context of the document. Moreover, the web cache stores entire objects (such as documents) and cache-hits are binary: either a perfect match or a miss. Even where only small changes are made to the documents, the web cache does not use the cached copy of the documents to reduce network traffic.
A network memory system for ensuring compliance is disclosed. The network memory system comprises a first appliance that encrypts data and stores the encrypted data in a first memory device. The first appliance also determines whether the original data is available in a second appliance in encrypted or unencrypted form and transmits a store instruction comprising the original data based on the determination that the first data does not exist in the second appliance. The second appliance receives the store instruction comprising the first data from the first appliance, encrypts the first data, and stores the encrypted data in a second memory device. The second appliance subsequently receives a retrieve instruction comprising an index, or location indicator, at which the encrypted first data is stored, processes the retrieve instruction to obtain encrypted response data, and decrypts the encrypted response data, and transmits the decrypted response data to a computer.
In some embodiments, the second appliance transmits the decrypted response data. The first appliance may receive data from at least one computer. The data may be encrypted using an algorithm such as Advanced Encryption Scheme, Data Encryption Scheme, or Triple Data Encryption Scheme. The second appliance may combine the encrypted response data with a key stream. In some embodiments, the first appliance stores the encrypted data at the index independent of an application or data context.
A method for ensuring compliance in a network memory is also disclosed. The method comprises encrypting data in a first appliance and storing the encrypted data in a first memory device. The method further comprises determining whether the original data is available in a second appliance in encrypted or unencrypted form, transmitting a store instruction comprising the original data from the first appliance, and receiving the store instruction into the second appliance, encrypting the first data, and storing the encrypted first data in a second memory device. Additionally, the method comprises receiving a retrieve instruction indicating an index at which the encrypted first data is stored into the second memory device, in the second appliance, processing the retrieve instruction to obtain encrypted response data, and decrypting the encrypted response data.
A software product for ensuring network compliance is also disclosed. The software product comprises software operational when executed by a processor to direct the processor to encrypt data in a first appliance, store the encrypted data in a memory device, determine whether the original data is available in a second appliance in encrypted or unencrypted form, and transmit a store instruction comprising the original first data from the first appliance. The software is further operational when executed by a processor to receive the store instruction into the second appliance, encrypt the data, store the encrypted data in a second memory device, receive a retrieve instruction into the second appliance, the retrieve instruction comprising an index at which the encrypted data is stored, processing the retrieve instruction to obtain encrypted response data in the second appliance, and decrypt the encrypted response data in the second appliance.
The embodiments discussed herein are illustrative of one example of the present invention. As these embodiments of the present invention are described with reference to illustrations, various modifications or adaptations of the methods and/or specific structures described may become apparent to those skilled in the art. All such modifications, adaptations, or variations that rely upon the teachings of the present invention, and through which these teachings have advanced the art, are considered to be within the scope of the present invention. Hence, these descriptions and drawings should not be considered in a limiting sense, as it is understood that the present invention is in no way limited to only the embodiments illustrated.
To provide improved application performance and data access, the network memory system generally comprises a first appliance and a second appliance. The first appliance receives data and determines whether a portion of the data is locally accessible to the second appliance. The first appliance generates an instruction based on the determination and transfers the instruction to the second appliance through the communication network.
The network memory system provides that the second appliance processes the instruction to obtain the data and transfers the data to a computer. The data may be locally accessible to the second appliance, and the transfer to the computer may occur faster than transferring the data over the communication network. Accordingly, the second appliance transfers the data to computer without the first appliance transferring the data over the communication network that may have a high latency and low bandwidth. Thus, the network memory system operates to reduce latency and network traffic over the communication network.
In the branch office 310, the computers 340 are linked to the branch appliance 350. The branch appliance 350 is linked to the router 360. The router 360 is coupled to the communication network 330. In the central office 320, the central servers 370 are linked to the central appliance 380. The central appliance 380 is linked to the router 390. The router 390 is coupled to the communication network 330.
The principles discussed herein are equally applicable to multiple branch offices (not shown) and to multiple central offices (not shown). For example, the network memory system 300 may include multiple branch offices and/or multiple central offices coupled to the communication network 330. Branch office/branch office communication and central office/central office communication, as well as multi-appliance and/or multi-node communication and bi-directional communication are further within the scope of the disclosure. However, for the sake of simplicity, the disclosure illustrates the network memory system 300 having the single branch office 310 and the single central office 320, and the respective branch office 310/central office 320 communication.
The communication network 330 comprises hardware and/or software elements that enable the exchange of information (e.g., voice and data) between the branch office 310 and the central office 320. Some examples of the communication network 330 are a private wide-area network (WAN), and the Internet. Typically connections from the branch office 310 to the communication network 330 (e.g., from the router 360 and the router 390) are ISDN, T1 lines (1.544 Mbps), and possibly broadband connections such as digital subscriber lines (DSL) and cable modems. Other examples are T3 lines (43.232 Mbps), OC3 (155 Mbps), and OC48 (2.5 Gbps), although more costly and more likely used for interconnection at the central office 320 or as the backbone of the communication network 330.
The branch appliance 350 comprises hardware and/or software elements configured to receive data (e.g., email, files, and databases transactions), determine whether a portion of the data is locally accessible to an appliance (e.g., the central appliance 380), generate an instruction based on the determination, and transfer the instruction to the appliance. The branch appliance 350 also comprises hardware and/or software elements configured to receive an instruction from an appliance (e.g., the central appliance 380), process the instruction to obtain data, and transfer the data to a computer (e.g., the computers 340). One example of the branch appliance 350 is described below with respect to
Locally accessible data comprises any data transferable to the computer (e.g., the computers 340 and the central servers 370) by an appliance (e.g., the branch appliance 350 and the central appliance 380) without transferring the data over the communication network 330. In some examples, the locally accessible data is stored in random access memory (RAM) in the branch appliance 350, on a hard drive in the branch appliance 350, and a combination of data stored in RAM and on one or more hard drives in the branch appliance 350. In another example, the locally accessible data is accessible by the branch appliance 350 over a communication network (other than the communication network 330), such as data stored in a network attached storage (NAS) device that is internal or external to the branch office 310. In still another example, the locally accessible data is stored in a database. The database may be stored in RAM, on a hard disk, a combination of RAM and hard disks, in a NAS device, and/or in other optical and flash storage devices.
The instruction comprises any message or signal that indicates to an appliance (e.g., the branch appliance 350 and the central appliance 380) an action to perform with the data. Some examples of the instruction indicate to the appliance to store the data, to retrieve the data, and to forward the data to the computer (e.g., the central servers 370 and the computers 340). The instruction may be explicit or implicit based on instructions indicating to store or retrieve the data. In some embodiments, the instruction indicates an index within a database for storing and retrieving the data.
The central appliance 380 comprises hardware and/or software elements configured to receive data, determine whether a portion of the data is locally accessible to an appliance (e.g., the branch appliance 350), generate an instruction based on the determination, and transfer the instruction to the appliance. The central appliance 380 also comprises hardware and/or software elements configured to receive an instruction from an appliance (e.g., the branch appliance 350), process the instruction to obtain the data, and transfer the data to a computer (e.g., the central servers 370). One example of the central appliance 380 is described below with respect to
As illustrated, the branch appliance 350 is configured in-line (or serially) between the computers 340 and the router 360. The central appliance 380 is also configured serially between the central servers 370 and the router 390. The branch appliance 350 and the central appliance 380 transparently intercept network traffic between the computers 340 and the central servers 370. For example, the central appliance 380 transparently intercepts data sent from the central servers 370 and addressed to the computers 340. The computers 340 and the central servers 370 advantageously require no additional configuration because the branch appliance 350 and the central appliance 380 operate transparently.
