Cloud based dead drop for isolated recovery systems

• US 10,635,838 B1
• Filed: 07/31/2017
• Issued: 04/28/2020
• Est. Priority Date: 07/31/2017
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Inventors: Shemer, Jehuda, Natanzon, Assaf
• Primary Examiner(s): Abedin, Shanto
• Application Number:
  US15/664,901
• Time in Patent Office: 1,002 Days
• CPC Class Codes: G06F 11/1456 Hardware arrangements for backup
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2201/805 Real-time
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching

Abstract

A method and system for implementing a cloud-based dead drop for isolated recovery systems. Specifically, the disclosed method and system entail the interjection of an object store as an intermediate storage relay between a production system and an isolated recovery system. The object store minimizes, if not eliminates, the exposure of data secured in the isolated recovery system from external cyber threats and attacks, as well as launches the deployment of the isolated recovery system as a service that may support any system.

Claims

1. A method for storing data, comprising:

allocating, by an isolated recovery system (IRS), storage space in the IRS, wherein the IRS comprises a replicated data retriever operatively connected to an object repository of an intermediate object store (IOS);

reading an object from the object repository of the IOS for a production computing system (PCS) operatively connected to the IOS; and

writing object contents extracted from the object in the storage space,

wherein the IRS restricts the initiation of incoming connections from the IOS and the PCS to minimize exposure to cyber threats.

2. The method of claim 1, further comprising:

prior to reading the object from the IOS;

generating a hyper text transfer protocol secure (HTTPS) GET request comprising an object ID associated with the object; and

transmitting the HTTPS GET request to the IOS.

3. The method of claim 1, wherein the IRS and the PCS are co-located in a data center.

4. The method of claim 1, wherein the IRS is located in a public cloud computing environment.

5. The method of claim 1, wherein the object contents comprises a replicated data instance and replicated metadata describing the replicated data instance.

6. The method of claim 1, wherein the IRS is deployed as a service.

7. A system, comprising:

a production computing system (PCS);

an intermediate object store (IOS) comprising an object repository operatively connected to the PCS; and

an isolated recovery system (IRS) comprising a replicated data retriever operatively connected to the object repository, and programmed to;

allocate storage space in a persistent storage of the IRS;

read an object from the object repository; and

write object contents extracted from the object in the persistent storage,

wherein the IRS restricts the initiation of incoming connections from the IOS and the PCS to minimize exposure to cyber threats.

8. The system of claim 7,

wherein the IOS is programmed to:

receive a hyper text transfer protocol secure (HTTPS) GET request from the replicated data retriever;

identify the object of a plurality of objects stored in the object repository using the object ID;

extract the object contents from within the object; and

transmit the object contents to the replicated data retriever.

9. A non-transitory computer readable medium (CRM) comprising computer readable program code, which when executed by a computer processor, enables the computer processor to:

allocate, by an isolated recovery system (IRS), storage space in the IRS, wherein the IRS comprises a replicated data retriever operatively connected to an object repository of an intermediate object store (IOS);

read an object from the object repository of the IOS for a production computing system (PCS) operatively connected to the IOS; and

write object contents extracted from the object in the storage space,

wherein the IRS restricts the initiation of incoming connections from the IOS and the PCS to minimize exposure to cyber threats.

10. The non-transitory CRM of claim 9, further comprising additional computer readable program code, which when executed by the computer processor, enables the computer processor to:

prior to reading the object from the IOS;

generate a hyper text transfer protocol secure (HTTPS) GET request comprising an object ID associated with the object; and

transmit the HTTPS GET request to the IOS.

11. The non-transitory CRM of claim 9, wherein the IRS and the PCS are co-located in a data center.

12. The non-transitory CRM of claim 9, wherein the IRS is located in a public cloud computing environment.

13. The non-transitory CRM of claim 9, wherein the object contents comprises a replicated data instance and replicated metadata describing the replicated data instance.

14. The non-transitory CRM of claim 9, wherein the IRS is deployed as a service.