Protecting configuration data in a clustered container system may include protecting an ETCD data store in a Kubernetes cluster. A data storage management system addresses the unique needs of protecting an ETCD data store of a target Kubernetes cluster, as well as protecting non-ETCD data payloads. The illustrative data storage management system defines ETCD as a unique kind of workload. ETCD protection is integrated within the data storage management system, which automatically creates data structures and resources within the system for, and provides special-purpose features to protect, ETCD contents and associated security certificates. One of the special-purpose features deploys a temporary data transfer agent within the target Kubernetes cluster to safeguard an ETCD snapshot and transmit its contents, along with the security certificates, to a backup infrastructure that operates outside of the target Kubernetes cluster. The backup infrastructure comprises components deployed by the data storage management system.
Because Kubernetes clusters can be ephemeral, backing up in-cluster data to storage outside the cluster is important. Prior art solutions used the cluster's API server, which facilitates communications with the cluster control plane, to transfer backup data through the API server. However, the API server as a data transfer node has resiliency weaknesses and can slow down backup job performance. The present solution provides a more streamlined and scalable approach, which circumvents the API server and additionally includes more robust error checking, log capture, and realtime job monitoring to provide improved data protection resilience. The disclosed approach employs a “sponsor” data agent outside the cluster and temporarily deploys a specialized backup resource within the cluster during a backup job, such as an enhanced File System Data Agent and/or a lightweight Kubernetes File Client, both of which present substantial performance and resiliency advantages over the API server.
An illustrative cloud-based air-gapped data storage management (destination) system obtains authorized access to other (source) systems'backup copies, replicates those copies within the destination system, parses supplemental metadata included in the source backup copies, and integrates the replica copies into the destination system as though natively created there. Replica copies are integrated as backup copies without first restoring the source backup copies to a native data format. The source system lacks knowledge of or connectivity with the destination system, thus maintaining an “air gap” between the systems. The destination system preferably operates in a cloud computing environment. The destination system uses supplemental metadata from the replica copies to re-create or mimic the source's computing environment and to restore backed up data from the replica copies. The destination system also operates as an autonomous analytics engine, applying value-added services to backed up data pulled from source system(s).
A hosting service enables streamlined scaling of features that relate to data storage management. The scaling is powered by deployment of microservices, each one directed to a discrete feature of a data storage management system. In addition to scaling on demand, the disclosed hosting service provides additional value-added features, such as streamlining intra-system handling, auditing, and reporting of logs generated by microservices; standardizing exception handling; mediating port assignments for co-located microservices to avoid collisions; streamlining formats for inter-microservice communications; streamlining local database access; etc. Advantageously, the disclosed solution off-loads the storage manager, and additionally improves system performance by scaling various functions and by streamlining interoperability among components. Furthermore, the disclosed solution also enables the hosting service in general, and each discrete microservice in particular, to be enhanced, deployed, and scaled separately and asynchronously from each other and from the storage manager.
A data storage management system comprises features for initiating failover orchestration jobs that invoke recovery resources on demand in a cloud computing environment. Backed up data that is stored persistently in the cloud computing environment may be rapidly restored within the cloud computing environment for use in disaster recovery and/or in test and verification scenarios. This approach may be contrasted to systems where a failover system is “always on” at the failover destination, such as having failover resources always up and running in the cloud computing environment. Such resources typically include a failover virtual machine (VM), a virtual machine datastore for the restored data, and one or more computing resources for restoring an auxiliary copy to the VM's datastore. The cloud-based failover resources are deactivated or taken down once the failover event ends.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 11/20 - Détection ou correction d'erreur dans une donnée par redondance dans le matériel en utilisant un masquage actif du défaut, p. ex. en déconnectant les éléments défaillants ou en insérant des éléments de rechange
Techniques are disclosed relating to providing fast access to restored data in a cloud storage environment. A computing system stores multiple sets of incremental backup data that reflect changes in data being backed up between backup intervals and metadata that indicates which set of incremental backup data stores a given object. The computing system generates an endpoint for a requesting computing system, where the endpoint supports requests for restored backup data and data responses. In response to a request from the requesting computing system via the endpoint, the computing system queries the metadata based on the request and stores metadata retrieved from the query in a key/value store using object identification information as key data and the retrieved metadata as value data. The computing system provides requested data according to a lazy loading technique, including providing requested data via the endpoint based on the metadata in the key/value store.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
7.
USING ERASURE CODING ON STORAGE NODES FEWER THAN DATA PLUS PARITY FRAGMENTS IN A DISTRIBUTED DATA STORAGE SYSTEM
A distributed data storage system using erasure coding (EC) provides advantages of EC data storage while retaining high resiliency for EC data storage architectures having fewer data storage nodes than the number of EC data-plus-parity fragments. An illustrative embodiment is a three-node data storage system with EC 4+2. Incoming data is temporarily replicated to ameliorate the effects of certain storage node outages or fatal disk failures, so that read and write operations can continue from/to the storage system. The system is equipped to automatically heal failed EC write attempts in a manner transparent to users and/or applications: when all storage nodes are operational, the distributed data storage system automatically converts the temporarily replicated data to EC storage and reclaims storage space previously used by the temporarily replicated data. Individual hardware failures are healed through migration techniques that reconstruct and re-fragment data blocks according to the governing EC scheme.
Data protection resources are automatically scaled to the needs of data source(s) in an application orchestrator computing environment, such as a cluster in a Kubernetes deployment. The approach is adaptable to data sources in production clusters or application suites that are not application orchestrator deployments, such as a cloud-based database-as-a-service (DBaaS). A data storage management system protects cluster-based data with an elastic number of data protection resources (e.g., data agents, media agents), which are deployed on demand. The number of data protection resources deployed for a particular job are appropriate to the workload(s) at present and depend on a variety of scaling factors. In some embodiments, data protection resources are deployed within the same cluster as the data sources. In other embodiments, a separate infrastructure cluster provides the data protection resources on demand, and connects to any number and types of data sources, whether cloud-based or otherwise, without limitation.
After completion of a backup job, the illustrative system performs a threat analysis of the freshly generated backup copies. Each copy is restored at a secure storage area. The system scans the restored data using, preferably, a signature-based malware scanning engine. If the scan finds malware infection or some other unsafe condition, a tracking index is updated to indicate that the copy is unsafe, and the secondary copy is quarantined. The quarantine prevents the copy from being restored to the production environment, and from acting as a source for other copies. The system iterates, scanning preceding versions of the copy, updating the index, and quarantining, until a clean or uninfected copy is found. The clean copy is so indexed. Responsive to a restore request, the illustrative system automatically restores the clean copy and skips over the infected copy/copies, preferably without asking the requesting user for input or approval.
A computer-implemented system and associated methods are disclosed, including components such as a client cloud computing environment, client computing devices, media agents, and a secondary storage subsystem managed by a throttle manager. The client cloud computing environment includes multiple virtual machines (VMs), each with a specific data agent responsible for collecting and transmitting application data. The secondary storage subsystem includes multiple secondary storage units managed by media agents. The throttle manager oversees the distribution and regulation of data streams across these media agents, dynamically adjusting the allocation of data streams to balance utilization and efficiently handle data. The system implements a multi-priority level bandwidth allocation mechanism, where bandwidth is distributed based on job type and dynamically adjusted based on stream performance.
Ransomware detection accuracy is improved by analyzing patterns of changes in filename extension counts, relative to each other, that occur in a file system over time. The disclosed approach is malware-agnostic and does not rely on recognizing malware extensions or on real-time monitoring of the target file system. Instead, during each successive backup job of the target file system, the disclosed technology counts different types of filename extensions and compares the counts to each other and to corresponding counts taken in earlier backup jobs. Preferably, the anomaly detection analysis uses machine learning to discern a behavior pattern of the file system, which indicates how filename extensions are distributed and how much they change between backup jobs over time.
G06F 21/56 - Détection ou gestion de programmes malveillants, p. ex. dispositions anti-virus
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
12.
APPLICATION ENVIRONMENT RECOVERY USING CLOUD-BASED IMMUTABLE STORAGE
An example method includes identifying cloud services of a distributed software system deployed in a cloud platform. The cloud services are specific to a first cloud account. Further, dependencies associated with the cloud services may be determined. Furthermore, metadata including the dependencies and application data associated with the cloud services are stored in one or more cloud-based immutable storage devices at defined intervals. Responsive to determining an anomaly in the distributed software system, the metadata associated with the cloud services may be retrieved from the cloud-based immutable storage devices. Cloud platform specific infrastructure as code (IaC) may be generated for the distributed software system based on the retrieved metadata. A second cloud account may be generated. The cloud platform specific IaC is executed to recover an application environment of the distributed software system in the second cloud account using the application data stored in the cloud-based immutable storage devices.
The present inventors devised technological improvements that substantially speed up data recovery. Disclosed techniques include on-demand rapid recovery based on restoring metadata from backups before restoring payload data according to certain preferences and priorities. Disclosed techniques further include predicting how long a restore job might take based on simulated restore operations, and using the predicted restore times to generate a “smart recovery planner” or “recovery playbook” that is designed to optimize massive data recovery after a catastrophic data loss event, such as a disaster, ransomware attack, malware infection, etc. The disclosed techniques are especially well suited to optimizing large data recoveries and improving the user experience by prioritizing preferred data sets.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
14.
HOLISTICALLY PROTECTING SERVERLESS APPLICATIONS BASED ON DETECTING IN-CLOUD DEPLOYMENTS
A holistic approach protects serverless applications in various cloud and/or non-cloud data center computing environments. An illustrative data storage management system deploys, or causes to be deployed, a discovery tracker function in a customer's cloud service account. The discovery tracker identifies and tracks what applications are executing therein, whether they are already known to the illustrative system or not. This aspect ensures that the system is up-to-date with a customer's cloud deployments, so that it may timely back up active applications, and conversely, so that it may dispose properly of copies of applications that are no longer deployed. The discovery tracker discovers application assets, relationships, and interoperability dependencies. The illustrative system creates a corresponding “application entity” that references the various assets. An orchestration function coordinates storage management operations to generate a set of copies of the application's discovered assets. The set of copies forms a point-in-time copy of the application.
A disclosed framework enables virtually any aggressive Recovery Point Objective (RPO) to be enforced for a production database, without limitation on type of database management system (DBMS) or size of the production database. The framework overcomes technological barriers of the prior art, such as bottlenecks presented by a storage manager computer that traditionally managed database backups. To avoid the bottlenecks, an illustrative data storage management system does not engage the storage manager computer in storage operations that could impact the database RPO. Certain components are added and enhanced to autonomously capture database transaction logs, which are stored securely and persistently away from the DBMS. In a separate and less frequent operation, and with involvement of the storage manager computer, the illustrative system generates secondary copies in their final form. Meanwhile, temporary backup files can be used in restore operations without first being converted into secondary copies.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
16.