Alternatively, the branch appliance 350 and the central appliance 380 are configured as an additional router or gateway. As a router, for example, the branch appliance 350 appears to the computers 340 as an extra hop before the router 360. In some embodiments, the branch appliance 350 and the central appliance 380 provide redundant routing or peer routing with the router 360 and the router 390. Additionally, in the bridge and router configurations, the branch appliance 350 and the central appliance 380 provide failure mechanisms, such as, fail-to-open (e.g., no data access) or fail-to-wire (e.g., a direct connection to the router 360).
It will be understood that the branch appliance 350 and the central appliance 380 perform bi-directional communication. For example, data sent to the branch appliance 350 from the central appliance 380 may be stored in a location locally accessible to the central appliance 380 and in a location locally accessible to the branch appliance 350. If the data is to be transferred again from the central appliance 380 to the branch appliance 350, the central appliance 380 may determine that the data is locally accessible to the branch appliance 350 and generate an instruction to the branch appliance 350 to retrieve the data. The central appliance 380 transfers the instruction to the branch appliance 350 and the branch appliance 350 processes the instruction to obtain the data. If later, the branch appliance 350 is to transfer the entire data back to the central appliance 380, the branch appliance 350 may use the fact that the central appliance 380 has before transferred the data to the branch appliance 350. The branch appliance 350 therefore determines that the data is locally accessible to the central appliance 380 and generates an instruction to the central appliance 380 to retrieve the data. The branch appliance 350 transmits the instruction to the central appliance 380 and the central appliance 380 processes the instruction to obtain the data. Therefore, an appliance (e.g., the branch appliance 350 and the central appliance 380) in the network memory system 300 advantageously uses data transferred to and from the appliance to reduce network traffic with other appliances in the network memory system 300.
The network memory system 300 advantageously provides increased productivity, reduced IT costs, and enhanced data integrity and compliance. For example, the network memory system 300 achieves the simple administration of centralized server systems whereby the central servers 370 store the primary copy of the data. The network memory system 300 improves application performance and data access in the branch office 310 and central office 320 because not every response to a data request travels over the communication network 330 from the central servers 370. The branch appliance 350 and the central appliance 380 also store to and retrieve from a local copy of the data for subsequent exchanges of the data.
In addition to enhanced performance, network memory system 300 provides the increased compliance of centralized server systems. The branch appliance 350 encrypts data, stores the encrypted data within the local copy in the branch appliance 350 or a NAS device, and transmits the data to the central appliance 380. The branch appliance 350 also retrieves the encrypted response data from the local copy per an instruction from the central appliance 380, decrypts the response data, and forwards the response data to the computers 340. The branch appliance 350 may also determine whether the data is locally accessible to the central appliance 380.
The central appliance 380 may likewise receive an instruction from the branch appliance 350 to store encrypted data in a local copy such that is locally accessible to the central servers 370. The central appliance 380 may receive unencrypted data from central servers 370, encrypt the data, and store the data in the local copy. The central appliance 380 is configured to determine whether the data is locally accessible to the branch appliance 350. The central appliance 380 may also transmit a store instruction and encrypted data to the branch appliance 350. The central appliance 380 is further configured to decrypt the data before transmitting the data to the central servers 370. Because a master copy is stored in the central servers 370, locally accessible data is encrypted at the branch office 310 without the replication and synchronization problems of distributed server systems.
The branch appliance 350 and/or the central appliance 380 may encrypt the data using the Advanced Encryption Scheme (AES) algorithm, the Data Encryption Scheme (DES) algorithm, the Triple DES algorithm, or the like.
Additionally, the network memory system 300 does not cache the data in the traditional sense. The data may be retrieved locally even if the URL or filename for the data is different because the data may be identified by a pattern for the data itself and not by the URL or filename. Furthermore, unlike web caching, the network memory system 300 ensures that the data is coherent by forwarding messages (e.g., data requests and responses) between the computers 340 and the central servers 370. For example, web caching operates by locally intercepting messages for an authoritative source (e.g., a web server) and responding to the messages such that the web server potentially never sees the messages. In some cases, particularly with dynamic content, the locally cached copy may be stale or out-of-date. Advantageously, the network memory system 300 provides the data coherency and up-to-date data by the transparent operation of the network memory system 300 and the principle in which messages are transferred end-to-end (e.g., from computers 340 to the central servers 370), even though the messages and/or the data may not traverse the communication network 330.
The network memory system 300 does not have the higher cost of distributed server systems because the branch appliance 350 and the central appliance 380 provide benefits across all applications and displace several distributed devices and caches, particularly in multiple branch implementations. In some embodiments, the branch appliance 350 and the central appliance 380 provide internal storage for a secondary copy of the data. The network memory system 300 also reduces the hardware and license costs for the branch office 310 and the central office 320 by eliminating the need for the numerous distributed devices. Further, the network memory system 300 minimizes the security vulnerabilities and patching activities commonly associated with the distributed systems. Management of the branch appliance 350 and the central appliance 380 is simpler than the management of a remote distributed server. Unlike remote servers, there is no need to configure user accounts, permissions, and authentication schemes on the branch appliance 350 and the central appliance 380.
In sequence 415, the central servers 370 process the data request 410, and in sequence 420, the central servers 370 generate the response data 425 based on the data request 410. Some examples of the response data 425 are an email message and attachment, a file, a web page, and results retrieved or obtained from the database query. The central servers 370 then transmit the response data 425 to the central appliance 380. Alternatively, in some embodiments, the central servers 370 address the response data 425 directly to the computers 340, however, during transmission, the central appliance 380 transparently intercepts the response data 425. In sequence 430, the central appliance 380 processes the response data 425 to determine whether a portion of the response data 425 is locally accessible to the branch appliance 350.
An appliance of the network memory system 300 (e.g., the branch appliance 350 and the central appliance 380) calculates hashes at every byte boundary of a data flow (e.g., the response data 425) to be sent across the communication network 330. In some embodiments, the data flow includes packets that are in the same Internet Protocol (IP) flow, as defined by the IP header five tuple of source address, source port, destination address, destination port, and protocol. The hashes may be influenced by preceding bytes in the data flow. For example, the hashes are influenced by approximately the n previous bytes, where n determines the fingerprint size. Some examples of calculating the hashes are cyclical redundancy checks (CRCs) and checksums over the previous n bytes of the data flow. In some embodiments, rolling implementations of CRCs and checksums are used where a new byte is added, and a byte from n bytes earlier is removed. To maximize the ability to determine whether a portion of the data flow is available in another appliance in the network memory system 300, the hash calculation may span across successive IP packets in the data flow. In other embodiments, the hash calculation ignores patterns that span one or more IP packet boundaries in the data flow, and the hashes are calculated within a single IP packet.
Each calculated hash is filtered by a fine filter 560 and a coarse filter 565. The appliance designates the locations in the data flow which meet the fine and coarse filter criteria as fine and coarse sync-points, respectively. The fine filter 560 and the coarse filter 565 have different filter criteria. Typically, the filter criteria for the coarse filter 565 are more restrictive and may be used to further filter those hashes which pass the fine filter. In other words, the fine filter produces a fine comb of sync-points and the coarse filter produces a coarse comb of sync-points. One example of the filter criteria is the null filter which allows results in sync-points at all locations. In another example, the filter criteria declares a fine sync-point when the top five bits of the hashes are all zeros and a coarse filter criteria which stores or compares hashes when the top ten bits of the hashes are all zeros. The hash at the fine sync-points index the fine SHT 505 and the hash at the coarse sync-points index the coarse SHT 525. For example, the index could be derived from the hash by using a number of low order bits from the hash. The filter criteria affect the sizing of the SHTs 505 and 525 and the probability of matching a hash in the SHTs 505 and 525. The more sync-points that are generated the easier repeated data is identified but, the larger the tables (i.e., the SHTs 505 and 525) need to be in order to index a given amount of information for the data flow. Having a coarse and fine table helps optimize this tradeoff. Alternative implementations may use a single table or multiple tables.
