System and method for storage operation access security

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 8,880,466
App. No.: 14/226,442
Granted: Nov 4, 2014
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

A method and system for controlling access to stored data is provided. The storage access control system leverages a preexisting security infrastructure of a system to inform the proper access control that should be applied to data stored outside of its original location, such as a data backup. The storage access control system may place similar access control restrictions on the backup files that existed on the original files. In this way, the backed up data is given similar protection as that of the original data.

Claims (54)

1. At least one non-transitory, computer-readable storage medium carrying instructions, which when executed by at least one data processor, manages data in a data management system, wherein the data management system manages secondary copies of data files, comprising:

for at least one user of the data management system, adding the user to a previously created group within the data management system,

wherein the group associates one or more users with at least one data management right related to storage operations for the secondary copies of data files;

receiving a request from the user to perform a data management operation,

wherein the data management operation includes a read or write operation with respect a secondary copy of a production data file, and

wherein the secondary copy is used to restore production data from the production file from which the secondary copy is created;

causing a security system to be queried to determine data management rights of the user,

wherein the data management rights include the user's rights to access the production data file, and,

causing the requested data management operation to be performed when the data management rights permit the data management operation,

wherein the data management rights permit the data management system to perform the data management operation if the production data file is associated with an acceptable one or more computers;

wherein adding the user to the created group within the data management system includes associating the user with the created group in the security system; and

wherein causing the requested data management operation to be performed includes determining data users within the group can access.

2. The non-transitory, computer-readable storage medium of claim 1 wherein a user of the data management system who does not have privileges to create new users within the data management system adds the user to the created group within the data management system, and wherein secondary copy storage is external from and remote to production data storage.

3. The non-transitory, computer-readable storage medium of claim 1 , further comprising querying the security system to determine an email address associated with the user.

4. The non-transitory, computer-readable storage medium of claim 1 wherein the at least one user is a security group that contains multiple users and wherein adding an identified user adds all users within the group.

5. The non-transitory, computer-readable storage medium of claim 1 wherein an administrator of the data management system does not have access rights to create new users within the data management system.

6. The non-transitory, computer-readable storage medium of claim 1 wherein an administrator of the data management system does not have data management rights to create new users within the security system.

7. The non-transitory, computer-readable storage medium of claim 1 , further including querying the security system to determine an email address associated with the user such that the email address can be used by the data management system to provide an email update to the user regarding the status of a storage operation.

8. The non-transitory, computer-readable storage medium of claim 1 wherein adding the identified at least one user to the created group within the data management system comprises storing a reference within the created group to a record associated with the user in the security system.

9. A method of managing access to data in a data management system that is configured to manage secondary copies of data files, the method comprising:

receiving a query request from a user to access data files stored within the data management system,

wherein the data files are secondary copies of production data files, and

wherein the secondary copies are used to restore production data from the production files from which the secondary copies are created;

obtaining query results based on the received query, wherein the query results include first and second sets of data files, and metadata associated with the first and second sets of data files;

causing a security system to be queried to determine data management rights of the user,

wherein the data management rights include the user's right to access the production data files,

wherein the user is associated with a previously created group within the data management system, and,

wherein the group associates one or more users with at least one data management right for performing data management operations;

determining that the data management rights indicate the user's right to access the first set of data files, but not to access the second set of data files;

providing for display to the user the metadata for the first set of data files, wherein the user is permitted to perform data management operations with respect to the first set of data files; and

providing for display to the user the metadata for the second set of data files, but not permitting the user to access or perform data management operations with respect to the second set of data files,

wherein at least one of the steps is performed by a computer.

10. The method of claim 9 , wherein the method further comprises querying the security system to determine an email address associated with the user.

11. The method of claim 9 , further including querying the security system to determine an email address associated with the user such that the email address can be used by the data management system to provide an email update to the user regarding a status of a storage operation.

12. The method of claim 9 wherein causing the security system to be queried to determine the data management rights includes determining one or more computers through which the user has access,

wherein the data management rights permit the data management system to perform the requested data management operation if the production data file is associated with one of the determined one or more computers; and,

wherein the at least one data management right for performing data management operations determines which data a user within the group can access.

13. At least one non-transitory, computer-readable storage medium carrying instructions, which when executed by at least one data processor, manages access to data in a data management system that is configured to manage secondary copies of data files, comprising: