System and method for controlling access to information stored in an information retention system

Abstract

The disclosed computer-implemented method for controlling access to information stored in an information retention system may include: (1) receiving metadata associated with object types of corresponding objects at a computing device, wherein at least two of the corresponding objects are in different domains, (2) determining the corresponding object types of the at least two objects from the metadata, (3) forming a hierarchy of the at least two objects based on relative characteristics of the corresponding object types, and (4) performing a security action, the security action comprising (A) receiving at least one access rule that controls access to the at least two objects by at least one user, and (B) storing the at least one access rule, the hierarchy of objects, and the at least two objects in at least one storage device in the information retention system. Various other methods, systems, and computer-readable media are also disclosed.

Description

Background Art

[0001] Backing up information is a preventative security measure that can speed up recovery efforts after a malicious attack on an information system. Backing up information can be a challenging, complex, and important operation. Some of the complexities include defining and controlling access to the backup information. For example, if only two employees were allowed access to important information backups many years ago, and both employees have left the company, who should be allowed access to the backup information? Some other complexities include that similar backup applications may have different access models, different objects, different object placement, and / or different access rules. In addition, some information storage systems may involve third-party service providers, such as cloud service providers, that may implement incompatible access management services. In addition, over time, users, user roles, applications, application roles, computing technologies, access control technologies, and / or storage technologies may change, while the backup data stored in the information retention system remains unchanged since it was stored. Summary of the invention

[0002] As will be described in greater detail below, the present disclosure describes various systems and methods for controlling access to information stored in an information retention system.

[0003] In one embodiment, a method for controlling access to information stored in an information retention system may include: (1) receiving metadata associated with object types of corresponding objects in a plurality of objects at a computing device, wherein at least two of the corresponding objects are in different domains, (2) determining the corresponding object types of at least two of the plurality of objects from the metadata, (3) forming a hierarchy of the at least two objects based on relative characteristics of the corresponding object types, and (4) performing a security action. The security action may include: (A) receiving at least one access rule that controls access to at least two of the plurality of objects by at least one user, and (B) storing the at least one access rule, the hierarchy of objects, and the at least two of the plurality of objects in at least one storage device in the information retention system.

[0004] In one example, an object in the plurality of objects may describe at least one of a variable, a function, and a data structure. In one embodiment, an object in the plurality of objects may include a database table, a file, a folder, a database, or a combination thereof. In some embodiments, at least two objects in the plurality of objects may be associated with different applications.

[0005] In some examples, determining the corresponding object type may further include comparing metadata of at least two objects with a cross-reference of the metadata and the object type. In one example, determining the corresponding object type may further include reading the corresponding object type from the metadata.

[0006] In one embodiment, at least one access rule may enable at least one user to access at least one corresponding portion of the hierarchical structure. In some embodiments, enabling at least one user to access at least one corresponding portion of the hierarchical structure may include enabling access to all levels of the hierarchical structure below the at least one corresponding portion of the hierarchical structure.

[0007] In some examples, at least one access rule may deny at least one user access to at least one corresponding portion of the hierarchical structure. In one example, denying at least one user access to at least one corresponding portion of the hierarchical structure may replace at least a portion of enabling at least one user to access at least one corresponding portion of the hierarchical structure. In one embodiment, denying at least one user access to at least one corresponding portion of the hierarchical structure may include denying reading, writing, deleting, and restoring at least one object in at least one corresponding portion of the hierarchical structure.

[0008] In some embodiments, at least one access rule may enable at least one user to access at least one object in the plurality of objects. In some examples, at least one access rule may deny at least one user access to at least one object in the plurality of objects.

[0009] In one example, performing a security action may include: (1) receiving additional access rules that control access by at least one user to at least one corresponding object among a plurality of objects, and (2) combining at least a portion of the received access rules into at least one combined access rule.

[0010] In one example, a system for controlling access to information stored in an information retention system may include several modules stored in a memory, the several modules including: (1) a receiving module stored in the memory, the receiving module receiving metadata associated with object types of corresponding objects in a plurality of objects, wherein at least two of the corresponding objects are in different domains, (2) a determining module stored in the memory, the determining module determining the corresponding object types of at least two of the plurality of objects from the metadata, (3) a forming module stored in the memory, the forming module forming a hierarchy of the at least two objects based on relative characteristics of the corresponding object types, (4) an executing module stored in the memory, the executing module executing a security action. The security action may include: (A) receiving at least one access rule, the at least one access rule controlling access of at least one user to at least two of the plurality of objects, and (B) storing the at least one access rule, the hierarchy of objects, and the at least two of the plurality of objects in at least one storage device in the information retention system. The system may also include at least one physical processor, the at least one physical processor executing the receiving module, the determining module, the forming module, and the executing module.