The fine SHT 505 is populated with hashes as the data 555 (e.g., the response data 425) is stored and when the data 555 is recalled from disk or other locally accessible storage. The fine SHT 505 finely indexes the data 555. In some embodiments, the fine SHT 505 holds approximately one entry for every 100 bytes of the data 555. The coarse SHT 525 is populated as the data 555 is stored and is coarsely indexed. For example, the coarse SHT 525 may hold one entry for approximately every 4 kilobytes (KB) of the data 555. The fine SHT 505 and the coarse SHT 525 may be considered short term and long term memory index structures, respectively.
The appliance of the network memory system 300 stores all or part of the calculated hashes in or compares all or part of the hashes to the check field 510 in the SHTs 505 and 525. For example, the central appliance 380 verifies a “hit” in the fine SHT 505 by comparing the entire calculated hash or a number of residual bits of the calculated hash to the check field 510. If the central appliance 380 finds no matching hashes in the fine SHT 505 or in the coarse SHT 525, the central appliance 380 determines that the response data 425 is not locally accessible to the branch appliance 350. Each calculated hash for the response data 425 in the fine SHT 505 and the coarse SHT 525 is stored or compared depending on the filter criteria for the fine filter 560 and the coarse filter 565.
The appliance of the network memory system 300 indexes each entry in the fine SHT 505 and the coarse SHT 525 to a page (e.g., by setting the page field 515 and the page field 535 to address page N) and byte offset (e.g., by setting the byte field 520 and the byte field 540 to a byte offset of the data 555) in the FHPs 545. For example, the central appliance 380 stores the response data 425 in the FHPs 545 at the page pointed to by the page field 515 and 535 at the byte offset indicated by the byte field 520 and 540. The byte field 520 of each hash in the fine SHT 505 for the response data 425 points to the start of a fine sync-point. The byte field 540 of each hash in the coarse SHT 525 for the response data 425 points to the start of a coarse sync-point.
In this example, the branch appliance 350 includes a fine SHT 505, a coarse SHT 525, and a FHP 545 data structure, and the central appliance 380 includes a fine SHT 505, a coarse SHT 525, and a FHP 545 data structure. Each appliance in the network memory system 300 maintains the separate data structures, with may include separate filter criteria for the fine filter 560 and the coarse filter 565. The page state information 550, in the FHP 545 of each appliance in the network memory system 300, includes page parameters, page ownership permissions, peer state, and a list of valid byte ranges for each appliance in the network memory system 300. The page state information 550 tracks the local state of the page (e.g., the FHP 545 in the branch appliance 350, and what parts of the page are used) and the remote state of the page at peers (e.g., the central appliance 380, and what part of the page in the branch appliance 350 is used by the central appliance 380).
The branch appliance 350 and the central appliance 380 each write the data 555 to an assigned page (e.g., the page N or the page N+1) and may reference a page assigned to another appliance in the network memory system 300. Appliances in the network memory system 300 may discover and reconcile the FHPs 545 assigned to other appliances as explained below with regard to
Referring again to
In sequence 445, the branch appliance 350 processes the response data 725 with the store instruction 440. In sequence 450, based on the store instruction 440, the branch appliance 350 stores the response data 425 in the branch appliance 350 at the index within the database. In this example, the branch appliance 350 stores the response data 425 in the FHPs 545 at the page and at a particular byte offset indicated by the index. Sequence 450 additionally includes encrypting the FHPs 545. In sequence 455, the branch appliance 350 forwards the response data 425 to the computer 340. As discussed previously, the branch appliance 350 may forward the data to the computer based on explicit and implicit instructions.
In sequence 630, the central appliance 380 processes the response data 625 to determine whether a portion of the response data 625 is locally accessible to the branch appliance 350. The central appliance 380 again generates hashes for the response data 625, as previously described with respect to
Based on the determination that the entire response data 625 is locally accessible to the branch appliance 350, in sequence 635, the central appliance 380 generates a retrieve instruction 640 that indicates to the branch appliance 350 to retrieve the response data 625 at an index within the database. The central appliance 380 then transmits only the retrieve instruction 640 to the branch appliance 350. In this manner, the central appliance 380 optimizes network traffic over the communication network 330. If the retrieve instruction 640 is smaller in size than the response data 625, the central appliance 380 transmits the retrieve instruction 640. If the retrieve instruction 640 is larger than the response data 625, the central appliance 380 transmits the response data 625 instead.
In sequence 645, the branch appliance 350 processes the retrieve instruction 640. In sequence 650, based on the retrieve instruction 640, the branch appliance 350 retrieves the response data 625 at the index within the database. Sequence 650 includes decrypting the FHPs 545 in which the response data 625 is stored. In sequence 655, the branch appliance 350 forwards the response data 625 to the computer 340.
In sequence 730, the central appliance 380 processes the response data 725 to determine whether a portion of the response data 725 is locally accessible to the branch appliance 350. The central appliance 380 computes hashes for the response data 725 and filters the hashes through the fine filter 560 and the coarse filter 565 to determine any fine and coarse sync-points. The central appliance 380 then looks up any fine sync-points in the fine SHT 505 and coarse sync-points in the coarse SHT 525. In this example, only a portion of the response data 725 is locally accessible to the branch appliance 350, meaning that although the central appliance 380 finds at least one match in the SHTs 505 and 525, additional checks (such as the direct forward comparison and the backward memory comparison with the response data 725 and the data 555) determine that only a portion of the response data 725 is locally accessible to the branch appliance 350.
The central appliance 380 stores the generated hashes for the non-locally accessible portion of the response data 725 (otherwise known as the deltas) in the SHTs 505 and 525, and stores the deltas in the FHPs 545. The central appliance 380 additionally encrypts the FHPs 545. The central appliance 380 will transmit the deltas (i.e., the portion of the response data 725 that is not locally accessible) to the branch appliance 350.
In sequence 735, the central appliance 380 generates retrieve and store instructions 740. The retrieve instruction indicates to the branch appliance 350 to retrieve the locally accessible portion of the response data 725 at an index within the database. The store instruction indicates to the branch appliance 350 to store the deltas at an index within the database. The store instruction may also indicate to the branch appliance 350 to store another copy of the portion of the response data 725 locally accessible to the branch appliance 350 with the deltas. The entire response data 725 will then be locally accessible in the database to the branch appliance 350. The central appliance 380 attaches the deltas to the retrieve and store instructions 740. The central appliance 380 then transmits the non-locally accessible portion of the response data 725 with retrieve and store instructions 740 to the branch appliance 350.
In sequence 745, the branch appliance 350 processes the non-locally accessible portion of the response data 725 with retrieve and store instructions 740. In sequence 750, based on the retrieve instruction, the branch appliance 350 retrieves the locally accessible portion of the response data 725 at the index in the database. In sequence 755, the branch appliance 350 obtains the response data 725 from the retrieved locally accessible portion and the transferred deltas (i.e., the transferred non-locally accessible portion of the response data 725). To obtain the data, the branch appliance 350 decrypts the response data 725. In sequence 760, based on the store instruction, the branch appliance 350 stores the deltas (and potentially the retrieve locally accessible portion of the response data 725) at the index in the database. If the deltas are not encrypted, the branch appliance 350 further encrypts the deltas. In sequence 765, the branch appliance 350 transmits the entire response data 725 to the computer 340.
