Aggregation of policy information for principals associated with a file system

Patent metadata

Field	Value
Publication number	US-12423458-B2
Application number	US-202318502625-A
Country	US
Kind code	B2
Filing date	Nov 6, 2023
Priority date	Nov 6, 2023
Publication date	Sep 23, 2025
Grant date	Sep 23, 2025

Abstract

Methods, systems, and devices for data management are described. A data management system (DMS) may obtain a snapshot of a file system that includes multiple files and permission sets associated with the files. A permission set may indicate one or more access approvals for associated principals. The DMS may scan the files to identify unique pairs each including a unique combination of a respective permission set and a respective sensitive information type. The DMS may store a first mapping that maps the unique pairs to respective values that indicate an amount of sensitive information, of the respective sensitive information type, that is included in one or more files associated with the unique pair. The DMS may identify a respective set of sensitive data types included in files to which a principal has access based on the first mapping and an evaluation of the permission sets.

First claim

What is claimed is:

1. A method, comprising:
obtaining, by a data management system, a snapshot of a file system, wherein the file system comprises a plurality of files and a plurality of permission sets, and wherein the plurality of permission sets indicate, for respective files of the plurality of files, one or more access approvals for one or more associated principals from among a plurality of principals associated with the file system;
scanning, by the data management system, the plurality of files to identify unique pairs, wherein a unique pair comprises a unique combination of a respective permission set and a respective sensitive information type, and wherein a file of the plurality of files is associated with a respective unique pair based at least in part on a permission set for the file and a sensitive information type included in the file respectively matching the respective permission set for the unique pair and the respective sensitive information type for the unique pair;
storing, by the data management system, a first mapping that maps the unique pairs to respective values, wherein a respective value for a unique pair is indicative of an amount of sensitive information, of the respective sensitive information type for the unique pair, that is included in one or more files associated with the unique pair; and
identifying, by the data management system, based at least in part on the first mapping and an evaluation of the plurality of permission sets, a respective set of sensitive data types included in files to which a principal from among the plurality of principals has access.

2. The method of claim 1 , further comprising:
receiving, by the data management system, a query that requests security information for the principal, wherein identifying the respective set of sensitive data types occurs in response to the query; and
outputting, by the data management system, an indication of the respective set of sensitive data types included in the files to which the principal has access in response to the query.

3. The method of claim 1 , further comprising:
performing, by the data management system, a plurality of iterations of a sensitive information scanning operation to generate the first mapping, wherein performing an iteration of the plurality of iterations of the sensitive information scanning operation comprises:
scanning a content table included in the snapshot to identify, from among the plurality of files, a set of one or more files that include a first sensitive information type of a first unique pair;
scanning file system metadata included in the snapshot to identify, from among the set of one or more files identified from the content table, a subset of one or more files associated with a first permission set of the first unique pair; and
incrementing a value that is mapped to the unique pair via the first mapping based at least in part on respective weights included in the content table that indicate amounts of sensitive information, of the first sensitive information type, that is included in the subset of one or more files, wherein the value is one of the respective values included in the first mapping.

4. The method of claim 3 , wherein performing the iteration of the plurality of iterations of the sensitive information scanning operation further comprises:
incrementing a second value that is mapped to the unique pair via the first mapping based at least in part on a quantity of files included in the subset of one or more files.

5. The method of claim 1 , wherein:
performing the evaluation of the plurality of permission sets comprises identifying, by the data management system and from among the plurality of principals, respective sets of one or more principals that are included in the plurality of permission sets; and
the method further comprises storing, by the data management system, a second mapping that maps the plurality of principals to the respective values for one or more sensitive information types based at least in part on the evaluation of the plurality of permission sets and further based at least in part on the first mapping, wherein identifying the respective set of sensitive data types included in the files to which the principal has access is further based at least in part on the second mapping.

6. The method of claim 5 , wherein generating the second mapping comprises:
identifying, by the data management system, based at least in part on evaluating the plurality of permission sets, a set of one or more entries in the first mapping that are associated with a first sensitive information type and with a permission set that includes a first principal from among the plurality of principals;
identifying, by the data management system, a second entry in the second mapping that is associated with the first principal and the first sensitive information type; and
incrementing, by the data management system and by an amount that is based at least in part on a first value included in the set of one or more entries in the first mapping, a respective score for the first principal that is associated with the first sensitive information type, the respective score included in the second entry.

7. The method of claim 5 , wherein:
the second mapping maps the plurality of principals to the respective values for the one or more sensitive information types and to respective second values;
a respective value for a principal is indicative of an amount of sensitive information, of a respective sensitive information type, that is included in one or more files to which the principal has access; and
a respective second value for the principal is indicative of a quantity of files including information of the respective sensitive information type to which the principal has access.

8. The method of claim 1 , wherein storing the first mapping comprises:
storing, by the data management system, a table that maps the unique pairs to the respective values.

9. An apparatus, comprising:
one or more memories storing processor-executable code; and
one or more processors coupled with the one or more memories and individually or collectively operable to execute the code to cause the apparatus to:
obtain, by a data management system, a snapshot of a file system, wherein the file system comprises a plurality of files and a plurality of permission sets, and wherein the plurality of permission sets indicate, for respective files of the plurality of files, one or more access approvals for one or more associated principals from among a plurality of principals associated with the file system;
scan, by the data management system, the plurality of files to identify unique pairs, wherein a unique pair comprises a unique combination of a respective permission set and a respective sensitive information type, and wherein a file of the plurality of files is associated with a respective unique pair based at least in part on an access control list set for the file and a sensitive information type included in the file respectively matching the respective permission set for the unique pair and the respective sensitive information type for the unique pair;
store, by the data management system, a first mapping that maps the unique pairs to respective values, wherein a respective value for a unique pair is indicative of an amount of sensitive information, of the respective sensitive information type for the unique pair, that is included in one or more files associated with the unique pair; and
identify, by the data management system, based at least in part on the first mapping and an evaluation of the plurality of permission sets, a respective set of sensitive data types included in files to which a principal from among the pluralit

Assignees

• Rubrik Inc

Inventors

• Muniraju Muraliraja
• Malpani Mudit
• Botelho Fabiano
• Kotadia Nandish
• SINGH Akhil
• Gee Adam

Classifications

• G06F16/128 Primary

  Details of file system snapshots on the file-level, e.g. snapshot creation, administration, deletion (error detection or correction of the data by redundancy in operations or in hardware G06F11/14, G06F11/16) · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F21/6227 Primary

  where protection concerns the structure of data, e.g. records, types, queries · CPC title