[0011] In some examples, the above method may be encoded as computer-readable instructions on a non-transitory computer-readable medium. For example, the computer-readable medium may include one or more computer-executable instructions that, when executed by at least one processor of a computing device, may cause the computing device to: (1) receive metadata associated with object types of corresponding objects in a plurality of objects at the computing device, wherein at least two of the corresponding objects are in different domains, (2) determine the corresponding object types of at least two of the plurality of objects from the metadata, (3) form a hierarchy of the at least two objects based on relative characteristics of the corresponding object types, and (4) perform a security action. The security action may include: (A) receiving at least one access rule that controls access to at least two of the plurality of objects by at least one user, and (B) storing the at least one access rule, the hierarchy of objects, and at least two of the plurality of objects in at least one storage device in the information retention system.

[0012] Features from any of the embodiments described herein may be used in combination with each other according to the general principles described herein. These and other embodiments, features and advantages will be more fully understood after reading the following detailed description in conjunction with the accompanying drawings and claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The accompanying drawings illustrate several exemplary embodiments and are a part of the specification. Together with the following description, these drawings demonstrate and explain various principles of the present disclosure.

[0014] Figure 1 is a block diagram of an exemplary system for controlling access to information stored in an information retention system.

[0015] Figure 2 is a block diagram of an additional exemplary system for controlling access to information stored in an information retention system.

[0016] Figure 3 is a flow chart of an exemplary method for controlling access to information stored in an information retention system.

[0017] Figure 4 is a block diagram of objects in an exemplary information retention system.

[0018] Figure 5 yes Figure 4 Illustration of an exemplary hierarchy of objects in an exemplary information retention system.

[0019] Throughout the drawings, the same reference characters and descriptions indicate similar but not necessarily identical elements. Although the exemplary embodiments described herein are susceptible to various modifications and alternative forms, specific embodiments are shown by way of example in the drawings, which will be described in detail herein. However, the exemplary embodiments described herein are not intended to be limited to the specific forms disclosed. On the contrary, the present disclosure encompasses all modifications, equivalents, and alternative forms that fall within the scope of the appended claims. DETAILED DESCRIPTION

[0020] The present disclosure as a whole relates to systems and methods for controlling access to information stored in an information retention system. Examples of the provided technology may provide a general application agnostic approach to enable secure management of information stored in a retention system, such as a long-term data retention system. Examples of the provided technology may provide a method for unified multi-application domain data access control in an information retention system, such as a long-term data retention system. In some embodiments, the provided technology may enable backing up different applications in a unified manner by enabling a flexible hierarchical organization across different application domains and their application-specific objects.

[0021] Some of the problems addressed by the provided systems and methods may include: (1) many enterprise software applications (e.g., operating systems, workloads such as virtualization, applications such as databases, etc.) define application-unique user access requirements and access rules to satisfy application-specific requirements, (2) many applications define and use different styles of objects, (3) backup and long-term data protection applications may archive information with application permissions that, over time, as applications evolve, become out of sync with each other, leaving older copies unmodified, (4) for application backup operations, it is often desirable to maintain consistency of application data at a particular point in time, thus requiring backup operations to be performed simultaneously and as a single user across different users (e.g., saving data from all tables in a database in a single pass to maintain consistency), and / or (5) a recovery time objective (RTO) in a service level agreement (SLA) may require enabling recovery of an amount of backup information that is less than the entire backup application.

[0022] Some examples of the provided systems and methods can analyze high-level software objects created and / or used by applications, such as tables in a database application, virtual machines in a virtualization application, and the like. The analysis results provide corresponding object properties that can be used to organize objects from different applications and / or different domains into a hierarchical structure (such as a parent-child hierarchy). This method of organizing objects (1) does not require matching backup applications, (2) can be high-level to low-level as long as meaningful detection and management can be performed, and / or (3) does not require understanding of individual application user or group information. Objects can be stored, and hierarchies can be stored. Data access rules (i.e., in rule-based access control (RBAC)) can be created and / or applied to control access to users and / or processes that access objects in the hierarchy. For example, an administrator can define that only certain users are allowed to access a first part of the hierarchy, while all users are allowed to access another part of the hierarchy. The provided technology provides a method that balances (1) avoiding strongly coupling an application's access model to the application's objects and (2) defining access controls to specific objects within an application at a granular level.