Alternatively, in addition to the examples in
In still further embodiments, the instruction may indicate a plurality of indexes. Referring again to
The database 850 comprises hardware and/or software elements configured to store data in an organized format to allow the processor 810 to create, modify, and retrieve the data. The database 850 may organize the data to enable the determination of whether a portion of the data is locally accessible to an appliance, and to enable quick retrieval of locally accessible data to the branch appliance 350. The hardware and/or software elements of the database 850 may include storage devices, such as RAM, hard drives, optical drives, flash memory, and magnetic tape. In some embodiments, the branch appliance 350 implements a virtual memory system with linear addresses, the locally accessible data, and the data structures discussed with respect to
Advantageously, the network memory system 300 improves application performance and data access. In some embodiments, by storing a secondary copy of the data locally accessible to the branch appliance 350 and the central appliance 380, the network memory system 300 minimizes the effects of latency and reduces network traffic over the communication network 330 to the central servers 370. Additionally, while the central servers 370 maintain the primary copy of the data, the central servers 370 potentially do not transfer the actual data over the communication network 330 for every request/response. Furthermore, accelerated access to the data locally accessible to the branch appliance 350 and the central appliance 380 is not limited to a particular application or data context.
In some embodiments, the network memory system 300 includes a secure tunnel between the branch appliance 350 and the central appliance 380. The secure tunnel provides encryption (e.g., IPsec) and access control lists (ACLs). Additionally, in other embodiments, the secure tunnel includes compression, such as header and payload compression. The secure tunnel may provide fragmentation/coalescing optimizations along with error detection and correction.
The first NMA 1020, the second NMA 1050, and the third NMA 1070 comprise hardware and/or software elements, similar to the branch appliance 350 and the central appliance 380, configured to receive data, determine whether the data is locally accessible to an appliance, generate an instruction based on the determination, and transfer the instruction to the appliance. The first NMA 1020, the second NMA 1050, and the third NMA 1070 also comprise hardware and/or software elements configured to receive an instruction from an appliance, process the instruction to obtain data, and transfer the data to a computer.
Advantageously, in this multi-office example, the network memory system 1000 provides for locally accessible data in each office. The first NMA 1020, the second NMA 1050, and the third NMA 1070 receive data, potentially destined for a computer and/or server in another office, and determine whether a portion of the data is locally accessible to an NMA in that office. To further enhance operation and the exchange of data between the first NMA 1020, the second NMA 1050, and the third NMA 1070, each NMA performs a discovery and reconciliation. During discovery and reconciliation the virtual memory map of the network memory system 1000 is updated. For example, each NMA updates the pages of the FHPs 545 in the NMA with references for data locally accessible in the network memory system 1000 and to which NMA the data is locally accessible.
The computer 1015 in the first office 1010 then transmits the same data to the first NMA 1020 addressed for the first time to the server 1080 in the third office 1060. The first NMA 1020 transmits the data with a store instruction to the third NMA 1070 indicating to store the data in a database in the third NMA 1070. In the sequence 1115, the third NMA 1070 stores the data in the database, and the third NMA 1070 transmits the data to the server 1080.
In sequence 1120, 1125, and 1130, the first NMA 1020, the second NMA 1050, and the third NMA 1070 perform discovery and reconciliation including update the virtual memory map. In this example, the first NMA 1020, the second NMA 1050, and the third NMA 1070 exchange information (e.g., the page state information 550) about which parts of the FHPs 545 each NMA has available locally. For example, to update the FHPs 545 in the second NMA 1050, the second NMA 1050 performs a discovery and reconciliation with the first NMA 1020 and the third NMA 1070. Similarly, each NMA performs discovery and reconciliation with every other peer NMA.
During the discovery and reconciliation between the second NMA 1050 and the first NMA 1020, for example, the second NMA 1050 discovers from the first NMA 1020 that the data (transmitted from the computer 1015 to the computer 1040 and the server 1080) is locally accessible to the third NMA 1070. The FHPs 545 of the first NMA 1020 include references to the data (e.g., in the page state information 550) and because the first NMA 1020 transferred the data to the third NMA 1070, the FHPs 545 indicate that the data is locally accessible to the third NMA 1070. The second NMA 1050 reconciles the references for the data in the FHPs 545 and further indicates that data is locally accessible to the third NMA 1070.
Referring again to
In sequence 1150, the third NMA 1070 processes the retrieve instruction. In sequence 1155, based on the retrieve instruction, the third NMA 1070 retrieves the data at the index within the database. In sequence 1160, the third NMA 1070 forwards the data to the server 1080.
Therefore, the network memory system 1000 provides improved application performance and data access between the first office 1010, the second office 1030, and the third office 1060. The network memory system 1000 provides access to locally accessible data, similar to distributed servers, without the complex management involved with replication and synchronization of the data among the distributed servers. Additionally, the network memory system 1000 reduces network traffic between the offices. Furthermore, discovery and reconciliation provides performance advantages by periodically or continuously updating the FHPs 545 in each NMA.
In step 1340, the branch appliance 350 decrypts the FHP 545 by combining the FHP 545 with the key stream. For example, the branch appliance 350 may combine the FHP 545 and the key stream using an XOR function. In step 1350, the FHP 545 is available to the computers 340 in a total time of about five to ten milliseconds, about the same amount of time required to retrieve data in an unencrypted system. Thus, the performance of the network is not affected by the decryption of the response data 625 when a key stream is used.
The above-described functions can be comprised of executable instructions that are stored on storage media. The executable instructions can be retrieved and executed by a processor. Some examples of executable instructions are software, program code, and firmware. Some examples of storage media are memory devices, tape, disks, integrated circuits, and servers. The executable instructions are operational when executed by the processor to direct the processor to operate in accord with the invention. Those skilled in the art are familiar with executable instructions, processor(s), and storage media.
The above description is illustrative and not restrictive. Many variations of the invention will become apparent to those of skill in the art upon review of this disclosure. The scope of the invention should, therefore, be determined not with reference to the above description, but instead should be determined with reference to the appended claims along with their full scope of equivalents.
This application is a continuation and claims the priority benefit of U.S. patent application Ser. No. 14/248,167 filed on Apr. 8, 2014, entitled “Data Encryption in a Network Memory Architecture for Providing Data Based on Local Accessibility,” which is a continuation and claims the priority benefit of U.S. patent application Ser. No. 13/757,548 filed on Feb. 1, 2013, entitled “Data Encryption in a Network Memory Architecture for Providing Data Based on Local Accessibility,” now U.S. Pat. No. 8,732,423 issued on May 20, 2014, which in turn is a continuation of, and claims the priority benefit of, U.S. patent application Ser. No. 11/497,026 filed on Jul. 31, 2006, entitled “Data Encryption in a Network Memory Architecture for Providing Data Based on Local Accessibility,” now U.S. Pat. No. 8,392,684 issued on Mar. 5, 2013, which is in turn a continuation-in-part of U.S. patent application Ser. No. 11/202,697 filed on Aug. 12, 2005, entitled “Network Memory Architecture for Providing Data Based on Local Accessibility,” now U.S. Pat. No. 8,370,583 issued on Feb. 5, 2013. The above applications are hereby incorporated by reference in their entirety.