BACKUP OF CONTAINERIZED APPLICATIONS USING A BACKUP SERVICES CONTAINER AND A BACKUP SERVICES CONTAINER-ORCHESTRATION POD
A “backup services container” comprises “backup toolkits,” which include scripts for accessing containerized applications plus enabling utilities/environments for executing the scripts. The backup services container is added to Kubernetes pods comprising containerized applications without changing other pod containers. For maximum value and advantage, the backup services container is “over-equipped” with toolkits. The backup services container selects and applies a suitable backup toolkit to a containerized application to ready it for a pending backup. Interoperability with a proprietary data storage management system provides features that are not possible with third-party backup systems. Some embodiments include one or more components of the proprietary data storage management within the illustrative backup services container. Some embodiments include one or more components of the proprietary data storage management system in a backup services pod configured in a Kubernetes node. All configurations and embodiments are suitable for cloud and/or non-cloud computing environments.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 9/455 - ÉmulationInterprétationSimulation de logiciel, p. ex. virtualisation ou émulation des moteurs d’exécution d’applications ou de systèmes d’exploitation
G06F 9/50 - Allocation de ressources, p. ex. de l'unité centrale de traitement [UCT]
17.
MANAGEMENT DATABASE LONG-TERM ARCHIVING TO A RECOVERY MANAGER
A storage manager for an information management system determines whether one or more predetermined conditions have been met for transferring metadata of previously performed backup jobs stored in a first management database. A backup job may correspond to a backup operation of a primary storage device of a first client computing device. In response to a determination that one or more of the predetermined conditions have been met, the storage manager may transfer metadata for a second plurality of backup jobs to a second management database of a recovery manager. The recovery manager may receive a request to restore data to the primary storage device of the first client computing device based on the metadata of the second plurality of backup jobs. A media agent managed by the recovery manager may then restore the requested data to the primary storage device of the first client computing device.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 16/21 - Conception, administration ou maintenance des bases de données
18.
INFORMATION MANAGEMENT SECURITY HEALTH MONITORING SYSTEM
An information management security health monitoring system is provided herein that can monitor the security health of one or more information management systems, identify any security issues that are occurring within an information management system, and automatically, or in response to a user input, transmit an instruction to the information management system to execute a workflow to resolve the security issue(s). For example, the information management cell health monitoring system receives security data and security policies, and/or similar data from an information management cell(s) via a network. The system analyzes the received information to identify any issues. If an issue is detected, the information management security health monitoring system retrieves workflows and determines whether any of the workflows can be used to resolve the detected issue. The information management security health monitoring system transmits a workflow that resolves the detected issue to the information management system for execution.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 16/25 - Systèmes d’intégration ou d’interfaçage impliquant les systèmes de gestion de bases de données
G06F 16/27 - Réplication, distribution ou synchronisation de données entre bases de données ou dans un système de bases de données distribuéesArchitectures de systèmes de bases de données distribuées à cet effet
G06F 21/62 - Protection de l’accès à des données via une plate-forme, p. ex. par clés ou règles de contrôle de l’accès
A strongly consistent distributed data storage system comprises an enhanced metadata service that is capable of fully recovering all metadata that goes missing when a metadata-carrying disk, disks, and/or partition fail. An illustrative recovery service runs automatically or on demand to bring the metadata node back into full service. Advantages of the recovery service include guaranteed full recovery of all missing metadata, including metadata still residing in commit logs, without impacting strong consistency guarantees of the metadata. The recovery service is network-traffic efficient. In preferred embodiments, the recovery service avoids metadata service downtime at the metadata node, thereby reducing the impact of metadata disk failure on the availability of the system. The disclosed metadata recovery techniques are said to be “self-healing” as they do not need manual intervention and instead automatically detect failures and automatically recover from the failures in a non-disruptive manner.
G06F 11/20 - Détection ou correction d'erreur dans une donnée par redondance dans le matériel en utilisant un masquage actif du défaut, p. ex. en déconnectant les éléments défaillants ou en insérant des éléments de rechange
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
20.
SECURE DATA REPLICATION TO, AND RECOVERY OF DATA FROM, AIR-GAPPED DATA STORAGE POOLS
An illustrative air-gapped data storage site for storing secure copies at the air-gapped storage site. Using specialized air-gapped media agents installed within the air-gapped storage pool site, the illustrative system, at an unpredictable time, establishes a one-way tunnel from secondary storage site to air-gapped site to receive backup copies of the data stored at primary site. In another embodiment, during disaster recovery, backup copies stored within the air-gapped site are replicated to a non-air gapped site (e.g., secondary storage pools) as “tertiary copies.” Those copies are then restored to the primary site in original application data formats for quick recovery. As restoration of data is complete, the tertiary copies are promoted to “secondary copies” to receive incremental backups.
The disclosed data storage management system enables data owners to model the costs and attributes of archiving their data and to readily capture and implement one or more resultant archiving plans. Modeling enables data owners to make informed choices about cost profiles before data is actually archived. Archiving plans devised according to these choices are intended to save on data storage costs and provide a compliance-ready data archive in cloud storage repository(ies). Armed with archiving simulations supplied by the illustrative data storage management system, a data owner may control data placement to predict costs, free up primary storage, and move inactive data to less expensive archive storage. Preferably, the disclosed system is implemented as a software-as-a-service (Saas) solution, and the accompanying archive storage is implemented as a cloud storage service, but the invention is not limited to SaaS or to cloud-based data archives.
A data storage management system is enhanced to accommodate, and moreover to optimize, the storing and retention of deduplicated secondary copies at write-once read-many (WORM) enabled storage platforms. Enhancements include without limitation: user interface (UI) options to enable WORM functionality for secondary storage, whether used for deduplicated or non-deduplicated secondary copies; enhancements to secondary copy (e.g., deduplication copy, backup) operations; and pruning changes. The storage manager is generally responsible for managing the creation, tracking, and deletion of secondary copies, with and without deduplication. Media agents that store secondary copies to and prune them from the WORM-enabled storage platforms also are enhanced for communicating and interoperating with both bucket-level and object-level WORM-enabled storage platforms to implement the features disclosed herein.
G06F 16/215 - Amélioration de la qualité des donnéesNettoyage des données, p. ex. déduplication, suppression des entrées non valides ou correction des erreurs typographiques
A streamlined approach analyzes block-level backups of VM virtual disks and creates both coarse and fine indexes of backed up VM data files in the block-level backups. The indexes (collectively the “content index”) enable granular searching by filename, by file attributes (metadata), and/or by file contents, and further enable granular live browsing of backed up VM files. Thus, by using the illustrative data storage management system, ordinary block-level backups of virtual disks are “opened to view” through indexing. Any block-level copies can be indexed according to the illustrative embodiments, including file system block-level copies. The indexing occurs offline in an illustrative data storage management system, after VM virtual disks are backed up into block-level backup copies, and therefore the indexing does not cut into the source VM's performance. The disclosed approach is widely applicable to VMs executing in cloud computing environments and/or in non-cloud data centers. The illustrative content indexing is accomplished without restoring the VM data files being indexed to a staging location.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 9/455 - ÉmulationInterprétationSimulation de logiciel, p. ex. virtualisation ou émulation des moteurs d’exécution d’applications ou de systèmes d’exploitation
G06F 16/13 - Structures d’accès aux fichiers, p. ex. indices distribués
24.
DATA PROTECTION SERVICE USING ISOLATED, ENCRYPTED BACKUP DATA
Disclosed techniques relate to security of backup data. In some embodiments, a method includes receiving, by data protection service running on a cloud computing system, a first encrypted copy of a backup of a first data store that is associated with a first account of an organization, where the first encrypted copy is encrypted using a first custodian cryptographic key that is shared between the organization and the data protection service that is different than a first production cryptographic key that is private and used by the organization to encrypt a non-backup version of the first data store. The method may include generating a second encrypted copy of the backup, including by encrypting the backup using a storage cryptographic key. The method may include storing the second encrypted copy of the backup in a second data store that is associated with the data protection service.
H04L 9/14 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité utilisant plusieurs clés ou algorithmes
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
A secure data storage management “recovery system” operates in a cloud computing environment that is apart from a source system and source data being protected. A “recovery manager” in the cloud computing environment is responsible for restoring secondary copies that were generated by the source system. The recovery manager gains knowledge (metadata) about the secondary copies by restoring, for its own use, a management database of, and backed up by, the source system. The recovery manager initiates out-of-place restores of the secondary copies to “recovery clients” in the recovery cloud. The recovery system restores, to the recovery cloud, secondary copies from any cloud platform and/or from non-cloud data centers, including secondary copies stored locally, off-cloud by the source system. The recovery manager comprises new features that enforce its isolation from the source system and they act to protect the integrity of the secondary copies generated by the source system.
G06F 16/11 - Administration des systèmes de fichiers, p. ex. détails de l’archivage ou d’instantanés
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
26.
PROTECTION OF VIRTUAL PRIVATE CLOUD CONFIGURATIONS
The methods and systems described herein provide a solution for protecting configuration data associated with a virtual private cloud. Network configurations, accounts, and/or security data may be collected from the host of the virtual private network using APIs provided by the host. The point-in-time configuration information of a VPC can be used in disaster recovery, migration to a new VPC host, or manage VPC configurations across accounts and regions. During a backup operation of a computing resource within a VPC, one or more processes requests security, network, and/or gateway configuration information from the VPC host. This information may be collected and requested for the entire VPC topology. The VPC configuration information, in the format/output received from the VPC host, is then backed up and stored with the backup of that computing resource in secondary storage.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 9/50 - Allocation de ressources, p. ex. de l'unité centrale de traitement [UCT]
27.
INTEROPERATING WITH A DATA PROTECTION SERVICE USING ISOLATED, ENCRYPTED BACKUP DATA
Disclosed techniques relate to security of backup data. In some embodiments, a method includes receiving, by data protection service running on a cloud computing system, a first encrypted copy of a backup of a first data store that is associated with a first account of an organization, where the first encrypted copy is encrypted using a first custodian cryptographic key that is shared between the organization and the data protection service that is different than a first production cryptographic key that is private and used by the organization to encrypt a non-backup version of the first data store. The method may include generating a second encrypted copy of the backup, including by encrypting the backup using a storage cryptographic key. The method may include storing the second encrypted copy of the backup in a second data store that is associated with the data protection service.
H04L 9/14 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité utilisant plusieurs clés ou algorithmes
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
Certain embodiments described herein relate to an improved synthetic full backup image generation system. In some embodiments, one or more components in an information management system can identify a file-server-created backup copy in a particular backup format of a plurality of backup formats, determine structure information associated with the particular backup format, and generate a synthetic full backup copy according to the structure information, where the synthetic full backup copy is also in the particular backup format identical to that of the file-server-created backup copy.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
29.
