Automated separation of corporate and private data for backup and archiving

• US 8,626,714 B1
• Filed: 09/07/2011
• Issued: 01/07/2014
• Est. Priority Date: 09/07/2011
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Newstadt, Keith, Gibson, Douglas E.
• Primary Examiner(s): Woo, Isaac M
• Application Number:
  US13/227,151
• Time in Patent Office: 853 Days
• Field of Search: 707600-899
• US Class Current: 707/640
• CPC Class Codes: G06F 11/1451 by selection of backup contents
• CPC Class Codes: G06F 11/1456 Hardware arrangements for backup
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/21 Design, administration or maintenance of databases
• CPC Class Codes: G06F 16/285 Clustering or classification

Abstract

A computing device categorizes data items as a corporate data items when a first criterion is satisfied and as personal data items when a second criterion is satisfied. The computing device provides identified corporate data items to a first backup system that stores the corporate data items to a corporate data store. The computing device further provides identified personal data items to a second backup system that stores the personal data items to a personal data store.

Claims

1. A method comprising:

categorizing a plurality of data items by a computing device using a data loss prevention (DLP) system, wherein categorizing a data item of the plurality of data items comprises applying at least one of indexed document matching, exact data matching, described content matching or vector machine learning by the DLP system to determine whether the data item contains sensitive corporate information, and wherein the data item is categorized as a corporate data item responsive to one or more first criteria being satisfied and as a personal data item responsive to one or more second criteria being satisfied;

providing the plurality of corporate data items to a first backup system that stores the corporate data items to a corporate data store; and

providing the plurality of personal data items to a second backup system that stores the personal data items to a personal data store.

2. The method of claim 1, further comprising:

receiving a user designation of the second backup system and of authentication credentials to use for accessing the second backup system.

3. The method of claim 1, further comprising:

scanning previously backed up or archived data in the corporate data store;

separating out personal data items from the previously backed up or archived data;

storing the personal data items to the personal data store; and

deleting the personal data items from the corporate data store.

4. The method of claim 1, further comprising:

intercepting, by a file system filter driver, an attempt by the first backup system to access the plurality of data items; and

filtering out the personal data items from the plurality of data items so that only the corporate data items are accessible by the first backup system.

5. The method of claim 1, further comprising:

intercepting, by a file system filter driver, an attempt by the second backup system to access the plurality of data items; and

filtering out the corporate data items from the plurality of data items so that only the personal data items are accessible by the second backup system.

6. The method of claim 1, wherein categorizing a data item comprises:

assigning a rating to the data item indicating a likelihood that the data item is a corporate data item;

providing the data item to the first backup system if the rating is within a first rating range; and

providing the data item to the second backup system if the rating is within a second rating range.

7. The method of claim 1, wherein the categorizing comprises determining whether the data item contains sensitive corporate information, wherein the data item is categorized as a corporate data item if the data item contains sensitive corporate information.

8. A computer readable storage medium including instructions that, when executed by a processing device, cause the processing device to perform a method comprising:

categorizing a plurality of data items by the processing device using a data loss prevention (DLP) system, wherein categorizing a data item of the plurality of data items comprises applying at least one of indexed document matching, exact data matching, described content matching or vector machine learning by the DLP system to determine whether the data item contains sensitive corporate information, and wherein the data item is categorized as a corporate data item responsive to one or more first criteria being satisfied and as a personal data item responsive to one or more second criteria being satisfied;

performing a first operation to backup or archive the corporate data items onto a first data store; and

performing a second operation to backup or archive the personal data items onto a second data store that is different from the first data store.

9. The computer readable storage medium of claim 8, the method further comprising:

receiving a user designation of the second data store and of authentication credentials to use for accessing the second data store.

10. The computer readable storage medium of claim 8, the method further comprising:

scanning previously backed up or archived data in the first data store;

separating out personal data items from the previously backed up or archived data;

storing the personal data items to the second data store; and

deleting the personal data items from the first data store.

11. The computer readable storage medium of claim 8, the method further comprising:

intercepting, using a file system filter driver, an attempt by a backup system that backs up data to the first data store to access the plurality of data items; and

filtering out the personal data items from the plurality of data items so that only the corporate data items are accessible by the backup system.

12. The computer readable storage medium of claim 8, the method further comprising:

intercepting, using a file system filter driver, an attempt by a backup system that backs up data to the second data store to access the plurality of data items; and

filtering out the corporate data items from the plurality of data items so that only the personal data items are accessible by the backup system.

13. The computer readable storage medium of claim 8, wherein categorizing a data item comprises:

assigning a rating to the data item indicating a likelihood that the data item is a corporate data item;

providing the data item to the first data store if the rating is within a first rating range; and

providing the data item to the second data store if the rating is within a second rating range.

14. An apparatus comprising:

a memory to store instructions for a backup filter; and

a processing device, coupled to the memory, to execute the instructions, wherein the processing device is configured by the instructions to;

categorize a plurality of data items using a data loss prevention (DLP) system, wherein categorizing a data item of the plurality of data items comprises applying at least one of indexed document matching, exact data matching, described content matching or vector machine learning by the DLP system to determine whether the data item contains sensitive corporate information, and wherein the data item is categorized as a corporate data item responsive to one or more first criteria satisfied and as a personal data item responsive to one or more second criteria being satisfied;

provide the plurality of corporate data items to a first backup system that stores the corporate data items to a corporate data store; and

provide the plurality of personal data items to a second backup system that stores the personal data items to a personal data store.

15. The apparatus of claim 14, wherein the instructions further cause the processing device to:

scan previously backed up or archived data in the corporate data store;

separate out personal data items from the previously backed up or archived data;

store the personal data items to the personal data store; and

delete the personal data items from the corporate data store.

16. The apparatus of claim 14, wherein the instructions further cause the processing device to:

intercept, using a file system filter driver, an attempt by the first backup system to access the plurality of data items; and

filter out the personal data items from the plurality of data items so that only the corporate data items are accessible by the first backup system.

17. The apparatus of claim 14, wherein the instructions further cause the processing device to:

intercept, using a file system filter driver, an attempt by the second backup system to access the plurality of data items; and

filter out the corporate data items from the plurality of data items so that only the personal data items are accessible by the second backup system.

18. The apparatus of claim 14, wherein categorizing a data item comprises:

assigning a rating to the data item indicating a likelihood that the data item is a corporate data item;

providing the data item to the first backup system if the rating is within a first rating range; and

providing the data item to the second backup system if the rating is within a second rating range.