[0023] By doing so, the systems and methods described herein can improve the functionality of a computing device by managing backup information without being limited by the unique user access requirements and access rules of an application. In addition, the systems and methods described herein can improve the functionality of a computing device by managing backup information without being limited by the different styles of objects used by different applications. In some embodiments, the systems and methods described herein can improve the functionality of a computing device by managing archived information without being affected by application permissions, which become out of sync with each other as the application evolves and over time, and keep older copies unmodified. In addition, the systems and methods described herein can improve the functionality of a computing device by managing backup information without having to perform backup operations simultaneously between different users and as a single user. In some embodiments, the systems and methods described herein can improve the functionality of a computing device by managing archived information in a manner that enables the recovery of an amount of backup information less than the entire application, thereby improving recovery time. In addition, in some examples, from the perspective of the application, the systems and methods described herein can appear transparent to the application.

[0024] The following will refer to Figure 1 to Figure 2 A detailed description of an exemplary system for controlling access to information stored in an information retention system is provided. Figure 3 A detailed description of the corresponding computer-implemented method is provided. Figures 4 to 5 A detailed description of an exemplary information retention system and associated object hierarchy is shown in .

[0025] Figure 1 1 is a block diagram of an exemplary system 100 for controlling access to information stored in an information retention system. In some embodiments, the exemplary system 100 may be a component of an information retention system. As shown in the figure, the exemplary system 100 may include one or more modules 102 for performing one or more tasks. As will be explained in more detail below, the modules 102 may include a receiving module 104, a determining module 106, a forming module 108, and an executing module 110. Although shown as separate elements, Figure 1 One or more of the modules 102 may represent portions of a single module or an application.

[0026] In certain embodiments, Figure 1 One or more of the modules 102 in the example embodiment may represent one or more software applications or programs that, when executed by a computing device, may cause the computing device to perform one or more tasks. For example, and as will be described in more detail below, one or more of the modules 102 may represent modules that are stored and configured to run on one or more computing devices, such as a Figure 2 , or a server “N” 208 . Figure 1 One or more of the modules 102 in may also represent all or part of one or more special-purpose computers configured to perform one or more tasks.

[0027] like Figure 1 As shown, the exemplary system 100 may also include one or more storage devices, such as storage device 120. Storage device 120 generally represents any type or form of volatile or non-volatile storage device or medium capable of storing data and / or computer-readable instructions. In one example, storage device 120 may store, load and / or maintain one or more of metadata 121, object type 122, object 123, hierarchical structure 124, relative characteristics of corresponding object type 125, security actions 126 and / or access rules 127. Examples of storage device 120 include, but are not limited to, random access memory (RAM), read-only memory (ROM), flash memory, hard disk drive (HDD), solid state drive (SSD), optical drive, cache, variations or combinations of one or more of the above, and / or any other suitable memory.

[0028] In some non-limiting embodiments, security actions 126 may include blocking access to a device (e.g., a storage device, memory, network device, etc.), allowing limited access to a device, allowing read-only access to a device, encrypting information, and / or other operations that restrict access to a device. In some examples, security actions may be performed automatically. In some embodiments, security actions may be performed based on executing access rules such as access rules 127.

[0029] In some embodiments, security actions 126 may attempt to identify and / or ameliorate potential security risks. In additional examples, security actions 126 may include displaying a warning on a user display indicating that access rules 127 have been violated. In some examples, security actions 126 may also include allowing access to information accessible only to authenticated processes and / or users. In some examples, security actions 126 may be performed according to a data loss prevention (DLP) policy.

[0030] like Figure 1As shown, the exemplary system 100 may also include one or more physical processors, such as physical processor 130. Physical processor 130 generally represents a hardware-implemented processing unit of any type or form capable of interpreting and / or executing computer-readable instructions. In one example, physical processor 130 may access and / or modify one or more of modules 102 stored in memory 140. Additionally or alternatively, physical processor 130 may execute one or more of modules 102 to facilitate controlling access to information stored in an information retention system. Examples of physical processor 130 include, but are not limited to, a microprocessor, a microcontroller, a central processing unit (CPU), a field programmable gate array (FPGA) implementing a soft-core processor, an application-specific integrated circuit (ASIC), a portion of one or more of the above, a variant or combination of one or more of the above, or any other suitable physical processor.

[0031] like Figure 1 As shown, the exemplary system 100 may also include one or more memory devices, such as memory 140. Memory 140 generally represents any type or form of volatile or non-volatile storage device or medium capable of storing data and / or computer-readable instructions. In one example, memory 140 may store, load, and / or maintain one or more of modules 102. Examples of memory 140 include, but are not limited to, random access memory (RAM), read-only memory (ROM), flash memory, hard disk drive (HDD), solid-state drive (SSD), optical drive, cache, any other suitable memory, and / or variations or combinations of one or more of the foregoing.

[0032] like Figure 1 As shown, exemplary system 100 may also include one or more displays, such as display 150. In some examples, display 150 may be a touch screen. Thus, display 150 may be a touch sensing device configured to receive input, such as a swipe, via a touch applied by a user on display 150 when the user touches display 150. In some examples, display 150 may implement technologies such as capacitive sensing, resistive sensing, pressure sensing, and the like. Display 150 may also be an image (e.g., video) display device configured to display a user interface that may display access rules, hierarchical structures, and / or objects.

[0033] like Figure 1 As shown, the exemplary system 100 may also include one or more network interfaces, such as network interface 160. The network interface 160 broadly represents any type or form of communication device or adapter (e.g., Figure 2204 in the example embodiment). For example, in some embodiments, the network interface 160 can facilitate communication between the exemplary system 100 and a network coupled to a computing system (such as a cloud-based information storage system). Examples of the network interface 160 include, but are not limited to, a wired network interface (such as a network interface card), a wireless network interface (such as a wireless network interface card), a modem, and any other suitable interface. In at least one embodiment, the network interface 160 can provide a direct connection to a remote server via a link to a network (such as the Internet). The network interface 160 can also provide such a connection indirectly through, for example, a local area network (such as an Ethernet network), a personal area network, a telephone or cable network, a cellular phone connection, a satellite data connection, or any other suitable connection.

[0034] In certain embodiments, the network interface 160 may also represent a host adapter that is configured to facilitate communication between the exemplary system 100 and one or more additional network or storage devices via an external bus or communication channel. Examples of host adapters include, but are not limited to, a small computer system interface (SCSI) host adapter, a universal serial bus (USB) host adapter, an Institute of Electrical and Electronics Engineers (IEEE) 1394 host adapter, an Advanced Technology Attachment (ATA), a parallel ATA (PATA), a serial ATA (SATA), and an external SATA (eSATA) host adapter, a fiber channel interface adapter, an Ethernet adapter, and the like. The network interface 160 may also allow the exemplary system 100 to participate in distributed or remote computing and / or information storage. For example, the network interface 160 may receive instructions from a remote device or send instructions to a remote device for execution.

[0035] Figure 1 The exemplary system 100 in FIG. 1 may be implemented in various ways. For example, all or part of the exemplary system 100 may represent Figure 2 As shown in FIG. Figure 2 As shown, system 200 may include a computing device 202 in communication with a first server 206 and / or a server "N" 208 via a network 204. In one example, all or part of the functionality of module 102 may be performed by computing device 202, first server 206, server "N" 208, and / or any other suitable computing system. As will be described in more detail below, when executed by at least one processor in computing device 202, first server 206, and / or server "N" 208, the Figure 1 One or more of modules 102 of may enable computing device 202, first server 206, and / or server "N" 208 to control access to information stored in a retention system. In some examples, system 200 may be an information retention system.

[0036] The computing device 202 generally represents any type or form of computing device capable of reading computer-executable instructions. For example, the computing device 202 may represent a device running information storage management software. Additional examples of the computing device 202 include, but are not limited to, a laptop computer, a tablet computer, a desktop computer, a server, a storage server, a cellular phone, a personal digital assistant (PDA), a multimedia player, an embedded system, a wearable device (e.g., a smart watch, smart glasses, etc.), a smart vehicle, an Internet of Things device (e.g., a smart appliance, etc.), a game console, a variation or combination of one or more of the above, or any other suitable computing device.

[0037] The network 204 generally represents any medium or architecture capable of facilitating communication or data transfer. In one example, the network 204 can facilitate communication between the computing device 202 and the servers 206 to 208. In this example, the network 204 can facilitate communication or data transfer using wireless and / or wired connections. Examples of the network 204 include, but are not limited to, an intranet, a wide area network (WAN), a local area network (LAN), a personal area network (PAN), the Internet, a power line communication (PLC), a cellular network (e.g., a global system for mobile communications (GSM) network), portions of one or more of the foregoing, variations or combinations of one or more of the foregoing, or any other suitable network.

[0038] Servers 206-208 generally represent any type or form of computing device capable of reading computer-executable instructions. For example, servers 206-208 may represent devices running information storage management software. Additional examples of servers 206-208 include, but are not limited to, storage servers, database servers, application servers, and / or web servers, which are configured to run certain software applications and / or provide various storage, database, and / or web services. Figure 2 Although shown as a single entity in FIG. 1 , servers 206 to 208 may include and / or represent multiple servers that work and / or operate in coordination with each other. In one example, servers 206 to 208 may be components of a cloud-based information retention system.

[0039] In some examples, servers 206 to 208 may include and / or be coupled to one or more storage devices, such as a first storage device 220 and / or an "Nth" storage device 222. The first storage device 220 and / or the "Nth" storage device 222 may generally represent any type or form of volatile or non-volatile storage device or medium capable of storing information and / or computer-readable instructions. Examples of the first storage device 220 and / or the "Nth" storage device 222 may include, but are not limited to, RAM, ROM, flash memory, HDD, SSD, optical drive, cache, memory, any other suitable storage device, and / or variations or combinations of one or more thereof.