CLOUD AND MULTI-CLOUD PROTECTION, RECOVERY, AND MIGRATION OF DATABASES-AS-A-SERVICE (DBAAS)
A streamlined approach enables customers to retain management control over their data in a database-as-a-service (“DBaaS”) setting, by providing managed backup copies outside cloud service providers' sphere of control. An illustrative data storage management system provides control over performing backup operations to generate managed backup copies, storing managed backup copies, recovering managed backup copies in whole or in part, migrating managed backup copies, and migrating DBaaS instances. Management control also extends to choices of where to store the managed backup copies, whether on the same cloud computing platform as the source DBaaS, on a different cloud computing platform, and/or in a non-cloud data center.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 9/455 - ÉmulationInterprétationSimulation de logiciel, p. ex. virtualisation ou émulation des moteurs d’exécution d’applications ou de systèmes d’exploitation
G06F 16/21 - Conception, administration ou maintenance des bases de données
G06F 16/28 - Bases de données caractérisées par leurs modèles, p. ex. des modèles relationnels ou objet
H04L 67/10 - Protocoles dans lesquels une application est distribuée parmi les nœuds du réseau
Presented herein are systems and methods for backing up and restoring related backup data stored in different cloud storage tiers in a cloud storage environment. Backup data generated during a backup job is stored to different cloud storage tiers based on the type of data and a storage policy comprising designations of a first cloud storage tier and a second cloud storage tier. Backup metadata and index data is stored in the designated first cloud storage tier and backup payload data is stored in the designated second cloud storage tier. Designations of the storage tiers are based on the attributes associated with each tier of cloud storage. During restore, the backup payload data is recalled from the second storage tier into the first storage tier where it is used to restore to the destination client or customer.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 3/06 - Entrée numérique à partir de, ou sortie numérique vers des supports d'enregistrement
31.
Ransomware detection accuracy based on machine learning analysis of filename extension patterns
Ransomware detection accuracy is improved by analyzing patterns of changes in filename extension counts, relative to each other, that occur in a file system over time. The disclosed approach is malware-agnostic and does not rely on recognizing malware extensions or on real-time monitoring of the target file system. Instead, during each successive backup job of the target file system, the disclosed technology counts different types of filename extensions and compares the counts to each other and to corresponding counts taken in earlier backup jobs. Preferably, the anomaly detection analysis uses machine learning to discern a behavior pattern of the file system, which indicates how filename extensions are distributed and how much they change between backup jobs over time.
G06F 21/56 - Détection ou gestion de programmes malveillants, p. ex. dispositions anti-virus
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
Techniques disclosed herein are well suited to restoring deduplicated backup data from cloud-based storage and from multi-node replicated files systems, and they also improve performance in more traditional data storage technologies. Pre-restore steps include analysis of deduplication indexes to identify data segments that are stored consecutively on storage media. Reading data in aggregate runs of consecutively stored data segments reduces interactions with storage media that hosts the deduplicated data and speeds up retrieval. Parallel reads from multiple storage devices in multi-node replicated file systems also speed up retrieval. An illustrative enhanced media agent pre-fetches data (stored in deduplicated form) in anticipation of read requests that are expected in the restore operation. The pre-fetched data is temporarily stored locally at the media agent, which is responsible for interfacing with storage media and is further responsible for orchestrating the disclosed techniques within an illustrative data storage management system.
G06F 16/11 - Administration des systèmes de fichiers, p. ex. détails de l’archivage ou d’instantanés
G06F 3/06 - Entrée numérique à partir de, ou sortie numérique vers des supports d'enregistrement
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
A system and method of deployment of malware detection traps by at least one processor may include performing a first interrogation of a first Network Asset (NA) of a specific NA family; determining, based on the interrogation, a value of one or more first NA property data elements of the first NA; obtaining one or more second NA property data elements corresponding to the specific NA family; integrating the one or more first NA property data elements and the one or more second NA property data elements to generate a template data element, corresponding to the specific NA family; producing, from the template data element, a malware detection trap module; and deploying, on one or more computing devices of a computer network, one or more instantiations of the malware detection trap module as decoys of the first NA.
G06F 21/56 - Détection ou gestion de programmes malveillants, p. ex. dispositions anti-virus
G06F 21/51 - Contrôle des utilisateurs, des programmes ou des dispositifs de préservation de l’intégrité des plates-formes, p. ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade du chargement de l’application, p. ex. en acceptant, en rejetant, en démarrant ou en inhibant un logiciel exécutable en fonction de l’intégrité ou de la fiabilité de la source
G06F 21/55 - Détection d’intrusion locale ou mise en œuvre de contre-mesures
G06F 21/57 - Certification ou préservation de plates-formes informatiques fiables, p. ex. démarrages ou arrêts sécurisés, suivis de version, contrôles de logiciel système, mises à jour sécurisées ou évaluation de vulnérabilité
An information management system includes one or more client computing devices in communication with a storage manager and a secondary storage computing device. The storage manager manages the primary data of the one or more client computing devices and the secondary storage computing device manages secondary copies of the primary data of the one or more client computing devices. Each client computing device may be configured with a ransomware protection monitoring application that monitors for changes in their primary data. The ransomware protection monitoring application may input the changes detected in the primary data into a machine-learning classifier, where the classifier generates an output indicative of whether a client computing device has been affected by malware and/or ransomware. Using a virtual machine host, a virtual machine copy of an affected client computing device may be instantiated using a secondary copy of primary data of the affected client computing device.
G06F 21/55 - Détection d’intrusion locale ou mise en œuvre de contre-mesures
G06F 9/455 - ÉmulationInterprétationSimulation de logiciel, p. ex. virtualisation ou émulation des moteurs d’exécution d’applications ou de systèmes d’exploitation
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 21/54 - Contrôle des utilisateurs, des programmes ou des dispositifs de préservation de l’intégrité des plates-formes, p. ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade de l’exécution du programme, p. ex. intégrité de la pile, débordement de tampon ou prévention d'effacement involontaire de données par ajout de routines ou d’objets de sécurité aux programmes
G06F 21/56 - Détection ou gestion de programmes malveillants, p. ex. dispositions anti-virus
G06F 21/62 - Protection de l’accès à des données via une plate-forme, p. ex. par clés ou règles de contrôle de l’accès
G06F 21/78 - Protection de composants spécifiques internes ou périphériques, où la protection d'un composant mène à la protection de tout le calculateur pour assurer la sécurité du stockage de données
G06N 5/04 - Modèles d’inférence ou de raisonnement
The present application discloses methods and systems that leverage an information management framework equipped with air-gapped storage and integrated with a cleanroom cloud environment. Using “Recovery Group” data (asset list, recovery target site, and various configuration settings), applications and their associated data can be securely recovered, tested, and verified in the cleanroom environment before reinstating them into operational use. These assets, which may include databases, virtual machines, and file servers, are restored according to predefined priorities, specific recovery points, and under stringent security measures. The recovery group data facilitates the formulation of a detailed cyber recovery plan, which orchestrates the recovery operation by using restore job details, asset configurations, security protocols for the cleanroom environment, and network settings.
G06F 21/55 - Détection d’intrusion locale ou mise en œuvre de contre-mesures
G06F 21/53 - Contrôle des utilisateurs, des programmes ou des dispositifs de préservation de l’intégrité des plates-formes, p. ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade de l’exécution du programme, p. ex. intégrité de la pile, débordement de tampon ou prévention d'effacement involontaire de données par exécution dans un environnement restreint, p. ex. "boîte à sable" ou machine virtuelle sécurisée
G06F 21/54 - Contrôle des utilisateurs, des programmes ou des dispositifs de préservation de l’intégrité des plates-formes, p. ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade de l’exécution du programme, p. ex. intégrité de la pile, débordement de tampon ou prévention d'effacement involontaire de données par ajout de routines ou d’objets de sécurité aux programmes
A cloud-based data protection service is disclosed. In an embodiment, the data protection service may support backup of data sets from one or more sites associated with one or more organizations. In an embodiment, deduplication of backup data across multiple sites of an organization and/or multiple sites associated with different organizations may be supported. In an embodiment, backup data may be post-processed in the cloud to insert fingerprints corresponding to data blocks that did not change since a previous backup was performed, to scan the backup for security threats such as viruses, other malware, personally identifiable information, etc. In an embodiment, restore may be supported from the cloud, where restore blocks may be larger than backup data blocks. In another embodiment, restore may be based on blocks that have changed since the most recent backup (or a user-selected backup).
G06F 9/455 - ÉmulationInterprétationSimulation de logiciel, p. ex. virtualisation ou émulation des moteurs d’exécution d’applications ou de systèmes d’exploitation
G06F 9/50 - Allocation de ressources, p. ex. de l'unité centrale de traitement [UCT]
G06F 21/62 - Protection de l’accès à des données via une plate-forme, p. ex. par clés ou règles de contrôle de l’accès
H04L 9/06 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité l'appareil de chiffrement utilisant des registres à décalage ou des mémoires pour le codage par blocs, p. ex. système DES
H04L 67/1095 - Réplication ou mise en miroir des données, p. ex. l’ordonnancement ou le transport pour la synchronisation des données entre les nœuds du réseau
H04L 67/1097 - Protocoles dans lesquels une application est distribuée parmi les nœuds du réseau pour le stockage distribué de données dans des réseaux, p. ex. dispositions de transport pour le système de fichiers réseau [NFS], réseaux de stockage [SAN] ou stockage en réseau [NAS]
G06F 21/10 - Protection de programmes ou contenus distribués, p. ex. vente ou concession de licence de matériel soumis à droit de reproduction
G06F 21/56 - Détection ou gestion de programmes malveillants, p. ex. dispositions anti-virus
37.
LIVE MOUNTING A VIRTUAL MACHINE IN A PUBLIC CLOUD BASED ON ACCESSING A SIMULATED VIRTUAL DISK AS AN INTERNET SMALL COMPUTER SYSTEMS INTERFACE (ISCSI) TARGET
A native cloud-based VM in a cloud computing environment of choice is live-mounted without requiring nesting techniques. All operating system data needed to live-mount the VM is accessed over ISCSI. The disclosed technology: supports both Windows and Unix-like (e.g., Linux) operating systems; handles any number of partitions of the root file system without repeated mounting, exporting, and unmounting; and uses only internet protocols (e.g., HTTP, ISCSI) to live-mount the VM. The live-mounted VM gains access to a variety of secondary copies, e.g., made with file-level techniques or with block-level techniques, made within or outside the public cloud computing environment, made from other VMs having the same or a different hypervisor than the public cloud computing environment, and/or made from non-virtualized sources. Access to snapshots as a data source for the live-mounted VM is also disclosed. Thus, a streamlined and source-agnostic technology is disclosed for live-mounting VMs in a public cloud.
G06F 9/455 - ÉmulationInterprétationSimulation de logiciel, p. ex. virtualisation ou émulation des moteurs d’exécution d’applications ou de systèmes d’exploitation
G06F 9/50 - Allocation de ressources, p. ex. de l'unité centrale de traitement [UCT]
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
38.
COMMISSIONING AND DECOMMISSIONING METADATA NODES IN A RUNNING DISTRIBUTED DATA STORAGE SYSTEM
In a running distributed data storage system that actively processes I/Os, metadata nodes are commissioned and decommissioned without taking down the storage system and without introducing interruptions to metadata or payload data I/O. The inflow of reads and writes continues without interruption even while new metadata nodes are in the process of being added and/or removed and the strong consistency of the system is guaranteed. Commissioning and decommissioning nodes within the running system enables streamlined replacement of permanently failed nodes and advantageously enables the system to adapt elastically to workload changes. An illustrative distributed barrier logic (the “view change barrier”) controls a multi-state process that controls a coordinated step-wise progression of the metadata nodes from an old view to a new normal. Rules for I/O handling govern each state until the state machine loop has been traversed and the system reaches its new normal.