Number | Name | Date | Kind |
---|---|---|---|
4494108 | Langdon, Jr. et al. | Jan 1985 | A |
4612532 | Bacon et al. | Sep 1986 | A |
5023611 | Chamzas et al. | Jun 1991 | A |
5243341 | Seroussi et al. | Sep 1993 | A |
5307413 | Denzer | Apr 1994 | A |
5357250 | Healey et al. | Oct 1994 | A |
5359720 | Tamura et al. | Oct 1994 | A |
5373290 | Lempel et al. | Dec 1994 | A |
5483556 | Pillan et al. | Jan 1996 | A |
5532693 | Winters et al. | Jul 1996 | A |
5592613 | Miyazawa et al. | Jan 1997 | A |
5611049 | Pitts | Mar 1997 | A |
5627533 | Clark | May 1997 | A |
5635932 | Shinagawa et al. | Jun 1997 | A |
5652581 | Furlan et al. | Jul 1997 | A |
5659737 | Matsuda | Aug 1997 | A |
5675587 | Okuyama et al. | Oct 1997 | A |
5710562 | Gormish et al. | Jan 1998 | A |
5748122 | Shinagawa et al. | May 1998 | A |
5754774 | Bittinger et al. | May 1998 | A |
5802106 | Packer | Sep 1998 | A |
5805822 | Long et al. | Sep 1998 | A |
5883891 | Williams et al. | Mar 1999 | A |
5903230 | Masenas | May 1999 | A |
5955976 | Heath | Sep 1999 | A |
6000053 | Levine et al. | Dec 1999 | A |
6003087 | Housel, III et al. | Dec 1999 | A |
6054943 | Lawrence | Apr 2000 | A |
6081883 | Popelka et al. | Jun 2000 | A |
6175944 | Urbanke et al. | Jan 2001 | B1 |
6295541 | Bodnar et al. | Sep 2001 | B1 |
6308148 | Bruins et al. | Oct 2001 | B1 |
6311260 | Stone et al. | Oct 2001 | B1 |
6339616 | Kovalev | Jan 2002 | B1 |
6374266 | Shnelvar | Apr 2002 | B1 |
6434662 | Greene et al. | Aug 2002 | B1 |
6438664 | McGrath et al. | Aug 2002 | B1 |
6452915 | Jorgensen | Sep 2002 | B1 |
6489902 | Heath | Dec 2002 | B2 |
6587985 | Fukushima et al. | Jul 2003 | B1 |
6618397 | Huang | Sep 2003 | B1 |
6633953 | Stark | Oct 2003 | B2 |
6643259 | Borella et al. | Nov 2003 | B1 |
6650644 | Colley et al. | Nov 2003 | B1 |
6653954 | Rijavec | Nov 2003 | B2 |
6667700 | McCanne et al. | Dec 2003 | B1 |
6674769 | Viswanath | Jan 2004 | B1 |
6718361 | Basani et al. | Apr 2004 | B1 |
6738379 | Balazinski et al. | May 2004 | B1 |
6769048 | Goldberg et al. | Jul 2004 | B2 |
6791945 | Levenson et al. | Sep 2004 | B1 |
6856651 | Singh | Feb 2005 | B2 |
6859842 | Nakamichi et al. | Feb 2005 | B1 |
6862602 | Guha | Mar 2005 | B2 |
6910106 | Sechrest et al. | Jun 2005 | B2 |
6963980 | Mattsson | Nov 2005 | B1 |
6968374 | Lemieux et al. | Nov 2005 | B2 |
6978384 | Milliken | Dec 2005 | B1 |
7007044 | Rafert et al. | Feb 2006 | B1 |
7020750 | Thiyagaranjan et al. | Mar 2006 | B2 |
7035214 | Seddigh et al. | Apr 2006 | B1 |
7047281 | Kausik | May 2006 | B1 |
7069342 | Biederman | Jun 2006 | B1 |
7110407 | Khanna | Sep 2006 | B1 |
7111005 | Wessman | Sep 2006 | B1 |
7113962 | Kee et al. | Sep 2006 | B1 |
7120666 | McCanne et al. | Oct 2006 | B2 |
7145889 | Zhang et al. | Dec 2006 | B1 |
7197597 | Scheid et al. | Mar 2007 | B1 |
7200847 | Straube et al. | Apr 2007 | B2 |
7215667 | Davis | May 2007 | B1 |
7242681 | Van Bokkelen et al. | Jul 2007 | B1 |
7243094 | Tabellion et al. | Jul 2007 | B2 |
7266645 | Garg et al. | Sep 2007 | B2 |
7278016 | Detrick et al. | Oct 2007 | B1 |
7318100 | Demmer et al. | Jan 2008 | B2 |
7366829 | Luttrell et al. | Apr 2008 | B1 |
7380006 | Srinivas et al. | May 2008 | B2 |
7383329 | Erickson | Jun 2008 | B2 |
7383348 | Seki et al. | Jun 2008 | B2 |
7388844 | Brown et al. | Jun 2008 | B1 |
7389357 | Duffie, III et al. | Jun 2008 | B2 |
7389393 | Karr et al. | Jun 2008 | B1 |
7417570 | Srinivasan et al. | Aug 2008 | B2 |
7417991 | Crawford et al. | Aug 2008 | B1 |
7420992 | Fang et al. | Sep 2008 | B1 |
7428573 | McCanne et al. | Sep 2008 | B2 |
7451237 | Takekawa et al. | Nov 2008 | B2 |
7453379 | Plamondon | Nov 2008 | B2 |
7454443 | Ram et al. | Nov 2008 | B2 |
7457315 | Smith | Nov 2008 | B1 |
7460473 | Kodama et al. | Dec 2008 | B1 |
7471629 | Melpignano | Dec 2008 | B2 |
7532134 | Samuels et al. | May 2009 | B2 |
7555484 | Kulkarni et al. | Jun 2009 | B2 |
7571343 | Xiang et al. | Aug 2009 | B1 |
7571344 | Hughes et al. | Aug 2009 | B2 |
7587401 | Yeo et al. | Sep 2009 | B2 |
7596802 | Border et al. | Sep 2009 | B2 |
7619545 | Samuels et al. | Nov 2009 | B2 |
7620870 | Srinivasan et al. | Nov 2009 | B2 |
7624446 | Wilhelm | Nov 2009 | B1 |
7630295 | Hughes et al. | Dec 2009 | B2 |
7639700 | Nabhan et al. | Dec 2009 | B1 |
7643426 | Lee et al. | Jan 2010 | B1 |
7644230 | Hughes et al. | Jan 2010 | B1 |
7676554 | Malmskog et al. | Mar 2010 | B1 |
7698431 | Hughes | Apr 2010 | B1 |
7702843 | Chen et al. | Apr 2010 | B1 |
7714747 | Fallon | May 2010 | B2 |
7746781 | Xiang | Jun 2010 | B1 |
7764606 | Ferguson et al. | Jul 2010 | B1 |
7827237 | Plamondon | Nov 2010 | B2 |
7849134 | McCanne et al. | Dec 2010 | B2 |
7853699 | Wu et al. | Dec 2010 | B2 |
7873786 | Singh et al. | Jan 2011 | B1 |
7941606 | Pullela et al. | May 2011 | B1 |
7945736 | Hughes et al. | May 2011 | B2 |
7948921 | Hughes et al. | May 2011 | B1 |
7953869 | Demmer et al. | May 2011 | B2 |
7970898 | Clubb et al. | Jun 2011 | B2 |
8069225 | McCanne et al. | Nov 2011 | B2 |
8072985 | Golan et al. | Dec 2011 | B2 |
8095774 | Hughes et al. | Jan 2012 | B1 |
8140757 | Singh et al. | Mar 2012 | B1 |
8171238 | Hughes et al. | May 2012 | B1 |
8209334 | Doerner | Jun 2012 | B1 |
8225072 | Hughes et al. | Jul 2012 | B2 |
8307115 | Hughes | Nov 2012 | B1 |
8312226 | Hughes | Nov 2012 | B2 |
8352608 | Keagy et al. | Jan 2013 | B1 |
8370583 | Hughes | Feb 2013 | B2 |
8386797 | Danilak | Feb 2013 | B1 |
8392684 | Hughes | Mar 2013 | B2 |
8442052 | Hughes | May 2013 | B1 |
