Adaptable multi-layer storage with controlled restoration of protected data

Patent metadata

Field	Value
Publication number	US-2020409802-A1
Application number	US-201916456999-A
Country	US
Kind code	A1
Filing date	Jun 28, 2019
Priority date	Jun 28, 2019
Publication date	Dec 31, 2020
Grant date	—

Abstract

Methods and systems for improving data back-up, recovery, and search across different cloud-based applications, services, and platforms are described. A data management and storage system may direct compute and storage resources within a customer's cloud-based data storage account to back-up and restore data while the customer retains full control of their data. The data management and storage system may direct the compute and storage resources within the customer's cloud-based data storage account to generate and store secondary layers that are used for generating search indexes, to generate and store shared space layers and user specific layers to facilitate the deduplication of email attachments and text blocks, to perform a controlled restoration of email snapshots such that sensitive information (e.g., restricted keywords) located within stored snapshots remains protected, and to detect and preserve emails that were received or transmitted and then deleted between two consecutive snapshots.

First claim

What is claimed is:

1 . A method for operating a data management system, comprising:
acquiring an instruction from a user to restore a snapshot of a set of electronic files; acquiring a user specific layer corresponding with a first electronic file of the set of electronic files; identifying a first pointer to an attachment stored within a shared space layer using the user specific layer for the first electronic file; identifying a second pointer to a text block stored within the shared space layer using the user specific layer for the first electronic file; detecting that restoration of the attachment is authorized for the user; detecting that the text block includes a restricted keyword; detecting that restoration of the text block is not authorized for the user subsequent to detecting that the text block includes the restricted keyword; and restoring the first electronic file with the attachment and without outputting the restricted keyword.

2 . The method of claim 1 , wherein:
the restoring the first electronic file without outputting the restricted keyword includes restoring the first electronic file with a new keyword substituted in place of the restricted keyword.

3 . The method of claim 1 , further comprising:
outputting a message to the user in response to restoring the first electronic file with the attachment and without outputting the restricted keyword.

4 . The method of claim 1 , wherein:
the set of electronic files comprises a plurality of electronic messages.

5 . The method of claim 1 , wherein:
the detecting that restoration of the text block is not authorized for the user includes comparing the restricted keyword with a list of restricted keywords.

6 . The method of claim 1 , wherein:
the detecting that restoration of the text block is not authorized for the user includes detecting that the user does not have access permissions for data associated with the restricted keyword.

7 . The method of claim 1 , wherein:
the detecting that the text block includes the restricted keyword includes identifying that the text block is associated with a hash value that corresponds a restricted hash value.

8 . The method of claim 1 , wherein:
the restricted keyword corresponds with a codename.

9 . The method of claim 1 , wherein:
the attachment comprises an image file.

10 . The method of claim 1 , further comprising:
detecting a change in access permissions for the user; detecting that restoration of the text block is authorized for the user subsequent to detecting the change in access permissions for the user; and restoring the first electronic file of the set of electronic files with both the text block and the attachment.

11 . A data management system, comprising:
a memory configured to store a restricted keyword; and one or more processors in communication with the memory configured to acquire an instruction from a user to restore a snapshot of a set of electronic files corresponding with a state of the set of electronic files at a particular point in time, the one or more processors configured to acquire a user specific layer corresponding with a state of a first electronic file of the set of electronic files at the particular point in time, the one or more processors configured to identify a first pointer to an attachment stored within a shared space layer using the user specific layer corresponding with the state of the first electronic file at the particular point in time, the one or more processors configured to identify a second pointer to a text block stored within the shared space layer using the user specific layer corresponding with the state of the first electronic file at the particular point in time, the one or more processors configured to detect that restoration of the attachment is authorized for the user and detect that the text block includes the restricted keyword, the one or more processors configured to detect that restoration of the text block is not authorized for the user subsequent to detection that the text block includes the restricted keyword, the one or more processors configured to restore the first electronic file with the attachment and without the restricted keyword.

12 . The data management system of claim 11 , wherein:
the one or more processors configured to restore the first electronic file with a new keyword substituted in place of the restricted keyword.

13 . The data management system of claim 11 , wherein:
the one or more processors configured to transmit an alert message to the user subsequent to restoration of the first electronic file with the attachment and without the restricted keyword.

14 . The data management system of claim 11 , wherein:
the set of electronic files comprises a plurality of electronic messages.

15 . The data management system of claim 11 , wherein:
the one or more processors configured to detect that restoration of the text block is not authorized for the user via a comparison of the restricted keyword with a list of restricted keywords.

16 . The data management system of claim 11 , wherein:
the one or more processors configured to detect that restoration of the text block is not authorized for the user via detection that the user does not have access permissions for data associated with the restricted keyword.

17 . The data management system of claim 11 , wherein:
the one or more processors configured to detect that the text block includes the restricted keyword via detection that the text block is associated with a hash value that corresponds a restricted hash value.

18 . The data management system of claim 11 , wherein:
the attachment comprises a text file.

19 . The data management system of claim 11 , wherein:
the one or more processors configured to detect a change in access permissions for the user and detect that restoration of the text block is authorized for the user subsequent to the change in access permissions for the user, the one or more processors configured to restore the first electronic file of the set of electronic files with both the text block and the attachment.

20 . One or more storage devices containing processor readable code for programming one or more processors to perform a method for operating a data management system, the processor readable code comprising:
processor readable code configured to acquire an instruction from a user to restore a snapshot of a set of electronic files corresponding with a state of the set of electronic files at a particular point in time; processor readable code configured to acquire a user specific layer corresponding with a state of a first electronic file of the set of electronic files at the particular point in time; processor readable code configured to identify a first pointer to an attachment stored within a shared space layer using the user specific layer corresponding with the state of the first electronic file at the particular point in time; processor readable code configured to identify a second pointer to a text block stored within the shared space layer using the user specific layer corresponding with the state of the first electronic file at the particular point in time; processor readable code configured to detect that restoration of the attachment is authorized for the user; processor readable code configured to detect that the text block includes a restricted keyword; processor readable code configured to detect that restoration of the text block is not authorized for the u

Assignees

• Rubrik Inc

Inventors

• Lim Jihang
• Moldvai Noel

Classifications

• G06F11/1464

  for networked environments · CPC title

• G06F2201/815

  Virtual · CPC title

• G06F16/128

  Details of file system snapshots on the file-level, e.g. snapshot creation, administration, deletion (error detection or correction of the data by redundancy in operations or in hardware G06F11/14, G06F11/16) · CPC title

• G06F11/1451

  by selection of backup contents · CPC title

• G06F2201/84

  Using snapshots, i.e. a logical point-in-time copy of the data · CPC title