G06F 9/455 - ÉmulationInterprétationSimulation de logiciel, p. ex. virtualisation ou émulation des moteurs d’exécution d’applications ou de systèmes d’exploitation
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06V 10/25 - Détermination d’une région d’intérêt [ROI] ou d’un volume d’intérêt [VOI]
G06V 10/34 - Lissage ou élagage de la formeOpérations morphologiquesSquelettisation
G06V 20/54 - Trafic, p. ex. de voitures sur la route, de trains ou de bateaux
G06V 20/59 - Contexte ou environnement de l’image à l’intérieur d’un véhicule, p. ex. concernant l’occupation des sièges, l’état du conducteur ou les conditions de l’éclairage intérieur
G06V 40/10 - Corps d’êtres humains ou d’animaux, p. ex. occupants de véhicules automobiles ou piétonsParties du corps, p. ex. mains
H04N 7/18 - Systèmes de télévision en circuit fermé [CCTV], c.-à-d. systèmes dans lesquels le signal vidéo n'est pas diffusé
H04N 23/56 - Caméras ou modules de caméras comprenant des capteurs d'images électroniquesLeur commande munis de moyens d'éclairage
H04N 23/66 - Commande à distance de caméras ou de parties de caméra, p. ex. par des dispositifs de commande à distance
39.
Resiliency of a data storage system by protecting its management database to meet a recovery point objective (RPO)
An illustrative data storage management system comprises a management database that stores administrative preferences and system configurations, as well as results and/or statistics of completed secondary storage operations, i.e., information needed by the system to protect customers' data and to track and recover the protected data, including secondary copies such as backup copies, archive copies, etc. The disclosed data storage management system is configured to protect its own system data subject to a very aggressive (short) Recovery Point Objective (RPO), by using an innovative infrastructure that enables the system's storage manager to fail over to any number of other failover destination storage managers, each one comprising a destination management database. An illustrative database granularly tracks whether each and every transaction log file has been successfully applied to each and every destination management database to synchronize with the source management database.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
40.
CONTROLLING INFORMATION PRIVACY IN A SHARED DATA STORAGE MANAGEMENT SYSTEM
An illustrative data storage management system uses a control layer that controls information content presented to users and ensures information privacy between diverse tenants and/or resellers who share the system. The system populates a relationship database as transactions roll in (intake processing), and uses information in the relationship database later when processing responses (output processing). The relationship database comprises associations between e.g., a company ID and any number of entities that were created by or on behalf of the company or that are related to the company's service in the system. The control layer parses raw results that are responsive to requests for information and prevents others' information from being included in the responsive message(s). The techniques disclosed herein are not limited to shared systems managed by service providers, and may be implemented in fully owned and operated systems to add security and privacy among diverse users and/or departments.
A client computing device includes an entropy driver and a volume driver for protecting the client computing device against potential ransomware. The entropy driver is configured to determine one or more entropy values for a file in response to a determination that the file has been modified or changed. The determined entropy value may then be compared with a known entropy value for a filetype of the changed or modified file. Where the known entropy value and the determined entropy value differ, the volume driver may engage one or more protection operations to secure the client computing device from further corruption and/or modifications by potential ransomware and/or malware. The protection operations may include revoking and/or restricting one or more permissions on one or more storage volumes of the client computing device and backing up one or more files of the client computing device to secondary storage.
G06F 21/56 - Détection ou gestion de programmes malveillants, p. ex. dispositions anti-virus
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 21/78 - Protection de composants spécifiques internes ou périphériques, où la protection d'un composant mène à la protection de tout le calculateur pour assurer la sécurité du stockage de données
42.
SYNTHESIZING A RESTORE IMAGE FROM ONE OR MORE SECONDARY COPIES TO FACILITATE DATA RESTORE OPERATIONS TO A FILE SERVER
An illustrative media agent (MA) in a data storage management system instructs a NAS file server (filer) to restore an MA-created synthesized-copy instead of larger filer-created backup copies. The synthesized-copy is designed only for the particular files to be restored and mimics, and is typically much smaller than, a filer-created backup copy. The synthesized-copy is fed to the filer on restore as a “restore data image.” When receiving a restore request for certain backed-up data files, the MA synthesizes the synthesized-copy on the fly. The MA generates a header mimicking a filer-created backup header; extracts files from filer-created backup copies arranging them within the synthesized-copy as if in filer-created backups; and instructs filer to perform a full-volume restore from the synthesized-copy. The MA serves the synthesized-copy piecemeal as available, rather than waiting to synthesize the entire synthesized-copy. The synthesized-copy is not stored at the MA.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 3/06 - Entrée numérique à partir de, ou sortie numérique vers des supports d'enregistrement
43.
ANALYSIS OF BACKUP COPIES TO IDENTIFY MALWARE-ENCRYPTED PRIMARY DATA
Backup data is leveraged to determine whether primary data has been encrypted by malware. The disclosed approach does not rely on recognizing particular malware instances or malware provenance, and thus can be applied to any body of data. Even a novel and previously unknown malware attack can be detected in this way. An illustrative data storage management system analyzes secondary copies it created over time, applies a multi-factor analysis to data recovered from the secondary copies and, based on the analysis, infers whether the primary data from which the secondary copies were created may be encrypted. The present approach uses successive versions of backup copies to find indicia of malware encryption, rather than trying to trace or identify the malware itself. Indicia of entropy correlate highly with encryption, such as encryption performed by malware attacks. Conversely, indicia of similarity correlate highly with lack of encryption of successive versions of documents.
Certain embodiments disclosed herein reduce or eliminate a communication bottleneck at the storage manager by reducing communication with the storage manager while maintaining functionality of an information management system. In some implementations, a client obtains information for enabling a secondary storage job (e.g., a backup or restore) from a storage manager and stores the information (which may be referred to as job metadata) in a local cache. The client may then reuse the job metadata for multiple storage jobs reducing the frequency of communication with the storage manager. When a configuration of the information management system changes, or the availability of resources changes, the storage manager can push updates to the job metadata to the clients. Further, a client can periodically request updated job metadata from the storage manager ensuring that the client does not rely on out-of-date job metadata.
H04L 41/046 - Architectures ou dispositions de gestion de réseau comprenant des agents de gestion de réseau ou des agents mobiles à cet effet
H04L 41/0895 - Configuration de réseaux ou d’éléments virtualisés, p. ex. fonction réseau virtualisée ou des éléments du protocole OpenFlow
H04L 41/40 - Dispositions pour la maintenance, l’administration ou la gestion des réseaux de commutation de données, p. ex. des réseaux de commutation de paquets en utilisant la virtualisation des fonctions réseau ou ressources, p. ex. entités SDN ou NFV
H04L 67/1095 - Réplication ou mise en miroir des données, p. ex. l’ordonnancement ou le transport pour la synchronisation des données entre les nœuds du réseau
H04L 67/1097 - Protocoles dans lesquels une application est distribuée parmi les nœuds du réseau pour le stockage distribué de données dans des réseaux, p. ex. dispositions de transport pour le système de fichiers réseau [NFS], réseaux de stockage [SAN] ou stockage en réseau [NAS]
H04L 67/568 - Stockage temporaire des données à un stade intermédiaire, p. ex. par mise en antémémoire
45.
EFFICIENT COLLECTION AND REPORTING OF OPERATION-RELATED METRIC DATA IN A CLOUD ENVIRONMENT
The present application discloses an efficient system and method for collecting, managing, and reporting operation-level metrics of data interactions with cloud storage. A media agent is configured to collect data about operations performed on cloud storage. The system is configured to capture, process, and report detailed metrics with enhanced efficiency and granularity. The media agent accumulates this data in a cache memory. In a predefined cycle, the collected data from the cache is transferred to a local file. The system further integrates the data with job-related data stored at a management database. By correlating the metrics data with this job-related information, the system can produce detailed reports that offer insights into usage patterns, efficiency, and performance across different tenants.
Systems and processes disclosed herein perform an automatic remediation process. The automatic remediation process may be a log-based remediation process. Systems disclosed herein may obtain log files from an information management system and determine the occurrence of errors at the information management system based on error codes included in the logs. Further, the systems may access a knowledgebase to determine whether solutions for the errors have been previously generated. The solutions may include patches or hotfixes that can be applied to the information management system without removing user-access or stopping execution of the information management system. The systems may automatically update the information management system to address the errors. Alternatively, or in addition, the systems may alert a user, such as an administrator, of the existence of a solution to the error, and whether the solution may be applied without interrupting service or access to the information management system.
The present inventors devised techniques and technologies that streamline the protection of data stored on shared file storage e.g., on file servers, network-attached storage (NAS), share drives, network shares, etc., in a data storage management system. Some embodiments feature a proxy-less backup configuration in which backup services hosts are assigned to perform a secondary copy job, at job runtime, based on host attributes relative to the data source. Some embodiments are configured to, at job runtime, automatically resolve data paths to the source data, and automatically mount the data paths, rather than requiring data paths to be expressly pre-administered on all possible candidate backup machines. Some embodiments automatically protect data from shared file storage that was not expressly given a backup plan (“undefined” data) by applying default preferences for protecting undefined data.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
Because Kubernetes clusters can be ephemeral, backing up in-cluster data to storage outside the cluster is important. Prior art solutions used the cluster's API server, which facilitates communications with the cluster control plane, to transfer backup data through the API server. However, the API server as a data transfer node has resiliency weaknesses and can slow down backup job performance. The present solution provides a more streamlined and scalable approach, which circumvents the API server and additionally includes more robust error checking, log capture, and realtime job monitoring to provide improved data protection resilience. The disclosed approach employs a “sponsor” data agent outside the cluster and temporarily deploys a specialized backup resource within the cluster during a backup job, such as a lightweight Kubernetes File Client and/or an enhanced File System Data Agent, both of which present substantial performance and resiliency advantages over the API server.
Because Kubernetes clusters can be ephemeral, backing up in-cluster data to storage outside the cluster is important. Prior art solutions used the cluster's API server, which facilitates communications with the cluster control plane, to transfer backup data through the API server. However, the API server as a data transfer node has resiliency weaknesses and can slow down backup job performance. The present solution provides a more streamlined and scalable approach, which circumvents the API server and additionally includes more robust error checking, log capture, and realtime job monitoring to provide improved data protection resilience. The disclosed approach employs a “sponsor” data agent outside the cluster and temporarily deploys a specialized backup resource within the cluster during a backup job, such as an enhanced File System Data Agent and/or a lightweight Kubernetes File Client, both of which present substantial performance and resiliency advantages over the API server.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
Techniques are disclosed relating to providing fast access to restored data in a cloud storage environment. A computing system stores multiple sets of incremental backup data that reflect changes in data being backed up between backup intervals and metadata that indicates which set of incremental backup data stores a given object. The computing system generates an endpoint for a requesting computing system, where the endpoint supports requests for restored backup data and data responses. In response to a request from the requesting computing system via the endpoint, the computing system queries the metadata based on the request and stores metadata retrieved from the query in a key/value store using object identification information as key data and the retrieved metadata as value data. The computing system provides requested data according to a lazy loading technique, including providing requested data via the endpoint based on the metadata in the key/value store.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
A data storage environment can include one or more virtual machines instantiated on a host computing device. Based on physical location data of the one or more virtual machines received from the host computing device, a storage manager can control the performance of a secondary copy operation on one or more storage units that store virtual machine data associated with the one or more virtual machines and/or the performance of a secondary copy operation on the one or more virtual machines.
