Copy data management with data security

Patent metadata

Field	Value
Publication number	US-9880757-B1
Application number	US-201514666137-A
Country	US
Kind code	B1
Filing date	Mar 23, 2015
Priority date	Mar 23, 2015
Publication date	Jan 30, 2018
Grant date	Jan 30, 2018

Abstract

The present disclosure provides systems and methods for automatically provisioning the security profile for production data to copy data. In some instances the security provisioning for the copy data is made at the time the production data is copied. In other instances, the security provisioning occurs in a secondary application using the copy data.

First claim

What is claimed is:

1. A computer-implemented method for automating security provisioning for copy data, at least a portion of the method being performed by a computing system comprising at least one computer processor, the method comprising:
identifying production data associated with a primary application operating in an enterprise computing environment;
determining that a logical copy of the production data associated with the primary application is to be used for a secondary application operating within a virtual machine of the enterprise environment;
identifying a security orchestration system that maintains an enterprise rules engine, wherein:
the enterprise rules engine utilizes a set of enterprise security rules to determine, based on security metadata in an information fabric, security provisioning to implement for logical copies of production data within the enterprise computing environment; and
the information fabric receives the security metadata from an information provisioning orchestration system that continually collects data and metadata about the enterprise computing environment, wherein the security metadata is based on the continually collected data and metadata;

using the security orchestration system to identify, from the set of enterprise security rules, an enterprise security rule indicating a level of security, required for the production data associated with the primary application, that needs to be provisioned for secondary applications that use logical copies of the production data; and
in response to identifying the enterprise security rule, implementing a security provisioning action set forth in the enterprise security rule such that the production data associated with the primary application and the logical copy of the production data are protected with the same level of security, wherein the security provisioning action comprises:
allocating, for the secondary application, the logical copy data in the virtual machine; and
at least one of:
automatically deploying one or more security products in the virtual machine to effect the identified level of security; and
automatically configuring one or more security products in the virtual machine to effect the identified level of security.

2. The method according to claim 1 , wherein the security metadata includes metadata about network positioning of the secondary application.

3. The method according to claim 2 , wherein the network positioning is private facing such that the secondary application runs internally within an enterprise associated with the secondary application.

4. The method according to claim 2 , wherein the positioning of the secondary application is public facing such that the secondary application is available on the internet for public use.

5. The method according to claim 1 , wherein:
determining that the logical copy of the production data is to be used for the secondary application comprises determining that the information provisioning orchestration system has received a request to allocate the logical copy of the production data for use by the secondary application;
using the security orchestration system to identify the enterprise security rule comprises using the security orchestration system to identify the enterprise security rule in response to determining that the information provisioning orchestration system has received the request; and
the information provisioning orchestration system implements the security provisioning action set forth in the enterprise security rule as part of allocating the logical copy of the production data for use by the secondary application.

6. The method according to claim 1 , wherein:
an enterprise associated with the enterprise computing environment comprises a plurality of organizations that operate within the enterprise; and
the security metadata includes at least one of:
metadata about an organization within the enterprise responsible for the secondary application; and
metadata about an organization within the enterprise responsible for the primary application.

7. The method according to claim 1 , wherein:
at least one of the primary application and the secondary application comprises a complex structure that includes a plurality of processes running on a plurality of servers; and
the security metadata includes metadata about diversity associated with at least one of the primary application and the secondary application that describes the complex structure of at least one of the primary application and the secondary application.

8. The method according to claim 1 , wherein the security provisioning action further comprises initiating the setting of security policies in security software running in the secondary application.

9. The method according to claim 1 , wherein the secondary application represents at least one of:
a data science application using the logical copy of the production data to test applications in a test and development environment;
a business intelligence application intending to perform services on the production data;
a disaster recovery application using the logical copy of the production data to enable retrieval of the production data in the event of a disaster associated with a primary computing environment of the production data;
an application using the logical copy of the production data for archiving purposes; and
an application using the logical copy of the production data for auditing purposes.

10. The method according to claim 1 , wherein the security metadata includes metadata about organization ownership.

11. A system for automating security provisioning for copy data, the system comprising:
an information fabric, stored in memory, containing security metadata associated with production data used by a primary application operating in an enterprise computing environment, wherein:
the information fabric receives the security metadata from an information provisioning orchestration system that continually collects data and metadata about the enterprise computing environment;
the security metadata is based on the continually collected data and metadata;

a security orchestration system, stored in memory, that:
maintains an enterprise rules engine that utilizes a set of enterprise security rules to determine, based on the security metadata in the information fabric, security provisioning to implement for logical copies of production data within the enterprise computing environment;
determines that a logical copy of the production data is to be used for a secondary application operating within a virtual machine of the enterprise computing environment;
identifies, from the set of enterprise security rules, an enterprise security rule indicating a level of security, required for the production data associated with the primary application, that needs to be provisioned for secondary applications that use logical copies of the production data; and
in response to identifying the enterprise security rule, implements a security provisioning action set forth in the enterprise security rule such that the production data associated with the primary application and the logical copy of the production data to be used for the secondary application are protected with the same level of security, wherein the security provisioning action comprises:
allocating, for the secondary application, the logical copy data in the virtual machine; and
at least one of:
automatically deploying one or more security products in the virtual machine to effect the identified level of security; and
automatically configuring one or more security products in the virtual machine to effect the identified level of security; and

Assignees

• Symantec Corp

Inventors

• Banerjee Deb
• Vranyes Steven A

Classifications

• G06F21/57 Primary

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F12/14

  Protection against unauthorised use of memory {or access to memory} · CPC title

• G06F3/0619 Primary

  in relation to data integrity, e.g. data losses, bit errors · CPC title

• G06F3/065

  Replication mechanisms · CPC title

• G06F3/067

  Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS] · CPC title