8447740 | Huang et al. | May 2013 | B1 |
8473714 | Hughes et al. | Jun 2013 | B2 |
8489562 | Hughes et al. | Jul 2013 | B1 |
8565118 | Shukla et al. | Oct 2013 | B2 |
8595314 | Hughes | Nov 2013 | B1 |
8613071 | Day et al. | Dec 2013 | B2 |
8700771 | Ramankutty et al. | Apr 2014 | B1 |
8706947 | Vincent | Apr 2014 | B1 |
8725988 | Hughes et al. | May 2014 | B2 |
8732423 | Hughes | May 2014 | B1 |
8738865 | Hughes et al. | May 2014 | B1 |
8743683 | Hughes | Jun 2014 | B1 |
8755381 | Hughes et al. | Jun 2014 | B2 |
8811431 | Hughes | Aug 2014 | B2 |
8885632 | Hughes et al. | Nov 2014 | B2 |
8929380 | Hughes et al. | Jan 2015 | B1 |
8929402 | Hughes | Jan 2015 | B1 |
8930650 | Hughes et al. | Jan 2015 | B1 |
9036662 | Hughes | May 2015 | B1 |
9092342 | Hughes et al. | Jul 2015 | B2 |
9363248 | Hughes et al. | Jun 2016 | B1 |
20010054084 | Kosmynin | Dec 2001 | A1 |
20020007413 | Garcia-Luna-Aceves et al. | Jan 2002 | A1 |
20020040475 | Yap et al. | Apr 2002 | A1 |
20020061027 | Abiru et al. | May 2002 | A1 |
20020065998 | Buckland | May 2002 | A1 |
20020071436 | Border et al. | Jun 2002 | A1 |
20020078242 | Viswanath | Jun 2002 | A1 |
20020101822 | Ayyagari et al. | Aug 2002 | A1 |
20020107988 | Jordan | Aug 2002 | A1 |
20020116424 | Radermacher et al. | Aug 2002 | A1 |
20020129260 | Benfield et al. | Sep 2002 | A1 |
20020131434 | Vukovic et al. | Sep 2002 | A1 |
20020150041 | Reinshmidt et al. | Oct 2002 | A1 |
20020163911 | Wee et al. | Nov 2002 | A1 |
20020169818 | Stewart et al. | Nov 2002 | A1 |
20020181494 | Rhee | Dec 2002 | A1 |
20020188871 | Noehring et al. | Dec 2002 | A1 |
20020194324 | Guha | Dec 2002 | A1 |
20030002664 | Anand | Jan 2003 | A1 |
20030009558 | Ben-Yehezkel | Jan 2003 | A1 |
20030012400 | McAuliffe et al. | Jan 2003 | A1 |
20030046572 | Newman et al. | Mar 2003 | A1 |
20030123481 | Neale et al. | Jul 2003 | A1 |
20030123671 | He et al. | Jul 2003 | A1 |
20030131079 | Neale et al. | Jul 2003 | A1 |
20030133568 | Stein et al. | Jul 2003 | A1 |
20030142658 | Ofuji et al. | Jul 2003 | A1 |
20030149661 | Mitchell et al. | Aug 2003 | A1 |
20030149869 | Gleichauf | Aug 2003 | A1 |
20030214954 | Oldak et al. | Nov 2003 | A1 |
20030233431 | Reddy et al. | Dec 2003 | A1 |
20040008711 | Lahti et al. | Jan 2004 | A1 |
20040047308 | Kavanagh et al. | Mar 2004 | A1 |
20040083299 | Dietz et al. | Apr 2004 | A1 |
20040086114 | Rarick | May 2004 | A1 |
20040088376 | McCanne et al. | May 2004 | A1 |
20040114569 | Naden et al. | Jun 2004 | A1 |
20040117571 | Chang et al. | Jun 2004 | A1 |
20040123139 | Aiello et al. | Jun 2004 | A1 |
20040179542 | Murakami et al. | Sep 2004 | A1 |
20040181679 | Dettinger et al. | Sep 2004 | A1 |
20040199771 | Morten et al. | Oct 2004 | A1 |
20040202110 | Kim | Oct 2004 | A1 |
20040203820 | Billhartz | Oct 2004 | A1 |
20040205332 | Bouchard et al. | Oct 2004 | A1 |
20040243571 | Judd | Dec 2004 | A1 |
20040255048 | Lev Ran et al. | Dec 2004 | A1 |
20050010653 | McCanne | Jan 2005 | A1 |
20050044270 | Grove et al. | Feb 2005 | A1 |
20050053094 | Cain et al. | Mar 2005 | A1 |
20050091234 | Hsu et al. | Apr 2005 | A1 |
20050111460 | Sahita | May 2005 | A1 |
20050131939 | Douglis et al. | Jun 2005 | A1 |
20050132252 | Fifer et al. | Jun 2005 | A1 |
20050141425 | Foulds | Jun 2005 | A1 |
20050171937 | Hughes et al. | Aug 2005 | A1 |
20050177603 | Shavit | Aug 2005 | A1 |
20050190694 | Ben-Nun et al. | Sep 2005 | A1 |
20050207443 | Kawamura et al. | Sep 2005 | A1 |
20050210151 | Abdo et al. | Sep 2005 | A1 |
20050220019 | Melpignano | Oct 2005 | A1 |
20050235119 | Sechrest et al. | Oct 2005 | A1 |
20050243743 | Kimura | Nov 2005 | A1 |
20050243835 | Sharma et al. | Nov 2005 | A1 |
20050256972 | Cochran et al. | Nov 2005 | A1 |
20050278459 | Boucher et al. | Dec 2005 | A1 |
20050286526 | Sood et al. | Dec 2005 | A1 |
20060013210 | Bordogna et al. | Jan 2006 | A1 |
20060026425 | Douceur et al. | Feb 2006 | A1 |
20060031936 | Nelson et al. | Feb 2006 | A1 |
20060036901 | Yang et al. | Feb 2006 | A1 |
20060039354 | Rao et al. | Feb 2006 | A1 |
20060059171 | Borthakur et al. | Mar 2006 | A1 |
20060059173 | Hirsch et al. | Mar 2006 | A1 |
20060117385 | Mester et al. | Jun 2006 | A1 |
20060143497 | Zohar et al. | Jun 2006 | A1 |
20060195547 | Sundarrajan et al. | Aug 2006 | A1 |
20060195840 | Sundarrajan et al. | Aug 2006 | A1 |
20060212426 | Shakara et al. | Sep 2006 | A1 |
20060218390 | Loughran et al. | Sep 2006 | A1 |
20060227717 | van den Berg et al. | Oct 2006 | A1 |
20060250965 | Irwin | Nov 2006 | A1 |
20060268932 | Singh et al. | Nov 2006 | A1 |
20060280205 | Cho | Dec 2006 | A1 |
20070002804 | Xiong et al. | Jan 2007 | A1 |
20070011424 | Sharma et al. | Jan 2007 | A1 |
20070038815 | Hughes | Feb 2007 | A1 |
20070038816 | Hughes et al. | Feb 2007 | A1 |
20070038858 | Hughes | Feb 2007 | A1 |
20070050475 | Hughes | Mar 2007 | A1 |
20070076693 | Krishnaswamy | Apr 2007 | A1 |
20070097874 | Hughes et al. | May 2007 | A1 |
20070110046 | Farrell et al. | May 2007 | A1 |
20070115812 | Hughes | May 2007 | A1 |
20070127372 | Khan et al. | Jun 2007 | A1 |
20070130114 | Li et al. | Jun 2007 | A1 |
20070140129 | Bauer et al. | Jun 2007 | A1 |
20070174428 | Lev Ran et al. | Jul 2007 | A1 |
20070195702 | Yuen et al. | Aug 2007 | A1 |
20070198523 | Hayim | Aug 2007 | A1 |
20070226320 | Hager et al. | Sep 2007 | A1 |
20070244987 | Pedersen et al. | Oct 2007 | A1 |
20070245079 | Bhattacharjee et al. | Oct 2007 | A1 |
20070248084 | Whitehead | Oct 2007 | A1 |