[0040] Many other devices or subsystems can be connected to Figure 1 The system 100 and / or Figure 2 In the system 200. In contrast, Figure 1 and Figure 2 All components and devices shown in the drawings need not be present to practice the embodiments described and / or shown herein. The devices and subsystems mentioned above may also be used in accordance with Figure 2 The systems 100 and 200 may also be interconnected in different ways as shown. Any number of software configurations, firmware configurations, and / or hardware configurations may also be employed. For example, one or more of the exemplary embodiments disclosed herein may be encoded as a computer program (also referred to as computer software, software application, computer-readable instructions, and / or computer control logic) on a computer-readable medium.

[0041] As used herein, the term "computer-readable medium" generally refers to any form of device, carrier, or medium capable of storing or carrying computer-readable instructions. Examples of computer-readable media include, but are not limited to, transmission-type media, such as carrier waves, and non-transitory media, such as magnetic storage media (e.g., hard drives, tape drives, and floppy disks), optical storage media (e.g., compact disks (CDs), digital video disks (DVDs), BLU-RAY disks), electronic storage media (e.g., solid-state drives and flash memory media), and other distribution systems.

[0042] Figure 3 is a flow chart of an exemplary computer-implemented method 300 for controlling access to information stored in an information retention system. Figure 3 The steps shown in may be performed by any suitable computer executable code and / or computing system, including Figure 1 System 100 in Figure 2 In one example, the system 200 and / or any variation or combination of any one or more of the foregoing. Figure 3 Each step shown in may represent an algorithm whose structure includes and / or is represented by multiple sub-steps, examples of which are provided in more detail below.

[0043] like Figure 3 As shown, at step 302, one or more of the systems described herein may receive metadata associated with an object type of a corresponding object in a plurality of objects. In an example, at least two of the corresponding objects may be in different domains. In some examples, the metadata may help establish that the corresponding object belongs to a particular folder, file, table, or other portion of a hierarchy, a configuration of a hierarchy, and / or a division of a hierarchy. The systems described herein may perform step 302 in various ways. For example, as Figure 2 As part of computing device 202, server 206, and / or server "N" 208 in FIG. 1 , receiving module 104 may receive metadata 121 associated with object type 122 of corresponding object 123 of the plurality of objects. In an example, at least two of the corresponding objects 123 may be in different domains.

[0044] In one example, an object in the plurality of objects may describe at least one of a variable, a function, and / or a data structure. In one example, an object in the plurality of objects may include a database table, a file, a folder, a database, or a combination thereof. In one embodiment, at least two objects in the plurality of objects may be from different applications.

[0045] like Figure 3 As shown, at step 304, one or more of the systems described herein may determine corresponding object types of at least two of the plurality of objects from the metadata. The systems described herein may perform step 304 in a variety of ways. For example, as Figure 2 As part of computing device 202 , server 206 , and / or server “N” 208 , determination module 106 may determine corresponding object types 122 of at least two objects 123 of the plurality of objects from metadata 121 .

[0046] In one example, determining the corresponding object type may include comparing metadata of at least two objects to a cross-reference of the metadata and the object type. In one example, determining the corresponding object type may include reading the corresponding object type from the metadata.

[0047] In some examples, the method may include defining a replacement (eg, dummy) data access object associated with the application and associated with a corresponding object in the application. The corresponding object type may be determined as part of the definition process.

[0048] like Figure 3 As shown, at step 306, one or more of the systems described herein may form a hierarchy of at least two objects based on the relative characteristics of the corresponding object types. The systems described herein may perform step 306 in various ways. For example, as Figure 2As part of computing device 202, server 206, and / or server "N" 208 in the example, forming module 108 may form a hierarchy 124 of at least two objects 123 based on relative characteristics of corresponding object types 125. In one example, the hierarchy may span different domains and may be a combination of pseudo-sequential objects stored as metadata to implement an intermediate path or a complete path. Figures 4 to 5 An example of a hierarchy created across multiple domains and associated rule-based access controls is depicted.

[0049] return Figure 3 In one example, the hierarchical structure of the file system may include a combination of files and folders. In another example, the hierarchical structure of the virtual machine may include a combination of data centers, folders, clusters, and / or tags. In a non-limiting embodiment, the hierarchical structure across multiple domains may include: (1) a cloud storage system as the highest level in the hierarchical structure, (2) a data center and a first domain in the cloud storage system, (3) a first virtual machine and a first domain in the data center, (4) a first folder and a first domain in the first virtual machine, (5) files in the first folder and the first domain, and (6) a second virtual machine, a first domain, and a second domain in the first folder. The second domain may include: (7) an operating system memory in the second virtual machine, (8) a second folder in the operating system memory, and (9) files in both the second folder and the third domain.

