Discovering relationships using deduplication metadata to provide a value-added service

• US 9,305,007 B1
• Filed: 02/08/2013
• Issued: 04/05/2016
• Est. Priority Date: 02/08/2013
• Status: Active Grant

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Efstathopoulos, Petros, Sundaram, Sharada
• Primary Examiner(s): Park, Grace
• Application Number:
  US13/763,268
• Time in Patent Office: 1,152 Days
• Field of Search: 707/692
• US Class Current: 1/1
• CPC Class Codes: G06F 16/1748 De-duplication implemented within the file system, e.g. based on file segments de-duplication techniques in storage systems for the management of data blocks G06F3/0641

Abstract

A first computer system identifies deduplication metadata for files. The deduplication metadata includes block level information for the files. The first computer system determines relationships that are associated with the files based on the block level information and sends relationship data that describes the relationships that are associated with the files to a second computer system via a network.

Claims

1. A method comprising:

identifying deduplication metadata for a plurality of files, wherein the deduplication metadata comprises block level information for the plurality of files;

examining, by a first computer system, the deduplication metadata to discover a plurality of levels of relationships associated with the plurality of files based on at least the block level information;

creating relationship data describing the plurality of levels of relationships, wherein the plurality of levels comprises a level describing relationships between users of host machines that are used to access respective files; and

sending the relationship data describing the plurality of levels of relationships associated with the plurality of files to a second computer system providing a data loss protection service to cause a data loss protection operation to be performed based on the relationship data,

wherein examining the deduplication metadata comprises identifying files that are pointing to a same data segment, identifying host machines that are used to access the files that point to the same data segments, and identifying respective users that are associated with the host machines that are accessing the files.

2. The method of claim 1, wherein the plurality of files comprises at least one of a virtual machine image, compressed data, or archived data.

3. The method of claim 1, wherein the first computer system comprises a data storage backup system.

4. The method of claim 1, further comprising:

sending the relationship data to at least one of a discovery system, a data governance system, an auditing system, or a forensic system.

5. The method of claim 1, wherein to cause the data loss protection operation to be performed based on the relationship data comprises:

identifying a first file of the plurality of files, the first file satisfying criterion of the data loss protection service;

identifying, from the relationship data, a second file of the plurality of files being related to the first file; and

determining that the second file satisfies the criterion of the data loss protection service based on the second file being related to the first file.

6. A system comprising:

a computer system comprising;

a memory; and

a processing device coupled with the memory to;

identify deduplication metadata for a plurality of files,

the deduplication metadata comprises block level information for the plurality of files;

examine the deduplication metadata to discover a plurality of levels of relationships associated with the plurality of files based on at least the block level information;

create relationship data describing the plurality of levels of relationships, wherein the plurality of levels comprises a level describing relationships between users of host machines that are used to access respective files; and

send the relationship data describing the plurality of levels of relationships associated with the plurality of files to a second computer system providing a data loss protection service to cause a data loss protection operation to be performed based on the relationship data,

wherein examining the deduplication metadata comprises identifying files that are pointing to a same data segment, identifying host machines that are used to access the files that point to the same data segments, and identifying respective users that are associated with the host machines that are accessing the files.

7. The system of claim 6, wherein the plurality of files comprises at least one of a virtual machine image, compressed data, or archived data.

8. The system of claim 6, wherein the computer system comprises a data storage backup system.

9. The system of claim 6, wherein the processing device is further to:

send the relationship data to at least one of a discovery system, a data governance system, an auditing system, or a forensic system.

10. The system of claim 6, wherein to cause the data loss protection operation to be performed based on the relationship data, the processing device is to:

identify a first file of the plurality of files, the first file satisfying criterion of the data loss protection service;

identify, from the relationship data, a second file of the plurality of files being related to the first file; and

determine that the second file satisfies the criterion of the data loss protection service based on the second file being related to the first file.

11. A non-transitory computer readable storage medium including instructions that, when executed by a processing device on a first computer system, cause the processing device to perform operations comprising:

identifying deduplication metadata for a plurality of files, wherein the deduplication metadata comprises block level information for the plurality of files;

examining, by the processing device, the deduplication metadata to discover a plurality of levels of relationships associated with the plurality of files based on at least the block level information;

creating relationship data describing the plurality of levels of relationships, wherein the plurality of levels comprises a level describing relationships between users of host machines that are used to access respective files; and

sending the relationship data describing the plurality of levels of relationships associated with the plurality of files to a second computer system providing a data loss protection service to cause a data loss protection operation to be performed based on the relationship data,

wherein examining the deduplication metadata comprises identifying files that are pointing to a same data segment, identifying host machines that are used to access the files that point to the same data segments, and identifying respective users that are associated with the host machines that are accessing the files.

12. The non-transitory computer readable storage medium of claim 11, wherein the plurality of files comprises at least one of a virtual machine image, compressed data, or archived data.

13. The non-transitory computer readable storage medium of claim 11, wherein the first computer system comprises a data storage backup system.

14. The non-transitory computer readable storage medium of claim 11, the operations further comprising:

sending the relationship data to at least one of a discovery server, a data governance server, an auditing server, or a forensic server.

15. The non-transitory computer readable storage medium of claim 11, wherein the second processing device is to:

identify a first file of the plurality of files, the first file satisfying criterion of the data loss protection service;

identify, from the relationship data, a second file of the plurality of files being related to the first file; and

determine that the second file satisfies the criterion of the data loss protection service based on the second file being related to the first file.