20070258468 | Bennett | Nov 2007 | A1 |
20070263554 | Finn | Nov 2007 | A1 |
20070276983 | Zohar et al. | Nov 2007 | A1 |
20070280245 | Rosberg | Dec 2007 | A1 |
20080005156 | Edwards et al. | Jan 2008 | A1 |
20080013532 | Garner et al. | Jan 2008 | A1 |
20080016301 | Chen | Jan 2008 | A1 |
20080028467 | Kommareddy et al. | Jan 2008 | A1 |
20080031149 | Hughes et al. | Feb 2008 | A1 |
20080031240 | Hughes et al. | Feb 2008 | A1 |
20080095060 | Yao | Apr 2008 | A1 |
20080133536 | Bjorner et al. | Jun 2008 | A1 |
20080133561 | Dubnicki et al. | Jun 2008 | A1 |
20080184081 | Hama et al. | Jul 2008 | A1 |
20080205445 | Kumar et al. | Aug 2008 | A1 |
20080229137 | Samuels et al. | Sep 2008 | A1 |
20080243992 | Jardetzky et al. | Oct 2008 | A1 |
20080267217 | Colville et al. | Oct 2008 | A1 |
20080313318 | Vermeulen et al. | Dec 2008 | A1 |
20080320151 | McCanne et al. | Dec 2008 | A1 |
20090024763 | Stepin et al. | Jan 2009 | A1 |
20090060198 | Little | Mar 2009 | A1 |
20090063696 | Wang et al. | Mar 2009 | A1 |
20090080460 | Kronewitter, III et al. | Mar 2009 | A1 |
20090092137 | Haigh et al. | Apr 2009 | A1 |
20090100483 | McDowell | Apr 2009 | A1 |
20090158417 | Khanna et al. | Jun 2009 | A1 |
20090175172 | Prytz et al. | Jul 2009 | A1 |
20090234966 | Samuels et al. | Sep 2009 | A1 |
20090265707 | Goodman et al. | Oct 2009 | A1 |
20090274294 | Itani | Nov 2009 | A1 |
20090279550 | Romrell et al. | Nov 2009 | A1 |
20090281984 | Black | Nov 2009 | A1 |
20100005222 | Brant et al. | Jan 2010 | A1 |
20100011125 | Yang et al. | Jan 2010 | A1 |
20100020693 | Thakur | Jan 2010 | A1 |
20100054142 | Moiso et al. | Mar 2010 | A1 |
20100070605 | Hughes et al. | Mar 2010 | A1 |
20100077251 | Liu et al. | Mar 2010 | A1 |
20100085964 | Weir et al. | Apr 2010 | A1 |
20100115137 | Kim et al. | May 2010 | A1 |
20100121957 | Roy et al. | May 2010 | A1 |
20100124239 | Hughes | May 2010 | A1 |
20100131957 | Kami | May 2010 | A1 |
20100225658 | Coleman | Sep 2010 | A1 |
20100246584 | Ferguson et al. | Sep 2010 | A1 |
20100290364 | Black | Nov 2010 | A1 |
20100318892 | Teevan et al. | Dec 2010 | A1 |
20110002346 | Wu | Jan 2011 | A1 |
20110022812 | van der Linden et al. | Jan 2011 | A1 |
20110113472 | Fung et al. | May 2011 | A1 |
20110154329 | Arcese et al. | Jun 2011 | A1 |
20110219181 | Hughes et al. | Sep 2011 | A1 |
20110276963 | Wu et al. | Nov 2011 | A1 |
20110299537 | Saraiya et al. | Dec 2011 | A1 |
20120036325 | Mashtizadeh et al. | Feb 2012 | A1 |
20120173759 | Agarwal et al. | Jul 2012 | A1 |
20120221611 | Watanabe et al. | Aug 2012 | A1 |
20120239872 | Hughes et al. | Sep 2012 | A1 |
20130018765 | Fork et al. | Jan 2013 | A1 |
20130044751 | Casado et al. | Feb 2013 | A1 |
20130080619 | Assuncao et al. | Mar 2013 | A1 |
20130086236 | Baucke et al. | Apr 2013 | A1 |
20130094501 | Hughes | Apr 2013 | A1 |
20130117494 | Hughes et al. | May 2013 | A1 |
20130121209 | Padmanabhan et al. | May 2013 | A1 |
20130250951 | Koganti | Sep 2013 | A1 |
20130263125 | Shamsee et al. | Oct 2013 | A1 |
20130282970 | Hughes et al. | Oct 2013 | A1 |
20130343191 | Kim et al. | Dec 2013 | A1 |
20140052864 | Van Der Linden et al. | Feb 2014 | A1 |
20140123213 | Vank et al. | May 2014 | A1 |
20140181381 | Hughes et al. | Jun 2014 | A1 |
20140379937 | Hughes et al. | Dec 2014 | A1 |
20150074291 | Hughes | Mar 2015 | A1 |
20150074361 | Hughes et al. | Mar 2015 | A1 |
20150078397 | Hughes et al. | Mar 2015 | A1 |
Number | Date | Country |
---|---|---|
1507353 | Feb 2005 | EP |
H05-061964 | Mar 1993 | JP |
WO 2001035226 | May 2001 | WO |
Entry |
---|
Business Wire, “Silver Peak Systems Delivers Family of Appliances for Enterprise-Wide Centralization of Branch Office Infrastructure; Innovative Local Instance Networking Approach Overcomes Traditional Application Acceleration Pitfalls,” Sep. 19, 2005, (available at http://www.businesswire.com/news/home/20050919005450/en/Silver-Peak-Syste- ms-Delivers-Family-Appliances-Enterprise-Wide#.UVzkPk7u-1 (last visited Aug. 8, 2014)). |
Riverbed, “Riverbed Introduces Market-Leading WDS Solutions for Disaster Recovery and Business Application Acceleration,” Oct. 22, 2007 (available at http://www.riverbed.com/about/news-articles/pressreleases/riverbed-introd- uces-market-leading-wds-solutions-fordisaster-recovery-and-business-applic- ation-acceleration.html (last visited Aug. 8, 2014). |
Tseng, Josh, “When accelerating secure traffic is not secure,” Aug. 27, 2008, (available at http://www.riverbed.com/blogs/whenaccelerati.html?&isSearch=true&pageS- ize=3&page=2 (last visited Aug. 8, 2014)). |
Riverbed, “The Riverbed Optimization System (RiOS) v4.0: A Technical Overview,” (explaining “Data Security” through segmentation) (available at http://mediacms.riverbed.com/documents/TechOverview-Riverbed-RiOS.sub.--4- .sub.--0.pdf (last visited Aug. 8, 2014)). |
Riverbed, “Riverbed Awarded Patent on Core WDS Technology” (available at: http://www.riverbed.com/about/news-articles/pressreleases/riverbed-awarde- d-patent-on-core-wds-technology.html (last visited Aug. 8, 2014)). |
Final Written Decision, dated Dec. 30, 2014, Inter Partes Review Case No. IPR2013-00403. |
Final Written Decision, dated Dec. 30, 2014, Inter Partes Review Case No. IPR2013-00402. |
Cisco Systems, Inc., “IPsec Anti-Replay Window: Expanding and Disabling,” Cisco IOS Security Configuration Guide. 2005-2006 Last updated: Sep. 12, 2006, 14 pages. |
