Methods for securely facilitating data protection workflows and devices thereof

Patent metadata

Field	Value
Publication number	US-2020128024-A1
Application number	US-201916659227-A
Country	US
Kind code	A1
Filing date	Oct 21, 2019
Priority date	Oct 19, 2018
Publication date	Apr 23, 2020
Grant date	—

Abstract

Methods, non-transitory machine readable media, and computing devices that more securely facilitate data protection workflows are disclosed. With this technology, identification information for primary inbound and outbound queues is extracted from a registration token received from an administrator device. A registration request is inserted into the primary outbound queue using the identification information and one or more communication networks that are external to a data center. The primary inbound queue is polled using the identification information and the communication networks to retrieve messages from a backup service computing device that instantiated the queues and generated the registration token. Accordingly, nodes in a data center can communicate more securely with a cloud backup service via queues and without exposing any HTTP ports to the backup service. Advantageously, the backup service can learn the topology of a storage cluster and manage data protection workflows via communications with one of the constituent nodes.

First claim

What is claimed is:

1 . A method, comprising:
extracting, by a computing device in a data center, identification information for a primary inbound queue and a primary outbound queue from a registration token received from an administrator device; inserting, by the computing device, a registration request into the primary outbound queue using the identification information and one or more communication networks that are external to the data center; and polling, by the computing device, the primary inbound queue using the identification information and the one or more communication networks to retrieve one or more messages from a backup service computing device that instantiated the primary inbound queue and the primary outbound queue and generated the registration token.

2 . The method of claim 1 , wherein one of the messages comprises a topology request and the method further comprises inserting, by the computing device, an indication of one or more peer computing devices in a same storage cluster as the computing device into the primary outbound queue using the identification information and the communication networks.

3 . The method of claim 2 , further comprising communicating, by the computing device, with one of the peer computing devices, when one of the messages is determined to be directed to the one of the peer computing devices.

4 . The method of claim 1 , wherein the polling is periodic and the method further comprising extracting, by the computing device, additional identification information for a backup inbound and a backup outbound queue from the registration token when a threshold time period has elapsed without retrieval of a message from the outbound queue.

5 . The method of claim 1 , wherein one or more of the messages comprise instructions for one or more data protection tasks associated with backup versions of data maintained on one or more cloud storage devices.

6 . The method of claim 1 , wherein the identification information comprises addresses for the primary inbound queue and the primary outbound queue and the method further comprises communicating, by the computing device, indirectly with the backup service computing device via the primary inbound queue and the primary outbound queue using HyperText Transfer Protocol (HTTP) and without exposing an HTTP port to the backup service computing device.

7 . A non-transitory machine readable medium having stored thereon instructions for securely facilitating data protection workflows, the instructions comprising machine executable code that, when executed by at least one machine, causes the machine to:
extract identification information for a primary inbound queue and a primary outbound queue from a registration token received from an administrator device; insert a registration request into the primary outbound queue using the identification information and one or more communication networks that are external to the data center; and poll the primary inbound queue using the identification information and the one or more communication networks to retrieve one or more messages from a backup service computing device that instantiated the primary inbound queue and the primary outbound queue and generated the registration token.

8 . The non-transitory machine readable medium of claim 7 , wherein one of the messages comprises a topology request and the machine executable code, when executed by the machine, further causes the machine to insert an indication of one or more peer computing devices in a same storage cluster as the computing device into the primary outbound queue using the identification information and the communication networks.

9 . The non-transitory machine readable medium of claim 8 , wherein the machine executable code, when executed by the machine, further causes the machine to communicate with one of the peer computing devices, when one of the messages is determined to be directed to the one of the peer computing devices.

10 . The non-transitory machine readable medium of claim 7 , wherein the polling is periodic and the machine executable code, when executed by the machine, further causes the machine to extract additional identification information for a backup inbound and a backup outbound queue from the registration token when a threshold time period has elapsed without retrieval of a message from the outbound queue.

11 . The non-transitory machine readable medium of claim 7 , wherein one or more of the messages comprise instructions for one or more data protection tasks associated with backup versions of data maintained on one or more cloud storage devices.

12 . The non-transitory machine readable medium of claim 7 , wherein the identification information comprises addresses for the queues and the machine executable code, when executed by the machine, further causes the machine to communicate indirectly with the backup service computing device via the primary inbound queue and the primary outbound queue using HyperText Transfer Protocol (HTTP) and without exposing an HTTP port to the backup service computing device.

13 . A computing device, comprising:
a memory containing machine readable medium comprising machine executable code having stored thereon instructions for securely facilitating data protection workflows; and a processor coupled to the memory, the processor configured to execute the machine executable code to cause the processor to:
extract identification information for a primary inbound queue and a primary outbound queue from a registration token received from an administrator device;
insert a registration request into the primary outbound queue using the identification information and one or more communication networks that are external to the data center; and
poll the primary inbound queue using the identification information and the one or more communication networks to retrieve one or more messages from a backup service computing device that instantiated the primary inbound queue and the primary outbound queue and generated the registration token.

14 . The computing device of claim 13 , wherein one of the messages comprises a topology request and the processor is further configured to execute the machine executable code to further cause the processor to insert an indication of one or more peer computing devices in a same storage cluster as the computing device into the primary outbound queue using the identification information and the communication networks.

15 . The computing device of claim 14 , wherein the processor is further configured to execute the machine executable code to further cause the processor to communicate with one of the peer computing devices, when one of the messages is determined to be directed to the one of the peer computing devices.

16 . The computing device of claim 13 , wherein the polling is periodic and the processor is further configured to execute the machine executable code to further cause the processor to extract additional identification information for a backup inbound and a backup outbound queue from the registration token when a threshold time period has elapsed without retrieval of a message from the outbound queue.

17 . The computing device of claim 13 , wherein one or more of the messages comprise instructions for one or more data protection tasks associated with backup versions of data maintained on one or more cloud storage devices.

18 . The computing device of claim 13 , wherein the identification information comprises addresses for the queues and the processor is further configu

Assignees

• Netapp Inc

Inventors

• Kuramkote Ravindra
• Naidu Abhishek
• Ngan Paul
• Mu Paul Yuedong
• Pandit Atul

Classifications

• H04L67/1097 Primary

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• G06F2201/84

  Using snapshots, i.e. a logical point-in-time copy of the data · CPC title

• H04L63/126 Primary

  the source of the received data · CPC title

• G06F11/1464 Primary

  for networked environments · CPC title