[0050] like Figure 3 As shown, at step 308, one or more of the systems described herein may perform a security action, such as using a hierarchy to establish rule-based information access control across multiple domains and / or different identity providers (IDPs). In some embodiments, the security action may include: (A) receiving at least one access rule that controls access by at least one user to at least two of the multiple objects, and / or (B) storing at least one access rule, the hierarchy of objects, and / or at least two of the multiple objects in at least one storage device in the information retention system. The systems described herein may perform step 308 in various ways. For example, as Figure 2As part of computing device 202, server 206, and / or server "N" 208 in the information retention system, execution module 110 can perform security action 126. In some embodiments, security action 126 can include: (A) receiving at least one access rule 127 that controls access and / or processing of at least two of the plurality of objects 123 by at least one user, and / or (B) storing at least one access rule 127, hierarchy 124 of objects 123, and / or at least two of the plurality of objects 123 in at least one storage device (e.g., storage device 120, first storage device 220, and / or "Nth" storage device 222) in the information retention system. In some examples, permissions can vary based on the access rules.

[0051] In some examples and in a simplified manner, the access rules may indicate that user "X" can access part "Y" of the hierarchy. For example, a first rule may indicate that user one can read and / or restore a specific file represented by object one in the hierarchy. As another example, a second rule may indicate that an administrator can restore a folder whose file one is a component file, but the administrator may not read file one.

[0052] In one embodiment, at least one access rule may enable at least one user to access at least one corresponding portion of the hierarchical structure. In some embodiments, enabling at least one user to access at least one corresponding portion of the hierarchical structure may include enabling access to all levels of the hierarchical structure below the at least one corresponding portion of the hierarchical structure. In some embodiments, enabling at least one user to access at least one corresponding portion of the hierarchical structure may include allowing reading, writing, deleting, and / or restoring at least one object in the at least one corresponding portion of the hierarchical structure.

[0053] In one example, at least one access rule may deny at least one user access to at least one corresponding portion of the hierarchical structure. In one embodiment, denying at least one user access to at least one corresponding portion of the hierarchical structure may replace at least a portion of enabling at least one user to access at least one corresponding portion of the hierarchical structure. In some embodiments, denying at least one user access to at least one corresponding portion of the hierarchical structure may include denying reading, writing, deleting, and restoring at least one object in at least one corresponding portion of the hierarchical structure.

[0054] In some examples, at least one access rule may enable at least one user to access at least one object in the plurality of objects. In some embodiments, at least one access rule may deny at least one user access to at least one object in the plurality of objects.

[0055] In some embodiments, the access rules controlling access to at least one user may provide a default access level. For example, the default access level for a user may include a level that enables access to a particular group of objects and / or a hierarchical structure. In some examples, the default access level for a user may include a level that denies access to a particular group of objects and / or a hierarchical structure.

[0056] In one example, performing the security action may include receiving additional access rules that control access of at least one user to at least one corresponding object in the plurality of objects. In some embodiments, performing the security action may include combining at least a portion of the received access rules into at least one combined access rule.

[0057] Figure 4 4 is a block diagram of an exemplary information retention system 400. Information retention system 400 may include a data center 402 that provides an information retention system including computing devices and / or storage devices that store information, such as the depicted objects. Users such as "Admin DC" 404, "Admins RnD" 406, Engineers 408, and / or "CPA" 410 may access certain objects in information retention system 400 as provided by corresponding access rules. Information retention system 400 includes multiple domains: a first domain is a "Financial Machine Folder" and a second domain is an "RnD Machine Folder".

[0058] For example, a data center administrator such as "Admin DC" 404 may be granted access rights through a first rule to restore a specific set of objects represented by first box 412. The first rule enables "Admin DC" 404 to have sufficient access to perform data center management tasks without enabling "Admin DC" 404 to access trade secret information in R&D Adv IP objects.

[0059] As another example, an administrator of "Admins RnD" 406 of the R&D department may be granted access rights through a second rule to restore a specific group of objects represented by a second box 414. The second rule enables "Admins RnD" 406 to have sufficient access to perform R&D department management tasks without enabling "Admins RnD" 406 to access trade secret information in the R&D AdvIP objects.

[0060] Additionally, engineer 408 may be granted access rights through a third rule to access a specific set of objects represented by third box 416. The third rule enables engineer 408 to have sufficient access to perform R&D tasks without enabling engineer 408 to access financial sector information in the FIN_VM1 object.

