Security detection

Patent metadata

Field	Value
Publication number	US-9917854-B2
Application number	US-201514870135-A
Country	US
Kind code	B2
Filing date	Sep 30, 2015
Priority date	Sep 30, 2015
Publication date	Mar 13, 2018
Grant date	Mar 13, 2018

Abstract

A computer implemented method, computer program product and comprising rolling an image to a point in time in a protection window by applying write data using write metadata and examining read metadata, the write data, and the write metadata to determine if the image was accessed by an intruder.

First claim

What is claimed is:

1. A system comprising:
a replication image corresponding to a copy of a production image at a point in time, the production image comprising a copy of a logical storage unit of a storage system at a specific point in time;
a journal comprising copies of input/output (IO) requests to the storage system, the IO requests issued by an entity in communication with the storage system for at least a portion of a protection window, wherein the journal comprises read metadata, write data and write metadata; wherein at least one of the read metadata, write data, and write metadata is configured to convey information relating to at least one virtual machine that existed during at least a portion of the protection window; wherein the write data and write metadata enable the replication image to be rolled to different points in time within the protection window; wherein the write data corresponds to data of writes that occurred to the production image during the protection window, and wherein the read metadata denotes reads that occurred to the production image during the protection window; and
a protection agent configured to intercept, during the protection window, at least a portion of the IO requests to the production image and to replicate to a replication site a copy of the write data, write metadata, and read metadata corresponding to the IO, the replication site comprising the journal and replication image;
computer-executable logic operating in memory, wherein the computer-executable program logic is configured to cause execution across one or more processors of:
rolling the replication image to a first point in time in the protection window by applying the write data using the write metadata, the first point in time corresponding to a time within a first protection window during which the at least one virtual machine existed within the storage system, wherein the replication image is configured to enable access to the at least one virtual machine even if the at least one virtual machine has been deleted;
examining at least a portion of at least one of the read metadata, write data, and write metadata to determine if any suspicious activity relating to the production image occurred when the at least one virtual machine existed; and
generating, based on a positive determination, a user notification relating to at least one file suspected of being associated with the suspicious activity.

2. The system of claim 1 wherein the examining comprises determining at least one action taken by the at least one virtual machine during a period of time following the first point in time to which the replication image was rolled.

3. The system of claim 1 wherein the examining further comprises determining whether a file suspected of being associated with the suspicious activity was encrypted.

4. The system of claim 1 wherein the computer-executable program logic is configured to cause execution across one or more processors of determining what files on the production image were accessed, parsing a file system on the replication image for files and mapping read metadata to the files.

5. The system of claim 1 wherein the examining further comprises determining if a file of the production image was read from beginning to end by examining the read metadata.

6. The system of claim 1 wherein a list of files suspected to be stolen is created based at least in part on a determination of whether files on the production image were determined to have been read.

7. The system of claim 1 , wherein rolling the replication image to a first point in time further comprises restoring the at least one virtual machine that existed during the point in time.

8. The system of claim 1 , wherein the protection agent is configured to:
create a replica copy of a virtual machine file system (VMFS) containing the at least one virtual machine; and
replicate in the journal information sufficient to enable access to any point in time in a volume containing the at least one virtual machine, wherein the replica copy of the VMFS virtual machine file system is configured to enable access to the at least one virtual machine even if the at least one virtual machine has been deleted.

9. A computer implemented method comprising:
accessing a replication image corresponding to a copy of a production image at a specific point in time, the production image comprising a copy of a logical storage unit of a storage system at the specific point in time;
intercepting, during a protection window that encompasses the specific point in time, at least a portion of input/output (IO) requests to the production image from an entity in communication with the storage system for at least a portion of the protected window and replicating to a replication site a copy of write data, write metadata, and read metadata corresponding to the IO, the replication site comprising a journal and the replication image;
replicating to the journal at least a portion of information associated with the intercepted IO requests, the at least a portion of information comprising at least read metadata, write data, and write metadata, wherein at least on of the read metadata, write data, and write metadata is configured to convey information relating to at least one virtual machine that existed during at least a portion of the protection window, wherein the write data and write metadata enable the replication image to be rolled to different points in time within the protection window, wherein the write data corresponds to data of writes that occurred to the production image during the protection window, and wherein the read metadata denotes reads that occurred to the production image during the protection window;
rolling the replication image to a first point in time in the protection window by applying write data from a journal using write metadata from the journal, the first point in time corresponding to a time within a first protection window during which the at least one virtual machine existed within the storage system, wherein the replication image is configured to enable access to the at least one virtual machine even if the at least one virtual machine has been deleted;
examining at least a portion of at least one of the read metadata, write data, and write metadata to determine if any suspicious activity relating to the production image occurred when the at least one virtual machine existed; and
generating, based on a positive determination, a user notification relating to at least one file suspected of being associated with the suspicious activity.

10. The method of claim 9 wherein the examining comprises determining at least one action taken by the at least one virtual machine during a period of time following the first point in time to which the image was rolled.

11. The method of claim 9 wherein the examining further comprises determining whether a file suspected of being associated with the suspicious activity was encrypted.

12. The method of claim 9 further comprising determining what files on the production image were accessed, parsing a file system on the replication image for files and mapping read metadata to the files.

13. The method of claim 9 wherein the examining further comprises determining if a file of the production image was read from beginning to end by examining the read metadata.

14. The method of claim 9 further comprising creating a list of files suspected to be stolen based at least in part on a determination of whether files on the production image were determined to have been read.

15. A computer program product comprising:
a non-transitory compute

Assignees

• Emc Corp

Inventors

• Natanzon Assaf
• Derbeko Philip

Classifications

• G06F16/27 Primary

  Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor · CPC title

• G06F21/604 Primary

  Tools and structures for managing or administering access control systems · CPC title

• G06F11/1471

  involving logging of persistent data for recovery · CPC title

• G06F11/1446

  Point-in-time backing up or restoration of persistent data · CPC title

• G06F11/1458

  Management of the backup or restore process · CPC title