Protect cloud objects from attacks
A lock is applied automatically without any user involvement, to each of one or more data objects stored by the data processing system. Each of the one or more locks prevent deletion, by any user, of the one or more data objects within a predetermined time frame. A cloud garbage collector marks the one or more data objects for a) deletion, or b) for lock extension, the garbage collector scheduled to run periodically at a period that is less than the predetermined time frame. The deletion or the lock extension is executed for the one or more data objects, based on marks by the garbage collector. Other embodiments are described and claimed.
1. A computer-implemented method, comprising:
applying a lock to each of one or more data objects stored by a networked computing device, each of the one or more locks preventing deletion, by any user, of the one or more data objects within a predetermined time frame;
marking, with a garbage collector, the one or more data objects for a) deletion, or b) for lock extension, the garbage collector scheduled to run periodically at a period that is less than the predetermined time frame; and
executing the deletion or the lock extension for the one or more data objects, based on marks by the garbage collector.
2. The method of claim 1 , wherein executing the deletion or the lock extension of the one or more data objects is performed with one or more independent background threads, separate from the garbage collector.
3. The method of claim 1 , wherein, in response to execution of a manual garbage collector, the lock extension is not performed, unless the manual garbage collector is executed in response to a failure of the garbage collector that is scheduled to run periodically where the one or more data objects expire before a next scheduled garbage collector run, or based on configuration of a lock extension setting.
4. The method of claim 1 , wherein the garbage collector that is scheduled to run periodically is locked to prevent cancellation.
5. The method of claim 4 , wherein if an input is received to modify the period of the garbage collector that is within an upper limit, then a first garbage collection run after the input is received is performed based on the period, and subsequent garbage collection runs are performed based on the modified period.
6. The method of claim 1 , wherein the predetermined time frame is greater than a sum of a) the period, and b) an estimated or calculated time to perform garbage collection of the one or more data objects.
7. The method of claim 1 , wherein the predetermined time frame is an expiration of each of the one or more locks that is common to all data objects stored, including new data objects that are created between adjacent garbage collector runs.
8. A non-transitory computer-readable medium storing instructions which, when executed by one or more processors of a networked computing device, cause the computing device to perform operations comprising:
applying a lock to each of one or more data objects stored by the networked computing device, each of the one or more locks preventing deletion, by any user, of the one or more data objects within a predetermined time frame;
marking, with a garbage collector, the one or more data objects for a) deletion, or b) for lock extension, the garbage collector scheduled to run periodically at a period that is less than the predetermined time frame; and
executing the deletion or the lock extension for the one or more data objects, based on marks by the garbage collector.
9. The non-transitory computer-readable medium of claim 8 , wherein executing the deletion or the lock extension of the one or more data objects is performed with one or more independent background threads, separate from the garbage collector.
10. The non-transitory computer-readable medium of claim 8 , wherein, in response to execution of a manual garbage collector, the lock extension is not performed, unless the manual garbage collector is executed in response to a failure of the garbage collector that is scheduled to run periodically where the one or more data objects expire before a next scheduled garbage collector run, or based on configuration of a lock extension setting.
11. The non-transitory computer-readable medium of claim 8 , wherein the garbage collector that is scheduled to run periodically is locked to prevent cancellation.
12. The non-transitory computer-readable medium of claim 11 , wherein if an input is received to modify the period of the garbage collector that is within an upper limit, then a first garbage collection run after the input is received is performed based on the period, and subsequent garbage collection runs are performed based on the modified period.
13. The non-transitory computer-readable medium of claim 8 , wherein the predetermined time frame is greater than a sum of a) the period, and b) an estimated or calculated time to perform garbage collection of the one or more data objects.
14. The non-transitory computer-readable medium of claim 8 , wherein the predetermined time frame is an expiration of each of the one or more locks that is common to all data objects stored, including new data objects that are created between adjacent garbage collector runs.
15. A data processing system, comprising:
computer-readable memory; and
a processor that executes instructions stored on the computer-readable memory, causing the data processing system to perform operations including:
applying a lock to each of one or more data objects stored by the data processing system, each of the one or more locks preventing deletion, by any user, of the one or more data objects within a predetermined time frame;
marking, with a garbage collector, the one or more data objects for a) deletion, or b) for lock extension, the garbage collector scheduled to run periodically at a period that is less than the predetermined time frame; and
executing the deletion or the lock extension for the one or more data objects, based on marks by the garbage collector.
16. The data processing system of claim 15 , wherein executing the deletion of the lock extension or the one or more data objects is performed with one or more independent background threads, separate from the garbage collector.
17. The data processing system of claim 15 , wherein, in response to execution of a manual garbage collector, the lock extension is not performed, unless the manual garbage collector is executed in response to a failure of the garbage collector that is scheduled to run periodically where the one or more data objects expire before a next scheduled garbage collector run, or based on configuration of a lock extension setting.
18. The data processing system of claim 15 , wherein the garbage collector that is scheduled to run periodically is locked to prevent cancellation.
19. The data processing system of claim 15 , wherein if an input is received to modify the period of the garbage collector that is within an upper limit, then a first garbage collection run after the input is received is performed based on the period, and subsequent garbage collection runs are performed based on the modified period.
20. The data processing system of claim 15 , wherein the predetermined time frame is greater than a sum of a) the period, and b) an estimated or calculated time to perform garbage collection of the one or more data objects.