Virtual private cloud that provides enterprise grade functionality and compliance

• US 8,850,516 B1
• Filed: 06/22/2012
• Issued: 09/30/2014
• Est. Priority Date: 06/22/2011
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Hrebicek, Ondrej, Chung, Leonard
• Primary Examiner(s): Truong, Thanhnga B
• Application Number:
  US13/530,763
• Time in Patent Office: 830 Days
• Field of Search: 726/1, 726/7, 713150-151, 709/202, 709/248, 707/610
• US Class Current: 726/1
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/125 characterised by the use of retention policies retention policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/162 Delete operations erasing in storage systems G06F3/0652
• CPC Class Codes: G06F 16/1734 Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs
• CPC Class Codes: G06F 16/178 Techniques for file synchronisation in file systems
• CPC Class Codes: G06F 16/21 Design, administration or maintenance of databases
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Techniques to enforce policies with respect to managed files and/or endpoints are disclosed. A policy to be applied with respect to one or more files included in a synchronization set and/or an endpoint associated with the synchronization set is received. Compliance with the policy is ensured across a plurality of heterogeneous endpoints associated with the synchronization set.

Claims

1. A method of managing files, comprising:

receiving, at a file management system, a policy to be applied with respect to one or more of a file included in a synchronization set and an endpoint associated with the synchronization set; and

ensuring compliance with the policy across a plurality of heterogeneous endpoints associated with the synchronization set by determining the plurality of heterogeneous endpoints based at least in part on the policy and propagating the policy to one or more of the heterogeneous endpoints, wherein each of the one or more endpoints is configured to enforce at the endpoint policies received from the file management system.

2. The method of claim 1, wherein each of at least a subset of the endpoints is configured to store or can access at least a subset of the files to which the policy is to be applied.

3. The method of claim 1, wherein the policy comprises one or more of a retention policy, a security policy, and an access restriction policy.

4. The method of claim 1, wherein the policy restricts access to a file from one or more of the endpoints and wherein ensuring compliance with the policy includes preventing access to the file by the one or more endpoints at which access is restricted.

5. The method of claim 1, wherein the policy restricts access to a file under a prescribed condition and wherein ensuring compliance with the policy includes preventing access to the file under circumstances in which the prescribed condition is met.

6. The method of claim 1, wherein the policy comprises a retention policy and further comprising receiving a request to delete a file to which the retention policy applies, marking the file as deleted at one or more endpoints at which the file has been stored, and retaining a copy of the file until expiration of a retention period specified in the policy.

7. The method of claim 6, wherein the copy is stored centrally.

8. The method of claim 6, wherein the copy is stored, but not made visible to users, at one or more of the endpoints.

9. The method of claim 1, further comprising providing an administrative user interface to enable the policy to be defined or otherwise provided.

10. The method of claim 9, wherein the administrative user interface is configured to receive an identification of one or more files to which the policy is to be applied.

11. The method of claim 1, further comprising creating and storing an audit record or other data that evidences that a compliance action required by the policy has been performed.

12. The method of claim 1, further comprising taking, with respect to a file as stored a first endpoint, an action required by the policy and propagating an effect of the action to one or more other endpoints.

13. The method of claim 1, wherein the policy requires data associated with one or more of a file, a user, an endpoint, and a device to be deleted.

14. The method of claim 13, further comprising initiating remotely an operation to cause data associated with the file, user, endpoint, and device, as applicable, to be deleted.

15. The method of claim 14, further comprising associated file management system metadata to be updated or deleted.

16. A file management system, comprising:

a processor configured to;

receive a policy to be applied with respect to one or more of a file included in a synchronization set and an endpoint associated with the synchronization set; and

ensure compliance with the policy across a plurality of heterogeneous endpoints associated with the synchronization by determining the plurality of heterogeneous endpoints based at least in part on the policy and propagating the policy to one or more of the heterogeneous endpoints, wherein each of the one or more endpoints is configured to enforce at the endpoint policies received from the file management system; and

a memory or other storage device coupled to the processor and configured to store the policy.

17. The system of claim 16, wherein each of at least a subset of the endpoints is configured to store or can access at least a subset of the files to which the policy is to be applied.

18. The system of claim 16, wherein the policy restricts access to a file from one or more of the endpoints and wherein ensuring compliance with the policy includes preventing access to the file by the one or more endpoints at which access is restricted.

19. The system of claim 16, wherein the policy comprises a retention policy and further comprising receiving a request to delete a file to which the retention policy applies, marking the file as deleted at one or more endpoints at which the file has been stored, and retaining a copy of the file until expiration of a retention period specified in the policy.

20. A computer program product to manage files, the computer program product being embodied in a tangible, non-transitory computer readable storage medium and comprising computer instructions for:

receiving a policy to be applied with respect to one or more of a file included in a synchronization set and an endpoint associated with the synchronization set; and

ensuring compliance with the policy across a plurality of heterogeneous endpoints associated with the synchronization set by determining the plurality of heterogeneous endpoints based at least in part on the policy and propagating the policy to one or more of the heterogeneous endpoints, wherein each of the one or more endpoints is configured to enforce at the endpoint policies received from the file management system.