[0061] As another example, account "CPA" 410 may be granted access rights through a fourth rule to access a specific set of objects represented by fourth box 418. The fourth rule enables "CPA" 410 to have sufficient access to "CPA" 410 to perform accounting tasks, but does not enable "CPA" 410 to access trade secret information in R&D Adv IP objects.

[0062] In another embodiment, data center administrator "Admin DC" 404 may be denied access to the group of objects represented by third box 416 via a fifth rule. The fifth rule enables "Admin DC" 404 full access to "Admin DC" 404 to perform data center management tasks while explicitly denying "Admin DC" 404 access to trade secret information in R&D Adv IP objects.

[0063] In another embodiment, the datacenter administrator "Admin DC" 404 may be denied access to the object group represented by the second box 414 by the sixth rule. The sixth rule may override the access rights granted by the first rule to "Admin DC" 404. Therefore, although rule one grants access rights to the object "RnD Machine Folder", the datacenter administrator "Admin DC" 404 may not be able to restore the object "RnD Machine Folder" because it is denied access by the superseded rule six.

[0064] Figure 5 is an illustration of an example hierarchy 500 of objects in example information retention system 400. Hierarchy 500 is an example of a hierarchy of objects across multiple domains.

[0065] As detailed above, Figure 3 The steps outlined in method 300 and Figures 4 to 5 Examples of may provide systems and methods for controlling access to information stored in an information retention system. By doing so, the systems and methods described herein may improve the functionality of a computing device by managing backup information without being limited by application-unique user access requirements, access rules, different styles of objects used by different applications, and / or unsynchronized application permissions. In some embodiments, the systems and methods described herein may improve the functionality of a computing device by managing archived information in a manner that enables recovery of an amount of backup information that is less than an entire application, thereby improving recovery time.

[0066] Although the above disclosure uses specific block diagrams, flow charts, and examples to illustrate various embodiments, each block diagram component, flow chart step, operation, and / or component described and / or illustrated herein may be implemented individually and / or collectively using a variety of hardware, software, or firmware (or any combination thereof) configurations. In addition, any disclosure of components contained within other components should be considered exemplary in nature, as many other architectures may be implemented to achieve the same functionality.

[0067] In some examples, Figure 1 All or a portion of the exemplary system 100 in the embodiment of the present invention may represent a cloud computing environment or a portion of a network-based environment. A cloud computing environment may provide various services and applications via the Internet. These cloud-based services (e.g., software as a service, platform as a service, infrastructure as a service, etc.) may be accessed through a web browser or other remote interface. Various functions described herein may be provided through a remote desktop environment or any other cloud-based computing environment.

[0068] In various embodiments, Figure 1 All or a portion of the exemplary system 100 in can facilitate multi-tenancy within a cloud-based computing environment. In other words, the modules described herein can configure a computing system (e.g., a server) to facilitate multi-tenancy of one or more of the functions described herein. For example, one or more of the modules described herein can program a server to allow two or more clients (e.g., customers) to share an application running on the server. A server programmed in this manner can share applications, operating systems, processing systems, and / or storage systems between multiple customers (i.e., tenants). One or more of the modules described herein can also partition the data and / or configuration information of a multi-tenant application for each customer so that one customer cannot access the data and / or configuration information of another customer.

[0069] According to various embodiments, Figure 1 All or a portion of the exemplary system 100 in the embodiment of the present invention may be implemented in a virtual environment. For example, the modules and / or data described herein may reside and / or execute in a virtual machine. As used herein, the term "virtual machine" generally refers to any operating system environment abstracted from computing hardware by a virtual machine manager (e.g., a hypervisor).

[0070] In some examples, Figure 1All or a portion of the exemplary system 100 in the example embodiment may represent a portion of a mobile computing environment. The mobile computing environment may be implemented by a variety of mobile computing devices, including mobile phones, tablet computers, e-book readers, personal digital assistants, wearable computing devices (e.g., computing devices with head-mounted displays, smart watches, etc.), variations or combinations of one or more of the foregoing, or any other suitable mobile computing devices. In some examples, the mobile computing environment may have one or more notable features, including, for example, reliance on battery power, presenting only one foreground application at any given time, remote management features, touch screen features, location and movement data (e.g., provided by a global positioning system, a gyroscope, an accelerometer, etc.), a restricted platform for limiting modifications to system-level configurations and / or limiting the ability of third-party software to inspect the behavior of other applications, controls for limiting the installation of applications (e.g., only applications from approved application stores), and the like. The various functions described herein may be provided for and / or may interact with the mobile computing environment.