G06F 9/455 - ÉmulationInterprétationSimulation de logiciel, p. ex. virtualisation ou émulation des moteurs d’exécution d’applications ou de systèmes d’exploitation
G06F 3/06 - Entrée numérique à partir de, ou sortie numérique vers des supports d'enregistrement
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 16/11 - Administration des systèmes de fichiers, p. ex. détails de l’archivage ou d’instantanés
The disclosed approach works without the individualized credentials of failed machines when setting up recovery VMs in a cloud computing environment. Each recovery VMs is customized to properly correspond to the system state of its failed counterpart. An illustrative data storage management system recovers backup data and system states collected from the counterpart computing devices, custom-configures recovery VMs in the cloud computing environment, and injects the desired drivers into each recovery VM during an enhanced bare-metal restore process. The enhanced bare-metal restore process works without the failed computer's credentials. The system also restores the backed up data to recovery volumes attached to the recovery VMs. The present approach is both scalable and secure. When the enhanced bare-metal restore process completes, each cloud-based recovery VM presents a user interface that, for the first time after the computing device has failed, asks for the individualized credentials of the failed machine.
G06F 9/455 - ÉmulationInterprétationSimulation de logiciel, p. ex. virtualisation ou émulation des moteurs d’exécution d’applications ou de systèmes d’exploitation
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
A secure data storage management “recovery system” operates in a cloud computing environment that is apart from a source system and source data being protected. A “recovery manager” in the cloud computing environment is responsible for restoring secondary copies that were generated by the source system. The recovery manager gains knowledge (metadata) about the secondary copies by restoring, for its own use, a management database of, and backed up by, the source system. The recovery manager initiates out-of-place restores of the secondary copies to “recovery clients” in the recovery cloud. The recovery system restores, to the recovery cloud, secondary copies from any cloud platform and/or from non-cloud data centers, including secondary copies stored locally, off-cloud by the source system. The recovery manager comprises new features that enforce its isolation from the source system and they act to protect the integrity of the secondary copies generated by the source system.
G06F 16/00 - Recherche d’informationsStructures de bases de données à cet effetStructures de systèmes de fichiers à cet effet
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 16/11 - Administration des systèmes de fichiers, p. ex. détails de l’archivage ou d’instantanés
54.
Protection of virtual private cloud configurations
The methods and systems described herein provide a solution for protecting configuration data associated with a virtual private cloud. Network configurations, accounts, and/or security data may be collected from the host of the virtual private network using APIs provided by the host. The point-in-time configuration information of a VPC can be used in disaster recovery, migration to a new VPC host, or manage VPC configurations across accounts and regions. During a backup operation of a computing resource within a VPC, one or more processes requests security, network, and/or gateway configuration information from the VPC host. This information may be collected and requested for the entire VPC topology. The VPC configuration information, in the format/output received from the VPC host, is then backed up and stored with the backup of that computing resource in secondary storage.
G06F 12/00 - Accès à, adressage ou affectation dans des systèmes ou des architectures de mémoires
G06F 9/50 - Allocation de ressources, p. ex. de l'unité centrale de traitement [UCT]
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
55.
HOLISTIC PROTECTION OF CLOUD-BASED SERVERLESS APPLICATIONS
The present inventors devised a holistic approach for protecting serverless applications in single-cloud, multi-zone, multi-cloud, and/or non-cloud data center computing environments. An illustrative data storage management system discovers application assets, relationships, and interoperability dependencies and creates an “application entity” that references the various assets. Protection preferences apply to the application entity as a whole. An orchestration function in the system coordinates storage management operations (e.g., backup, replication, live synchronization, etc.) in a suitable order of operations gleaned from asset dependencies, if any. A set of copies of the application's discovered assets are generated in coordinated fashion and represent a point-in-time copy of the application. The point-in-time copy can be restored and/or migrated to other computing services by the data storage management system. The orchestration function coordinates restore and migration operations, including any cloud-to-cloud or cloud-to/from-non-cloud conversions that might be necessary to activate the application in a different computing environment.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 11/20 - Détection ou correction d'erreur dans une donnée par redondance dans le matériel en utilisant un masquage actif du défaut, p. ex. en déconnectant les éléments défaillants ou en insérant des éléments de rechange
H04L 67/00 - Dispositions ou protocoles de réseau pour la prise en charge de services ou d'applications réseau
H04L 67/1095 - Réplication ou mise en miroir des données, p. ex. l’ordonnancement ou le transport pour la synchronisation des données entre les nœuds du réseau
H04L 67/1097 - Protocoles dans lesquels une application est distribuée parmi les nœuds du réseau pour le stockage distribué de données dans des réseaux, p. ex. dispositions de transport pour le système de fichiers réseau [NFS], réseaux de stockage [SAN] ou stockage en réseau [NAS]
H04L 67/51 - Découverte ou gestion de ceux-ci, p. ex. protocole de localisation de service [SLP] ou services du Web
56.
Protection Groups for Backing up Cloud-Based Key-Value Stores
Techniques are disclosed relating to providing protection groups and rapid determination of expired objects and associated storage resources in a cloud-based backup storage context. In various embodiments, the disclosed techniques include generating, by a computing system, incremental backup data for a backup based on protection group information, including a set of cloud-based key-value data store buckets, filter information, and policy information. Disclosed techniques also include rapid determination of expired objects and associated storage resources. Disclosed techniques may advantageously provide a centralized view across buckets, accounts, and regions and allow users to target specific subsets of their data stores for backup, which may improve performance and reduce backup storage costs, relative to traditional techniques.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
57.
Adaptive data protection for a multi-node data cluster
An illustrative data storage management system protects data in a replicated multi-node system (“cluster”). The illustrative system creates a new administrative entity (“pseudo-client”) that represents the cluster within the system. The system intelligently performs as an adaptive “set it and forget it” system. Preferences for the pseudo-client, including alternate rules that cover various contingencies in the cluster, need not be reset as the cluster undergoes node failures and/or role changes over time. Rather, the disclosed system adapts, on each successive secondary copy job, to the current configuration of the cluster without requiring a system administrator to provide further input or analysis. This approach ensures that jobs can begin promptly as scheduled or on demand. Component selection is based at least in part on geography/zone and/or network topology considerations, which improves the likelihood of job completion and success, and RPO/RTO service levels are more likely to be met.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
An illustrative file indexing approach enhances what was previously possible with hypervisor-free live browsing of virtual machine (VM) block-level backup copies. Capabilities are described for indexing files discovered in VM block-level backup copies, including file content. The illustrative file indexing functionality activates a live-browse session to discover files present within VM block-level backup copies and indexes file names and directory structures as created by an original source VM, resulting in an illustrative file index. The illustrative file indexing functionality optionally indexes file contents within VM block-level backup copies, resulting in an illustrative content index. The file index and content index are retained in persistent data structure(s) stored apart from the VM block-level backup copies. The indexes are searchable without mounting or live-browsing the VM block-level backup copies. In some embodiments the file index and the content index are consolidated. An enhanced storage manager is also disclosed.
Described herein are techniques for automating media agent state management. For example, if a media agent is running poorly, then the media agent can be disabled and an alternate media agent can perform secondary copy job operations in place of the poorly running media agent. To determine whether a media agent is running poorly, a storage manager can determine whether the media agent has an anomalous number of failed jobs, pending jobs, and/or long running jobs and/or can determine whether the amount of resources used by the media agent is high or is increasing constantly, at a constant rate, or at a near constant rate.
G06F 11/20 - Détection ou correction d'erreur dans une donnée par redondance dans le matériel en utilisant un masquage actif du défaut, p. ex. en déconnectant les éléments défaillants ou en insérant des éléments de rechange
G06F 3/06 - Entrée numérique à partir de, ou sortie numérique vers des supports d'enregistrement
Artificial intelligence (AI), preferably a generative AI (Gen-AI) technology, powers an illustrative “dynamic API service” that interoperates with or within a data resiliency system that has well-defined API(s) for communicating with it. The illustrative dynamic API service is configured to recognize incoming information from an originator, which may arrive unstructured or in a format that is incompatible with the API(s). The illustrative dynamic API service interprets the incoming information, identifies pertinent components in the data resiliency system, issues API call(s) to the system components, and organizes response(s) to the originator. In some embodiments, the illustrative dynamic API service uses or incorporates Gen-AI technology to perform some of the disclosed features and functions. The Gen-AI training corpus preferably includes information extracted from the data resiliency system itself. The originator systems also may employ Gen-AI, and some embodiments function in an AI-to-AI configuration.
An illustrative “dynamic API service” interoperates with a data storage management system that has well-defined API(s). The illustrative dynamic API service is configured to recognize information received from an originator, but the information arrives unstructured or is otherwise incompatible with the API(s). The illustrative dynamic API service interprets the incoming information, identifies pertinent system components in the system, issues API call(s) to the system components, and organizes appropriate response(s). Advantageously, the illustrative dynamic API service is configured to recognize information that is relevant to the data storage management system, and to ignore irrelevant information. Relevant incoming information may include malware alerts, information requests, backup prompts, restore requests, metadata queries, configuration prompts or queries, etc., without limitation. In some embodiments, the illustrative dynamic API service uses or incorporates generative artificial intelligence (Gen-AI) to perform some of the disclosed functions. The originator systems also may employ Gen-AI.
This application relates to ransomware detection and data pruning management. Ransomware typically involves an I/O heavy process of encrypting data files and/or deleting or renaming the original files. Thus, ransomware attacks may be detected by analyzing the I/O activity in a given file system. In some embodiments, a software module running on a client machine manages copying, archiving, migrating, and/or replicating of primary data and restoring and/or pruning secondary data (e.g., backup copies of the primary data). When a potential ransomware attack is detected, the software module is immediately stopped so that the software module does not prune any data that may need to be restored. Upon receiving user input that indicates that the client machine is not under a ransomware attack, the software module is allowed to resume its operations, including pruning of the secondary data.
Snapshot-based disaster recovery (DR) orchestration systems and methods for virtual machine (VM) failover and failback do not require that VMs or their corresponding datastores be actively operating at the DR site before a DR orchestration job is initiated, i.e., before failover. An illustrative data storage management system deploys proprietary components at source data center(s) and at DR site(s). The proprietary components (e.g., storage manager, data agents, media agents, backup nodes, etc.) interoperate with each other and with the source and DR components to ensure that VMs will successfully failover and/or failback. DR orchestration jobs are suitable for testing VM failover scenarios (“clone testing”), for conducting planned VM failovers, and for unplanned VM failovers. DR orchestration jobs also handle failback and integration of DR-generated data into the failback site, including restoring VMs that never failed over to fully re-populate the source/failback site.