Singh, B., et al., “Future of Internet Security—Ipsec,” Jan. 26, 2005, [online] [Retrieved on Feb. 1, 2005] Retrieved from the Internet <URL: http://www.securitydocs.com/library/2926>. |
Muthitacharoen, A., et al., “A Low-bandwidth Network File System,” Oct. 2001, In the Proceedings of the 18th ACM Symposium on Operating Systems Principles, Chateau Lake Louise, Banff, Canada, pp. 174-187. |
“Shared LAN Cache Datasheet,” 1996, [online] [Retrieved on Aug. 26, 2009] Retrieved from the Internet <URL:http://www.lancache.com/slcdata.htm>. |
Spring et al., “A protocol-independent technique for eliminating redundant network traffic”, ACM SIGCOMM Computer Communication Review, vol. 30, Issue 4 (Oct. 2000) pp. 87-95, Year of Publication: 2000. |
Hong, B., et al. “Duplicate data elimination in a SAN file system,” In Proceedings of the 21st Symposium on Mass Storage Systems (MSS '04), Goddard, MD, Apr. 2004. IEEE. |
You, L. L. and Karamanolis, C. 2004. “Evaluation of efficient archival storage techniques”, In Proceedings of the 21st IEEE Symposium on Mass Storage Systems and Technologies (MSST). |
Douglis, F. et al., “Application specific Delta-encoding via Resemblance Detection,” Published in the 2003 USENIX Annual Technical Conference, 14 Pages. |
You, L. L., et al., “Deep Store an Archival Storage System Architecture,” Data Engineering, 2005, Proceedings of the 21st Intl. Conf. on Data Eng.,Tokyo, Japan, Apr. 5-8, 2005, 12 Pages. |
Manber, U., “Finding Similar Files in a Large File System,” TR 93-33, Oct. 1994, Department of Computer Science, University of Arizona. <http://webglimpse.net/pubs/TR93-33.pdf>. Also appears in the 1994 winter USENIX Technical Conference. |
Knutsson, B., et al., “Transparent Proxy Signalling,” Journal of Communications and Networks, 2001, pp. 164-174, vol. 3, No. 2. |
Definition memory (n), Webster's Third New International Dictionary, Unabridged (1993), available at <http://lionreference.chadwyck.com> (Dictionaries/Webster's Dictionary). |
Definition appliance, 2c, Webster's Third New International Dictionary, Unabridged (1993), available at <http://lionreference.chadwyck.com> (Dictionaries/Webster's Dictionary). |
Newton, H., “Newton's Telecom Dictionary”, 17th Ed., 2001, pp. 38, 201, and 714. |
Silver Peak Systems, “The Benefits of Byte-level WAN Deduplication,” 2008. |
Final Written Decision, dated Jun. 9, 2015, Inter Partes Review Case No. IPR2014-00245. |
Decision Granting Joint Motion to Terminate, Riverbed Technology, Inc. v. Silver Peak Systems, Inc., Case IPR2014-00245, U.S. Pat. No. 8,392,684, Feb. 7, 2018, 4 pages. |
Declaration of Frank Fritsch, Riverbed Technology, Inc. v. Silver Peak Systems, Inc., Case IPR2014-00245, U.S. Pat. No. 8,392,684, Nov. 19, 2014, 17 pages. |
1st Declaration of Dr. Geoff Kuenning, Riverbed Technology, Inc. v. Silver Peak Systems, Inc., Case IPR2014-00245, U.S. Pat. No. 8,392,684, Aug. 7, 2014, 42 pages. |
2nd Declaration of Dr. Geoff Kuenning, Riverbed Technology, Inc. v. Silver Peak Systems, Inc., Case IPR2014-00245, U.S. Pat. No. 8,392,684, Nov. 19, 2014, 32 pages. |
A Riverbed Technology, Inc. White Paper: Security and the Riverbed Steelhead Data Store, Riverbed Technology, Inc. v. Silver Peak Systems, Inc., Case IPR2014-00245, Apr. 11, 2005, 6 pages. |
The Tolly Group Report: Certeon, Inc., S-Series™ Acceleration Appliance, Riverbed Technology, Inc. v. Silver Peak Systems, Inc., Case IPR2014-00245, Feb. 2006, 8 pages. |
Declaration of Steven W. Landauer, Riverbed Technology, Inc. v. Silver Peak Systems, Inc., Case IPR2014-00245, U.S. Pat. No. 8,392,684, Dec. 10, 2013, 96 pages. |
Record of Oral Hearing, Riverbed Technology, Inc. v. Silver Peak Systems, Inc., Case IPR2014-00245, U.S. Pat. No. 8,392,684, May 12, 2015, 81 pages. |
Patent Owner's Reply in Support of Its Motion to Amend, Riverbed Technology, Inc. v. Silver Peak Systems, Inc., Case IPR2014-00245, U.S. Pat. No. 8,392,684, Nov. 19, 2014, 9 pages. |
Petitioner Riverbed Technology, LLC's Opposition to Patent Owner's Motion to Amend, Riverbed Technology, Inc. v. Silver Peak Systems, Inc., Case IPR2014-00245, U.S. Pat. No. 8,392,684, Oct. 14, 2014, 20 pages. |
Patent Owner's Motion to Amend Under 37 CFR § 42.121, Riverbed Technology, Inc. v. Silver Peak Systems, Inc., Case IPR2014-00245, U.S. Pat. No. 8,392,684, Aug. 7, 2014, 19 pages. |
Opening Brief of Appellant Silver Peak Systems, Inc., Silver Peak Systems, Inc. v. Riverbed Technology, Inc., Appeal No. 15-2072, Case IPR2014-00245, Nov. 24, 2015, 143 pages. |
Brief for Intervenor—Director of the United States Patent and Trademark Office, Document: 24, In Re: Silver Peak Systems, Inc., Appeal No. 2015-2072, Case IPR2014-00245, Feb. 8, 2016, 59 pages. |
Brief for Intervenor—Director of the United States Patent and Trademark Office, Document: 25, in Re: Silver Peak Systems, Inc., Appeal No. 2015-2072, Case IPR2014-00245, Feb. 8, 2016, 59 pages. |
Reply Brief of Appellant Silver Peak Systems, Inc., Appeal No. 15-2072, Case IPR2014-00245, In re: Silver Peak Systems, Inc., Mar. 10, 2016, 33 pages. |
United States Court of Appeals for the Federal Circuit, Notice of Entry of Judgment Accompanied by Opinion, Case 15-2042, Oct. 24, 2017, 5 pages. |
Number | Date | Country | |
---|---|---|---|
Parent | 14248167 | Apr 2014 | US |
Child | 15148671 | US | |
Parent | 13757548 | Feb 2013 | US |
Child | 14248167 | US | |
Parent | 11497026 | Jul 2006 | US |
Child | 13757548 | US |
Number | Date | Country | |
---|---|---|---|
Parent | 11202697 | Aug 2005 | US |
Child | 11497026 | US |