Restricted data transfer
One example method includes receiving, by a first computing entity from a second computing entity, a request for data, providing, by the first computing entity, a compliance API (Application Program Interface) to the second computing entity, receiving, by the first computing entity from the second computing entity, location information and/or data compliance information, by way of the compliance API, consulting, by the first computing entity, a mapping, and determining, based on information in the mapping and the location information and/or data compliance information, whether or not the data is permitted to be transmitted by the first computing entity to the second computing entity, and either transmitting the data to the second computing entity, or not transmitting the data to the second computing entity, based on data tags, the information in the mapping and the location information and/or data compliance information.
1. A method performed by a backup application, said method comprising:
setting a compliance lock for a primary volume of the backup application, wherein the compliance lock is set using a compliance API (Application program interface) provided by a storage device, and wherein the compliance lock prevents requests to copy or replicate the primary volume;
adding an additional tag to the compliance lock;
receiving, from the storage device, a request for data controlled by the backup application;
providing access to the compliance API to the storage device;
receiving from the storage device, location information and/or data compliance information by way of the compliance API;
consulting a mapping and determining, based on information in the mapping and the data compliance information, whether or not the data is permitted to be transmitted by the backup application to the storage device;
when the data compliance information and the additional tag both indicate that transmission of the data is permitted, transmitting the data to the storage device; and
when the data compliance information indicates the transmission of the data is permitted but the additional tag indicates the transmission of the data is not permitted, preventing the transmission of the data to the storage device such that the additional tag is independently evaluated relative to the data compliance information and such that the transmission of the data occurs when both the data compliance information and the additional tag indicate the transmission of the data is permitted.
2. The method as recited in claim 1 wherein transmitting the data comprises transferring the data, or replicating the data.
3. The method as recited in claim 1 , wherein the data is tagged with a geo tag and/or a compliance tag.
4. The method as recited in claim 3 , wherein the geo tag indicates a geographical location to which the data is permitted to be transmitted, and the compliance tag indicates a data compliance standard that governs handling of the data.
5. The method as recited in claim 1 , wherein the backup application and the storage device have a trust relationship with each other.
6. The method as recited in claim 1 , wherein the storage device comprises a mapping that relates a volume of the storage device to a particular geographical location and/or to a particular data compliance standard.
7. The method as recited in claim 1 , wherein the mapping consulted by the backup application relates the primary volume of the backup application to a particular geographical location and/or to a particular data compliance standard.
8. The method as recited in claim 1 , wherein the data comprises a saveset created by a backup application.
9. The method as recited in claim 1 , wherein the additional tag indicates a geographical location, from which backup data was generated.
10. The method as recited in claim 1 , wherein the additional tag is independent of a data compliance standard that governs handling of the data.
11. A non-transitory computer readable storage medium having stored therein instructions that are executable by one or more hardware processors to cause a backup application to perform operations comprising:
setting a compliance lock for a primary volume of the backup application, wherein the compliance lock is set using a compliance API (Application program interface) provided by a storage device, and wherein the compliance lock prevents requests to copy or replicate the primary volume;
adding an additional tag to the compliance lock;
receiving, from the storage device, a request for data controlled by the backup application;
providing access to the compliance API to the storage device;
receiving, from the storage device, data compliance information by way of the compliance API;
consulting a mapping and determining, based on information in the mapping and the data compliance information, whether or not the data is permitted to be transmitted by the backup application to the storage device;
when the data compliance information and the additional tag both indicate that transmission of the data is permitted, transmitting the data to the storage device; and
when the data compliance information indicates the transmission of the data is permitted but the additional tag indicates the transmission of the data is not permitted, preventing the transmission of the data to the storage device such that the additional tag is independently evaluated relative to the data compliance information and such that the transmission of the data occurs when both the data compliance information and the additional tag indicate the transmission of the data is permitted.
12. The non-transitory computer readable storage medium as recited in claim 11 wherein transmitting the data comprises transferring the data, or replicating the data.
13. The non-transitory computer readable storage medium as recited in claim 11 , wherein the data is tagged with a geo tag and/or a compliance tag.
14. The non-transitory computer readable storage medium as recited in claim 13 , wherein the geo tag indicates a geographical location to which the data is permitted to be transmitted, and the compliance tag indicates a data compliance standard that governs handling of the data.
15. The non-transitory computer readable storage medium as recited in claim 11 , wherein the backup application and the storage device have a trust relationship with each other.
16. The non-transitory computer readable storage medium as recited in claim 11 , wherein the storage device comprises a mapping that relates a volume of the storage device to a particular geographical location and/or to a particular data compliance standard.
17. The non-transitory computer readable storage medium as recited in claim 11 , wherein the mapping consulted by the backup application relates the primary volume of the backup application to a particular geographical location and/or to a particular data compliance standard.
18. The non-transitory computer readable storage medium as recited in claim 11 , wherein the data comprises a saveset created by a backup application.
19. The non-transitory computer readable storage medium as recited in claim 11 , wherein the additional tag indicates a geographical location, from which backup data was generated.
20. The non-transitory computer readable storage medium as recited in claim 11 , wherein the additional tag is independent of a data compliance standard that governs handling of the data.