G06F 11/20 - Détection ou correction d'erreur dans une donnée par redondance dans le matériel en utilisant un masquage actif du défaut, p. ex. en déconnectant les éléments défaillants ou en insérant des éléments de rechange
G06F 9/455 - ÉmulationInterprétationSimulation de logiciel, p. ex. virtualisation ou émulation des moteurs d’exécution d’applications ou de systèmes d’exploitation
The disclosed cyber threat detection and deception system leverages metadata information collected by the data storage management system. Using the metadata collected by the data storage management system, the cyber threat detection and deception system analyzes that metadata to detect any anomalies. Once suspicious or abnormal behavior is detected in an asset, the cyber threat detection and deception system creates and deploys a cyber deception plan for that asset. The cyber deception plan is implemented by way of deploying sensors or emulation traps in any number of cyber-threat appliances within the data network. Lures or tokens are configured and deployed on the suspected assets themselves to redirect attackers to the emulation traps.
Protecting configuration data in a clustered container system may include, in some embodiments, protecting an ETCD data store in a Kubernetes cluster. A data storage management system addresses the unique needs of protecting an ETCD data store of a target Kubernetes cluster, as well as protecting non-ETCD data payloads. The illustrative data storage management system defines ETCD as a unique kind of workload. ETCD protection is integrated within the data storage management system, which automatically creates data structures and resources within the system for, and provides special-purpose features to protect, ETCD contents and associated security certificates. One of the special-purpose features deploys a temporary data transfer agent within the target Kubernetes cluster to safeguard an ETCD snapshot and transmit its contents, along with the security certificates, to a backup infrastructure that operates outside of the target Kubernetes cluster. The backup infrastructure comprises components deployed by the data storage management system.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
Systems described herein may dynamically add one or more proxy agents to a cloud data storage system to process an information management job, such as restore job. Upon completion of the job or at some other appropriate interval, the system can power down and decommission the proxy agents and/or the virtual machines on which the proxies reside according to a cleanup schedule (e.g., at hourly or minute intervals). The system takes into account currently existing proxies or virtual machines when processing a restore request to determine the need for new proxies to service the restore request. In this manner the system can save costs and computing resources through efficient virtual machine deployment and retirement.
A storage manager for an information management system determines whether one or more predetermined conditions have been met for transferring metadata of previously performed backup jobs stored in a first management database. A backup job may correspond to a backup operation of a primary storage device of a first client computing device. In response to a determination that one or more of the predetermined conditions have been met, the storage manager may transfer metadata for a second plurality of backup jobs to a second management database of a recovery manager. The recovery manager may receive a request to restore data to the primary storage device of the first client computing device based on the metadata of the second plurality of backup jobs. A media agent managed by the recovery manager may then restore the requested data to the primary storage device of the first client computing device.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 16/21 - Conception, administration ou maintenance des bases de données
An information management system can detect instances in which data is being stored in a non-standard file path and can alert the user of the client computing device, modify the storage policy to include the non-standard file path, and/or initiate a secondary copy operation to prevent data loss of the data stored in the non-standard file path. For example, a client computing device may execute a filter driver that monitors interactions with files in the file system. The filter driver can identify any non-standard file paths not subject to a storage policy that include files in which interactions occurred. For a non-standard file path, the filter driver can determine whether the frequency of interaction with files in the non-standard file path satisfies a threshold frequency. If the threshold is satisfied, then the filter driver may determine that the files should be subject to the storage policy and take appropriate action.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
An illustrative cloud-based air-gapped data storage management (destination) system obtains authorized access to other (source) systems' backup copies, replicates those copies within the destination system, parses supplemental metadata included in the source backup copies, and integrates the replica copies into the destination system as though natively created there. Replica copies are integrated as backup copies without first restoring the source backup copies to a native data format. The source system lacks knowledge of or connectivity with the destination system, thus maintaining an “air gap” between the systems. The destination system preferably operates in a cloud computing environment. The destination system uses supplemental metadata from the replica copies to re-create or mimic the source's computing environment and to restore backed up data from the replica copies. The destination system also operates as an autonomous analytics engine, applying value-added services to backed up data pulled from source system(s).
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
Some service providers (e.g., Microsoft's Office 365 services) throttle application or service requests an organization, a user, or device can request from a specific application or a suite of applications/services. This throttling can significantly impact performance for, not only the requesting user/device, but also for other tenants associated with that organization. To limit this imposed external throttling, an intelligent internal adaptive throttling or rate limiting may be implemented. In an embodiment, the system monitors throttling imposed by the service provider. Using this information, the system determines an optimal rate of calls that can made for that service to maximize throughput and performance. The system continuously monitors the throttling and in response dynamically modifies the internal target rate.
H04L 47/12 - Prévention de la congestionRécupération de la congestion
H04L 47/2475 - Trafic caractérisé par des attributs spécifiques, p. ex. la priorité ou QoS pour la prise en charge des trafics caractérisés par le type d'applications
H04L 67/1097 - Protocoles dans lesquels une application est distribuée parmi les nœuds du réseau pour le stockage distribué de données dans des réseaux, p. ex. dispositions de transport pour le système de fichiers réseau [NFS], réseaux de stockage [SAN] ou stockage en réseau [NAS]
71.
Mobile control application for managing an information management system
A control application facilitates interactions with, and configurations of, the information management system that manages one or more client computing devices of an information management system. The control application may be implemented using a variety of modules that allow a user to interact with the information management system services in various ways. Using the control application, a user may view a backup status of the information management system, and view the backup status of specific client computing devices that are managed by the information management system. The user may also search for various entities and/or objects within the information management system using the control application. In addition, a user may view the status of one or more backup jobs configured within the information management system, as well as backup plans that have been established for one or more of the client computing devices.
In order to avoid writing duplicates of blocks of data into a storage platform, any virtual disk within the storage platform may have a de-duplication feature enabled. Or, all virtual disks have this feature enabled. For virtual disks with de-duplication enabled, a unique message digest is calculated for every block of data written to that virtual disk. Upon a write, these message digests are consulted in order to determine if a particular block of data has already been written, if so, it is not written again, and if not, it is written. All de-duplication virtual disks are written to a single system virtual disk within the storage platform. De-duplication occurs over the entire storage platform and over all its virtual disks because all message digests are consulted before a write is performed for any virtual disk. A read for a de-duplication virtual desk reads from the system virtual disk.
An information management system includes a storage manager for managing backup and/or restore operations for one or more client computing devices. The storage manager may be in communication with a resource administrator of a computing resource cluster, wherein the resource administrator instantiates one or more computing pods using the computing resource cluster. The resource administrator may receive a request for computing resources from the storage manager and provision the computing pods based on the request. The resource administrator may then select a pre-configured container image from one or more pre-configured container images based on the computing resource request, wherein the pre-configured container image configures a computing pod to create secondary copies of primary data from a particular primary data source of the information management system. The resource administrator may then communicate a message to the storage manager informing the storage of the availability of the provisioned computing pods.
G06F 9/50 - Allocation de ressources, p. ex. de l'unité centrale de traitement [UCT]
G06F 9/455 - ÉmulationInterprétationSimulation de logiciel, p. ex. virtualisation ou émulation des moteurs d’exécution d’applications ou de systèmes d’exploitation
74.
PERFORMING SECONDARY COPY OPERATIONS BASED ON DEDUPLICATION PERFORMANCE
An improved information management system is described herein in which the information management system can evaluate the deduplication performance of secondary copy operations and dynamically adjust the manner in which secondary copy data is created to minimize the negative effects of performing deduplication. Furthermore, the improved information management system can improve deduplication performance by applying different storage policies to different types of applications running on a client computing device. Moreover, the improved information management system can automatically detect the region of a client computing device and apply an appropriate information management policy to the client computing device to avoid inconsistencies or other errors resulting from administrator control.
An information management system according to certain aspects is provided to perform archiving based on third-party application rules and third-party metadata. The system may include a third-party archiving data agent that can access archiving rules and/or metadata of a third-party application. The third-party archiving data agent may be a data agent that can access archiving rules and/or metadata of a third-party application, and can include or be in the form of a plug-in for a particular third-party application. The third-party archiving data agent can decide whether to archive a file associated with a third-party application by checking the third-party metadata associated with the file and determining whether the metadata meets the third-party archiving rules. The system can perform the archiving on behalf of the third-party application, and in certain embodiments, notify the third-party application that the archiving has been completed.
Live mounting a virtual machine (VM) causes the VM to run off a backup copy or snapshot previously taken of a “live” production VM. The live-mounted VM is generally intended for temporary use such as to validate the integrity and contents of the backup copy for disaster recovery validation, or to access some contents of the backup copy from the live-mounted VM without restoring all backed up files. These uses contemplate that changes occurring during live mount are not preserved after the live-mounted VM expires or is taken down. Thus, live mounting a VM is not a restore operation and usually does not involve access to every block of data in the backup copy. However, live mounting provides live VM service in the cloud sooner than waiting for all of the backup copy/snapshot to be restored.
G06F 9/455 - ÉmulationInterprétationSimulation de logiciel, p. ex. virtualisation ou émulation des moteurs d’exécution d’applications ou de systèmes d’exploitation
G06F 3/06 - Entrée numérique à partir de, ou sortie numérique vers des supports d'enregistrement
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 11/20 - Détection ou correction d'erreur dans une donnée par redondance dans le matériel en utilisant un masquage actif du défaut, p. ex. en déconnectant les éléments défaillants ou en insérant des éléments de rechange
According to certain aspects, a system includes a client device that includes a virtual machine (VM) executed by a hypervisor, a driver located within the hypervisor, and a data agent. The VM may include a virtual hard disk file and a change block bitmap file. According to some embodiments the driver intercepts write operations generated by the VM to store data in a sector, determines an identity of the sector based on the intercepted write operation, determines an entry in the change block file that corresponds with the first sector, and modifies the entry in the change block file to indicate that data in that sector has changed. The data agent may generate an incremental backup of the VM based on the change block file in response to an instruction from a storage manager, where the incremental backup includes the data in the sector where data was modified.
G06F 3/06 - Entrée numérique à partir de, ou sortie numérique vers des supports d'enregistrement
G06F 9/455 - ÉmulationInterprétationSimulation de logiciel, p. ex. virtualisation ou émulation des moteurs d’exécution d’applications ou de systèmes d’exploitation
G06F 11/00 - Détection d'erreursCorrection d'erreursContrôle de fonctionnement
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
During a data protection operation, a data storage system can collect computing attributes associated with hosting of an application generating data being backed up and may also obtain information relating to physical characteristics of the computing device hosting the application and the data. At the time of migration to a cloud, the system can use the collected attributes and/or information to provision cloud resources. The cloud storage system may accept provisioning requests, and may provide several templates which each specify a cloud resource that can be provisioned upon request. The system may compare the collected attributes with the attributes of the available templates to determine the best match. Then, the system may issue a provisioning request to the cloud provider according to the best-matched template. After provisioning the resources, the system may restore backup data of the application to the cloud storage system to migrate the data.
