Virtual private cloud that provides enterprise grade functionality and compliance

• US 10,572,453 B2
• Filed: 01/26/2018
• Issued: 02/25/2020
• Est. Priority Date: 06/22/2011
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Inventors: Hrebicek, Ondrej, Chung, Leonard
• Primary Examiner(s): Truong, Thanhnga B
• Application Number:
  US15/881,028
• Publication Number:
  US 20180150475A1
• Time in Patent Office: 760 Days
• Field of Search: 726 1, 726 7, 726 22, 726 25, 713150, 713151, 713188, 709202, 709248, 709224, 707610
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/125 characterised by the use of retention policies retention policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/162 Delete operations erasing in storage systems G06F3/0652
• CPC Class Codes: G06F 16/1734 Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs
• CPC Class Codes: G06F 16/178 Techniques for file synchronisation in file systems
• CPC Class Codes: G06F 16/21 Design, administration or maintenance of databases
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Techniques to enforce policies with respect to managed files and/or endpoints are disclosed. A policy to be applied with respect to one or more files included in a synchronization set and/or an endpoint associated with the synchronization set is received. Compliance with the policy is ensured across a plurality of heterogeneous endpoints associated with the synchronization set.

Claims

1. A method of managing files, comprising:

obtaining, by one or more processors associated with a file management system that is connected to a plurality of endpoints via a network, a policy to be applied with respect to a synchronization set, wherein the plurality of endpoints are associated with the synchronization set and a plurality of computing systems respectively including one or more non-transitory computer-readable storage mediums, and wherein at least two of the plurality of endpoints have different types of native file stores; and

providing, by one or more processors associated with the file management system, the policy to at least a first one of the plurality of endpoints, wherein the first one of the plurality of endpoints enforces the policy in response to determining that a policy triggering event associated with one or more files in the synchronization set occurred.

2. The method of claim 1, further comprising:

obtaining, by the one or more processors associated with the file management system, an indication of the policy triggering event; and

synchronizing, by the one or more processors associated with the file management system, the one or more files in the synchronization set across at least a second one of the plurality of endpoints, wherein the one or more files in the synchronization set is synchronized based at least in part on the policy triggering event, and wherein one or more files in the synchronization set is synchronized in a manner based at least in part on a type of the native file store of the at least the second one of the plurality of endpoints.

3. The method of claim 1, wherein one or more files in the synchronization set is synchronized in a manner based at least in part on a capability of the at least the second one of the plurality of endpoints.

4. The method of claim 1, wherein the policy triggering event includes a request to access, create, change, or delete a file to which the policy applies.

5. The method of claim 1, wherein the policy restricts access to a file from one or more of the endpoints.

6. The method of claim 1, wherein enforcing the policy includes preventing access to the file by the one or more endpoints at which access is restricted.

7. The method of claim 1, wherein each of the plurality of endpoints is configured to enforce at the endpoint policies received from the file management system, including by responding in a manner prescribed by the policy to occurrence of a policy-triggering event defined in the policy.

8. The method of claim 1, wherein each of the plurality of endpoints is configured to store or can access at least a subset of files to which the policy is to be applied.

9. The method of claim 1, wherein the policy comprises one or more of a retention policy, a security policy, and an access restriction policy.

10. The method of claim 1, further comprising:

monitoring one or more of the plurality of endpoints to detect the occurrence of the policy-triggering event; and

responding to the occurrence of the policy triggering event by performing one or more operations prescribed by the policy.

11. The method of claim 1, wherein the policy prescribes restriction to access to a file upon the occurrence of the policy-triggering event, and wherein enforcing the policy includes preventing access to the file upon the occurrence of the policy-triggering event.

12. The method of claim 1, wherein:

the policy comprises a retention policy; and

in response to obtaining an indication of the policy-triggering event, a retention policy operation prescribed by the retention policy is performed.

13. The method of claim 1, wherein at least partially in response to the policy trigger event, the file is marked as deleted at one or more endpoints at which the file has been stored, and a copy of the file is retained until expiration of a retention period specified in the policy.

14. The method of claim 13, wherein the copy of the file is stored centrally.

15. The method of claim 13, wherein the copy is stored, but not made visible to users, at one or more of the endpoints.

16. The method of claim 1, further comprising:

providing an administrative user interface to enable the policy to be defined.

17. The method of claim 16, wherein the administrative user interface is configured to receive an identification of files to which the policy is to be applied.

18. The method of claim 1, further comprising:

creating and storing an audit record or other data that evidences that a compliance action required by the policy has been performed.

19. The method of claim 1, further comprising:

taking, with respect to a file as stored at the first one of the plurality of endpoints, an action required by the policy and propagating an effect of the action to one or more other endpoints of the plurality of endpoints.

20. The method of claim 1, wherein the policy requires data associated with one or more of a file, a user, an endpoint, and a device to be deleted.

21. The method of claim 1, further comprising:

initiating remotely an operation to cause data associated with a file, user, endpoint, and device, to be deleted.

22. The method of claim 21, wherein the operation causes associated file management system metadata to be updated or deleted.

23. The method of claim 1, wherein at least one of the plurality of endpoints corresponds to a network storage system that provides access to one or more files stored on the associated one or more non-transitory computer-readable storage medium.

24. The method of claim 23, wherein the network storage system is associated with a web service that provides a storage service that provides access to one or more files stored on the associated one or more non-transitory computer readable storage medium.

25. The method of claim 1, further comprising:

propagating, to one or more of the plurality of endpoints, a file in a native file format corresponding to the one or more of the plurality of endpoints, or

propagating, to one or more of the plurality of endpoints, an effect of an action to be taken on a file stored at the one or more of the plurality of endpoints, wherein the effect includes one or more commands for the action to be taken on the file based at least in part on the native file format corresponding to the one or more of the plurality of endpoints.

26. A file management system that is connected to a plurality of endpoints via a network, the file management system comprising:

one or more processors configured to;

obtain a policy to be applied with respect to a synchronization set, wherein the policy includes an indication of one or more policy triggering events, the policy triggering events including one or more permitted or restricted events relating to a file in the synchronization set, wherein the plurality of endpoints are associated with the synchronization set and a plurality of computing systems respectively including one or more non-transitory computer-readable storage mediums, and wherein at least two of the plurality of endpoints have different types of native file stores; and

providing, by one or more processors associated with the file management system, the policy to at least a first one of the plurality of endpoints, wherein the first one of the plurality of endpoints enforces the policy in response to determining that a policy triggering event associated with one or more files in the synchronization set occurred.

27. A computer program product to manage files, the computer program product being embodied in a tangible, non-transitory computer readable storage medium and comprising computer instructions for:

obtaining, by a file management system that is connected to a plurality of endpoints via a network, a policy to be applied with respect to a synchronization set, wherein the policy includes an indication of one or more policy triggering events, the policy triggering events including one or more permitted or restricted events relating to a file in the synchronization set, wherein the plurality of endpoints are associated with the synchronization set and a plurality of computing systems respectively including one or more non-transitory computer-readable storage mediums, and wherein at least two of the plurality of endpoints have different types of native file stores; and

providing, by one or more processors associated with the file management system, the policy to at least a first one of the plurality of endpoints, wherein the first one of the plurality of endpoints enforces the policy in response to determining that a policy triggering event associated with one or more files in the synchronization set occurred.