H04L 67/1097 - Protocoles dans lesquels une application est distribuée parmi les nœuds du réseau pour le stockage distribué de données dans des réseaux, p. ex. dispositions de transport pour le système de fichiers réseau [NFS], réseaux de stockage [SAN] ou stockage en réseau [NAS]
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 16/11 - Administration des systèmes de fichiers, p. ex. détails de l’archivage ou d’instantanés
G06F 16/21 - Conception, administration ou maintenance des bases de données
An information management system according to certain aspects may be configured to generate a snapshot of data relating to a plurality of applications. The system may include a plurality of data agents, wherein each data agent is associated with at least one of a plurality of applications, and data generated by the plurality of applications is stored in a logical volume in primary storage. The system may also include a snapshot manager configured to detect the plurality of applications; check with the plurality of data agents whether the associated applications are in consistent states; obtain a snapshot of the logical volume in response to receiving notifications from the plurality of data agents that the associated applications are in consistent states; and generate mapping information between a particular one of the plurality of applications and a portion of the snapshot relating to the particular one of the plurality of applications.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 9/455 - ÉmulationInterprétationSimulation de logiciel, p. ex. virtualisation ou émulation des moteurs d’exécution d’applications ou de systèmes d’exploitation
A streamlined approach analyzes block-level backups of VM virtual disks and creates both coarse and fine indexes of backed up VM data files in the block-level backups. The indexes (collectively the “content index”) enable granular searching by filename, by file attributes (metadata), and/or by file contents, and further enable granular live browsing of backed up VM files. Thus, by using the illustrative data storage management system, ordinary block-level backups of virtual disks are “opened to view” through indexing. Any block-level copies can be indexed according to the illustrative embodiments, including file system block-level copies. The indexing occurs offline in an illustrative data storage management system, after VM virtual disks are backed up into block-level backup copies, and therefore the indexing does not cut into the source VM's performance. The disclosed approach is widely applicable to VMs executing in cloud computing environments and/or in non-cloud data centers. The illustrative content indexing is accomplished without restoring the VM data files being indexed to a staging location.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 9/455 - ÉmulationInterprétationSimulation de logiciel, p. ex. virtualisation ou émulation des moteurs d’exécution d’applications ou de systèmes d’exploitation
G06F 16/13 - Structures d’accès aux fichiers, p. ex. indices distribués
81.
Cloud-based destination for block-level data replication processing
Systems and methods disclosed herein improve on current technology for block-level data replication to cloud computing environments. A new system architecture deploys one or more replication tail proxies in a cloud computing environment, locally (at the cloud) tracks replicated data and determines which replicated data meet criteria for reconstructing a desired point-in-time in the cloud, and persists data blocks received at the replication tail proxy until they are processed as recovery points. The disclosed approach presents resiliency and performance advantages. First, the resiliency of block-level data replication to cloud is improved by deploying the replication tail proxy in the destination cloud. Second, a Recovery Time Objective (RTO) is reduced by enabling faster cloud deployment of virtual machines for disaster recovery, failover, and/or test purposes based on the replicated data.
G06F 3/06 - Entrée numérique à partir de, ou sortie numérique vers des supports d'enregistrement
G06F 9/455 - ÉmulationInterprétationSimulation de logiciel, p. ex. virtualisation ou émulation des moteurs d’exécution d’applications ou de systèmes d’exploitation
82.
Enforcing a recovery point objective (RPO) for a production database without generating secondary copies of the production database
A disclosed framework enables virtually any aggressive Recovery Point Objective (RPO) to be enforced for a production database, without limitation on type of database management system (DBMS) or size of the production database. The framework overcomes technological barriers of the prior art, such as bottlenecks presented by a storage manager computer that traditionally managed database backups. To avoid the bottlenecks, an illustrative data storage management system does not engage the storage manager computer in storage operations that could impact the database RPO. Certain components are added and enhanced to autonomously capture database transaction logs, which are stored securely and persistently away from the DBMS. In a separate and less frequent operation, and with involvement of the storage manager computer, the illustrative system generates secondary copies in their final form. Meanwhile, temporary backup files can be used in restore operations without first being converted into secondary copies.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
83.
Distributed data storage system using erasure coding on storage nodes fewer than data plus parity fragments
A distributed data storage system using erasure coding (EC) provides advantages of EC data storage while retaining high resiliency for EC data storage architectures having fewer data storage nodes than the number of EC data-plus-parity fragments. An illustrative embodiment is a three-node data storage system with EC 4+2. Incoming data is temporarily replicated to ameliorate the effects of certain storage node outages or fatal disk failures, so that read and write operations can continue from/to the storage system. The system is equipped to automatically heal failed EC write attempts in a manner transparent to users and/or applications: when all storage nodes are operational, the distributed data storage system automatically converts the temporarily replicated data to EC storage and reclaims storage space previously used by the temporarily replicated data. Individual hardware failures are healed through migration techniques that reconstruct and re-fragment data blocks according to the governing EC scheme.
A “backup services container” comprises “backup toolkits,” which include scripts for accessing containerized applications plus enabling utilities/environments for executing the scripts. The backup services container is added to Kubernetes pods comprising containerized applications without changing other pod containers. For maximum value and advantage, the backup services container is “over-equipped” with toolkits. The backup services container selects and applies a suitable backup toolkit to a containerized application to ready it for a pending backup. Interoperability with a proprietary data storage management system provides features that are not possible with third-party backup systems. Some embodiments include one or more components of the proprietary data storage management within the illustrative backup services container. Some embodiments include one or more components of the proprietary data storage management system in a backup services pod configured in a Kubernetes node. All configurations and embodiments are suitable for cloud and/or non-cloud computing environments.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 9/455 - ÉmulationInterprétationSimulation de logiciel, p. ex. virtualisation ou émulation des moteurs d’exécution d’applications ou de systèmes d’exploitation
G06F 9/50 - Allocation de ressources, p. ex. de l'unité centrale de traitement [UCT]
85.
Restoring virtual machine data to cloud using a virtual server cloud file system
Uploads of restored virtual machine (“VM”) data to cloud storage, e.g., VM restore-to-cloud operations, are performed without having to write whole restored virtual disk files to a proxy server before the virtual disk data begins uploading to cloud. Restored data blocks from a backup source are locally cached, staged for efficiency, and asynchronously uploaded to the cloud page-by-page without tapping mass storage resources on the proxy. Downloads of VM data from cloud storage, e.g., VM backup-from-cloud, are performed without having to download a virtual disk file in its entirety to the proxy server before the backup operation begins generating a backup copy. This speeds up “pulling” VM data from the cloud by pre-fetching and locally caching downloaded data blocks. The cached data blocks are processed for backup and stored page-by-page directly into a secondary copy of the cloud VM virtual-disk file without tapping mass storage resource at the proxy.
G06F 7/00 - Procédés ou dispositions pour le traitement de données en agissant sur l'ordre ou le contenu des données maniées
G06F 9/455 - ÉmulationInterprétationSimulation de logiciel, p. ex. virtualisation ou émulation des moteurs d’exécution d’applications ou de systèmes d’exploitation
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 11/16 - Détection ou correction d'erreur dans une donnée par redondance dans le matériel
G06F 11/20 - Détection ou correction d'erreur dans une donnée par redondance dans le matériel en utilisant un masquage actif du défaut, p. ex. en déconnectant les éléments défaillants ou en insérant des éléments de rechange
An improved information management system that implements a staging area or cache to temporarily store primary data in a native format before the primary data is converted into secondary copies in a secondary format is described herein. For example, the improved information management system can include various media agents that each include one or more high speed drives. When a client computing device provides primary data for conversion into secondary copies, the primary data can initially be stored in the native format in the high speed drive(s). If the client computing device then submits a request for the primary data, the media agent can simply retrieve the primary data from the high speed drive(s) and transmit the primary data to the client computing device. Because the primary data is already in the native format, no conversion operations are performed by the media agent, thereby reducing the restore delay.
H04L 67/5683 - Stockage des données fournies par les terminaux des utilisateurs, c.-à-d. mise en antémémoire inversée
H04L 67/1097 - Protocoles dans lesquels une application est distribuée parmi les nœuds du réseau pour le stockage distribué de données dans des réseaux, p. ex. dispositions de transport pour le système de fichiers réseau [NFS], réseaux de stockage [SAN] ou stockage en réseau [NAS]
H04L 67/565 - Conversion ou adaptation du format ou du contenu d'applications
87.
Hyper visor-independent reference copies of virtual machine payload data
Hypervisor-independent reference copies of virtual machine payload data based on block-level pseudo-mount infrastructure and techniques are generated and stored in an illustrative data storage management system. An illustrative hypervisor-independent reference copy includes one or more virtual-machine payload data files that originated from a first virtual machine. The hypervisor-independent virtual-machine-payload reference copy is governed by a distinct reference copy policy that controls retention, storage, tiering, scheduling, etc. for the reference copy, independently of how the illustrative system treats other virtual machine payload data files originating from the same virtual machine.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 11/32 - Surveillance du fonctionnement avec indication visuelle du fonctionnement de la machine
G06F 16/00 - Recherche d’informationsStructures de bases de données à cet effetStructures de systèmes de fichiers à cet effet
G06F 9/455 - ÉmulationInterprétationSimulation de logiciel, p. ex. virtualisation ou émulation des moteurs d’exécution d’applications ou de systèmes d’exploitation
Recovery points can be used for replicating a virtual machine and reverting the virtual machine to a different state. A filter driver can monitor and capture input/output commands between a virtual machine and a virtual machine disk. The captured input/output commands can be used to create a recovery point. The recovery point can be associated with a bitmap that may be used to identify data blocks that have been modified between two versions of the virtual machine. Using this bitmap, a virtual machine may be reverted or restored to a different state by replacing modified data blocks and without replacing the entire virtual machine disk.
G06F 12/00 - Accès à, adressage ou affectation dans des systèmes ou des architectures de mémoires
G06F 3/06 - Entrée numérique à partir de, ou sortie numérique vers des supports d'enregistrement
G06F 9/455 - ÉmulationInterprétationSimulation de logiciel, p. ex. virtualisation ou émulation des moteurs d’exécution d’applications ou de systèmes d’exploitation
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
An illustrative data storage management system comprises a management database that stores administrative preferences and system configurations, as well as results and/or statistics of completed secondary storage operations, i.e., information needed by the system to protect customers' data and to track and recover the protected data, including secondary copies such as backup copies, archive copies, etc. The disclosed data storage management system is configured to protect its own system data subject to a very aggressive (short) Recovery Point Objective (RPO), by using an innovative infrastructure that enables the system's storage manager to fail over to any number of other failover destination storage managers, each one comprising a destination management database. An illustrative database granularly tracks whether each and every transaction log file has been successfully applied to each and every destination management database to synchronize with the source management database.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
A system and method of deployment of malware detection traps by at least one processor may include performing a first interrogation of a first Network Asset (NA) of a specific NA family; determining, based on the interrogation, a value of one or more first NA property data elements of the first NA; obtaining one or more second NA property data elements corresponding to the specific NA family; integrating the one or more first NA property data elements and the one or more second NA property data elements to generate a template data element, corresponding to the specific NA family; producing, from the template data element, a malware detection trap module; and deploying, on one or more computing devices of a computer network, one or more instantiations of the malware detection trap module as decoys of the first NA.
G06F 21/56 - Détection ou gestion de programmes malveillants, p. ex. dispositions anti-virus
G06F 21/51 - Contrôle des utilisateurs, des programmes ou des dispositifs de préservation de l’intégrité des plates-formes, p. ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade du chargement de l’application, p. ex. en acceptant, en rejetant, en démarrant ou en inhibant un logiciel exécutable en fonction de l’intégrité ou de la fiabilité de la source
G06F 21/55 - Détection d’intrusion locale ou mise en œuvre de contre-mesures
G06F 21/57 - Certification ou préservation de plates-formes informatiques fiables, p. ex. démarrages ou arrêts sécurisés, suivis de version, contrôles de logiciel système, mises à jour sécurisées ou évaluation de vulnérabilité
91.
Distributed architecture for information management services in cloud environments
Distributed architecture for executing information management services using shared platform microservices, containerization techniques, and regional core services. This architecture decentralizes the traditional model by segmenting the various functions of the centralized control and information manager into modular cloud microservices. This modularization not only enhances system flexibility but also allows for a more dynamic configuration, with certain elements being deployable as containers. The resilient architecture leverages the inherent scalability and adaptability of cloud technology.
A hosting service enables streamlined scaling of features that relate to data storage management. The scaling is powered by deployment of microservices, each one directed to a discrete feature of a data storage management system. In addition to scaling on demand, the disclosed hosting service provides additional value-added features, such as streamlining intra-system handling, auditing, and reporting of logs generated by microservices; standardizing exception handling; mediating port assignments for co-located microservices to avoid collisions; streamlining formats for inter-microservice communications; streamlining local database access; etc. Advantageously, the disclosed solution off-loads the storage manager, and additionally improves system performance by scaling various functions and by streamlining interoperability among components. Furthermore, the disclosed solution also enables the hosting service in general, and each discrete microservice in particular, to be enhanced, deployed, and scaled separately and asynchronously from each other and from the storage manager.
An improved system architecture for scaling deployments of data management-as-a-service (DMaaS) distributes “job manager” functionality so that a large-scale data storage management system may be deployed in a cloud computing environment as DMaaS without experiencing performance bottlenecks that slow down core data protection operations at scale. The disclosed solution creates an infrastructure where job manager features run on any number of distinct machines or compute resources that act as local job managers. In the illustrative DMaaS, any number of components that scale horizontally (“the distributed components”) carry job management responsibility for storage management operations such as backup jobs, auxiliary copy jobs, archive jobs, etc. These distributed components are configured to perform locally as job managers and to see each storage management job through from beginning to end without centralized control. These distributed components or local job managers also maintain, collect, and locally store job metadata.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
94.
Scaled deployment of data protection resources for data originating in an application orchestrator
Data protection resources are automatically scaled to the needs of data source(s) in an application orchestrator computing environment, such as a cluster in a Kubernetes deployment. The approach is adaptable to data sources in production clusters or application suites that are not application orchestrator deployments, such as a cloud-based database-as-a-service (DBaaS). A data storage management system protects cluster-based data with an elastic number of data protection resources (e.g., data agents, media agents), which are deployed on demand. The number of data protection resources deployed for a particular job are appropriate to the workload(s) at present and depend on a variety of scaling factors. In some embodiments, data protection resources are deployed within the same cluster as the data sources. In other embodiments, a separate infrastructure cluster provides the data protection resources on demand, and connects to any number and types of data sources, whether cloud-based or otherwise, without limitation.
A distributed data storage system comprises features for integration with application orchestrators such as Kubernetes, and includes a proprietary Container Storage Interface (CSI) driver. Features include setting snapshot scheduling and retention policies, and a “container data mover” that replicates data from a source to a distinct destination distributed data storage system. The migration may be configured one-to-one, one-to-many, unidirectional, and/or bi-directional. Metadata-based snapshots and metadata-based changed block tracking identify payload data to move from source to destination within application orchestrator frameworks at both ends. Payload data is migrated from source to destination using different techniques than those used for migrating metadata, e.g., kernel-to-kernel for copying payload data versus ordinary metadata writes. An illustrative barrier logic ensures that the migration follows a controlled progression of operations.
In a running distributed data storage system that actively processes I/Os, metadata nodes are commissioned and decommissioned without taking down the storage system and without introducing interruptions to metadata or payload data I/O. The inflow of reads and writes continues without interruption even while new metadata nodes are in the process of being added and/or removed and the strong consistency of the system is guaranteed. Commissioning and decommissioning nodes within the running system enables streamlined replacement of permanently failed nodes and advantageously enables the system to adapt elastically to workload changes. An illustrative distributed barrier logic (the “view change barrier”) controls a multi-state process that controls a coordinated step-wise progression of the metadata nodes from an old view to a new normal. Rules for I/O handling govern each state until the state machine loop has been traversed and the system reaches its new normal.
G06F 15/173 - Communication entre processeurs utilisant un réseau d'interconnexion, p. ex. matriciel, de réarrangement, pyramidal, en étoile ou ramifié
G06F 9/455 - ÉmulationInterprétationSimulation de logiciel, p. ex. virtualisation ou émulation des moteurs d’exécution d’applications ou de systèmes d’exploitation
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06V 10/25 - Détermination d’une région d’intérêt [ROI] ou d’un volume d’intérêt [VOI]
G06V 10/34 - Lissage ou élagage de la formeOpérations morphologiquesSquelettisation
G06V 20/54 - Trafic, p. ex. de voitures sur la route, de trains ou de bateaux
G06V 20/59 - Contexte ou environnement de l’image à l’intérieur d’un véhicule, p. ex. concernant l’occupation des sièges, l’état du conducteur ou les conditions de l’éclairage intérieur
G06V 40/10 - Corps d’êtres humains ou d’animaux, p. ex. occupants de véhicules automobiles ou piétonsParties du corps, p. ex. mains
A data storage management system is enhanced to accommodate, and moreover to optimize, the storing and retention of deduplicated secondary copies at write-once read-many (WORM) enabled storage platforms. Enhancements include without limitation: user interface (UI) options to enable WORM functionality for secondary storage, whether used for deduplicated or non-deduplicated secondary copies; enhancements to secondary copy (e.g., deduplication copy, backup) operations; and pruning changes. The storage manager is generally responsible for managing the creation, tracking, and deletion of secondary copies, with and without deduplication. Media agents that store secondary copies to and prune them from the WORM-enabled storage platforms also are enhanced for communicating and interoperating with both bucket-level and object-level WORM-enabled storage platforms to implement the features disclosed herein.
G06F 16/215 - Amélioration de la qualité des donnéesNettoyage des données, p. ex. déduplication, suppression des entrées non valides ou correction des erreurs typographiques
Indexing preferences generally associate each data source with a type of indexing technology and/or with an index/catalog and/or with a computing device that hosts the index/catalog for tracking backup data generated from the source data. Indexing preferences govern which index/catalog receives transaction logs for a given storage operation. Thus, indexing destinations are defined granularly and flexibly in reference to the source data. Load balancing without user intervention assures that the various index/catalogs are fairly distributed in the illustrative backup systems by autonomously initiating migration jobs. Criteria for initiating migration jobs are based on past usage and going-forward trends. An illustrative migration job re-associates data sources with a different destination media agent and/or index/catalog, including transferring some or all relevant transaction logs and/or indexing information from the old host to the new host.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
G06F 11/20 - Détection ou correction d'erreur dans une donnée par redondance dans le matériel en utilisant un masquage actif du défaut, p. ex. en déconnectant les éléments défaillants ou en insérant des éléments de rechange
G06F 16/10 - Systèmes de fichiersServeurs de fichiers
G06F 16/11 - Administration des systèmes de fichiers, p. ex. détails de l’archivage ou d’instantanés
G06F 16/21 - Conception, administration ou maintenance des bases de données
H04L 41/08 - Gestion de la configuration des réseaux ou des éléments de réseau
99.
Enhanced network attached storage (NAS) services interfacing to cloud storage
An illustrative storage management appliance is interposed between client computing devices and one or more cloud storage resources. The appliance uses cloud storage resources in conjunction with a network attached storage device configured within the appliance to provide to the client computing devices seemingly unlimited network attached storage on respective network shares. The storage management appliance monitors data objects on the network shares and when a data object meets one or more criteria for archiving, the storage management appliance archives the data object to a cloud storage resource and replaces it with a stub and preview image on the network share. When access to the stub and/or preview image is detected, the storage management appliance restores the data object from the cloud storage resource. The criteria for archiving flexibly allow individual data objects to be archived to cloud storage without archiving frequently-accessed “neighboring” data objects on the same network share.
G06F 12/00 - Accès à, adressage ou affectation dans des systèmes ou des architectures de mémoires
G06F 3/06 - Entrée numérique à partir de, ou sortie numérique vers des supports d'enregistrement
G06F 16/00 - Recherche d’informationsStructures de bases de données à cet effetStructures de systèmes de fichiers à cet effet
H04L 67/1095 - Réplication ou mise en miroir des données, p. ex. l’ordonnancement ou le transport pour la synchronisation des données entre les nœuds du réseau
H04L 67/1097 - Protocoles dans lesquels une application est distribuée parmi les nœuds du réseau pour le stockage distribué de données dans des réseaux, p. ex. dispositions de transport pour le système de fichiers réseau [NFS], réseaux de stockage [SAN] ou stockage en réseau [NAS]
A method for automatically encrypting files is disclosed. In some cases, the method may be performed by computer hardware comprising one or more processors. The method can include detecting access to a first file, which may be stored in a primary storage system. Further, the method can include determining whether the access comprises a write access. In response to determining that the access comprises a write access, the method can include accessing file metadata associated with the first file and accessing a set of encryption rules. In addition, the method can include determining whether the file metadata satisfies the set of encryption rules. In response to determining that the file metadata satisfies the set of encryption rules, the method can include encrypting the first file to obtain a first encrypted file and modifying an extension of the first encrypted file to include an encryption extension.
G06F 21/62 - Protection de l’accès à des données via une plate-forme, p. ex. par clés ou règles de contrôle de l’accès
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
H04L 9/14 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité utilisant plusieurs clés ou algorithmes
G06F 21/70 - Protection de composants spécifiques internes ou périphériques, où la protection d'un composant mène à la protection de tout le calculateur
G06F 21/78 - Protection de composants spécifiques internes ou périphériques, où la protection d'un composant mène à la protection de tout le calculateur pour assurer la sécurité du stockage de données
brevets