[0071] The process parameters and step sequences described and / or illustrated herein are given by way of example only and may be changed as desired. For example, although the steps illustrated and / or described herein may be shown or discussed in a particular order, the steps need not be performed in the order illustrated or discussed. The various example methods described and / or illustrated herein may also omit one or more of the steps described or illustrated herein, or include additional steps in addition to those disclosed.

[0072] Although various embodiments have been described and / or shown herein in the context of a fully functional computing system, one or more of these exemplary embodiments may be distributed as various forms of program products, regardless of the specific type of computer-readable medium used to actually distribute. Embodiments disclosed herein may also be implemented using modules that perform certain tasks. These modules may include script files, batch files, or other executable files that may be stored on a computer-readable storage medium or in a computing system. In some embodiments, these modules may configure a computing system to perform one or more of the exemplary embodiments disclosed herein.

[0073] The foregoing description is intended to enable others skilled in the art to best utilize the various aspects of the example embodiments disclosed herein. This exemplary description is not intended to be exhaustive or limited to any exact form disclosed. Many modifications and variations may be made without departing from the spirit and scope of the present disclosure. The embodiments disclosed herein should be considered exemplary and non-restrictive in all respects. The scope of the present disclosure should be determined with reference to the appended claims and their equivalents.

[0074] Unless otherwise indicated, the terms "connected to" and "coupled to" (and their derivative forms) used in this specification and claims should be understood to allow both direct and indirect (i.e., via other elements or components) connections. In addition, the terms "a" or "an" used in this specification and claims should be understood to mean "at least one ...". Finally, for ease of use, the terms "including" and "having" (and their derivative forms) used in this specification and claims are interchangeable with the word "comprising" and have the same meaning as the word "comprising".

Claims

1. A computer-implemented method for controlling access to information stored in an information retention system, at least a portion of the method being performed by a computing device including at least one processor, the method comprising: receiving, at the computing device, metadata associated with an object type of respective objects of a plurality of objects, wherein at least two of the respective objects are in different domains; determining the corresponding object types of at least two objects of the plurality of objects from the metadata; forming a hierarchy of the at least two objects based on relative characteristics of the corresponding object types; as well as Performing a security action, the security action comprising: receiving at least one access rule, the at least one access rule controlling access by at least one user to the at least two objects of the plurality of objects; as well as The at least one access rule, the hierarchical structure of the objects, and the at least two objects of the plurality of objects are stored in at least one storage device in the information retention system. 2 . The computer-implemented method of claim 1 , wherein an object in the plurality of objects describes at least one of a variable, a function, and a data structure. 3 . The computer-implemented method of claim 1 , wherein an object of the plurality of objects comprises a database table, a file, a folder, a database, or a combination thereof. 4 . The computer-implemented method of claim 1 , wherein the at least two objects of the plurality of objects are associated with different applications.

5. The computer-implemented method of claim 1 or 2, wherein determining the corresponding object types further comprises comparing the metadata of the at least two objects to a cross-reference of metadata and object types.

6. The computer-implemented method of claim 1 or 2, wherein determining the corresponding object type further comprises reading the corresponding object type from the metadata.

7. The computer-implemented method of claim 1 or 2, wherein the at least one access rule enables the at least one user to access at least one corresponding portion of the hierarchical structure.

8. The computer-implemented method of claim 7, wherein enabling the at least one user to access the at least one corresponding portion of the hierarchical structure comprises enabling access to all levels of the hierarchical structure below the at least one corresponding portion of the hierarchical structure.

9. The computer-implemented method of claim 1 or 2, wherein the at least one access rule denies the at least one user access to at least one corresponding portion of the hierarchical structure.

10. The computer-implemented method of claim 9, wherein denying the at least one user access to the at least one corresponding portion of the hierarchical structure replaces enabling the at least one user to access at least a portion of the at least one corresponding portion of the hierarchical structure.

11. A computer-implemented method according to claim 9, wherein denying the at least one user access to the at least one corresponding portion of the hierarchical structure includes denying reading, writing, deleting, and restoring at least one object in the at least one corresponding portion of the hierarchical structure.

12. The computer-implemented method of claim 1 or 2, wherein the at least one access rule enables the at least one user to access at least one object of the plurality of objects.

13. The computer-implemented method of claim 1 or 2, wherein the at least one access rule denies the at least one user access to at least one object of the plurality of objects.

14. The computer-implemented method of claim 1 or 2, wherein performing the security action further comprises: receiving an additional access rule that controls access by the at least one user to at least one corresponding object of the plurality of objects; as well as At least a portion of the received access rules are combined into at least one combined access rule.

15. A system for controlling access to information stored in an information retention system, the system comprising: means for receiving metadata associated with an object type of respective objects of a plurality of objects, wherein at least two of the respective objects are in different domains; means for determining, from the metadata, the corresponding object types of at least two objects of the plurality of objects; means for forming a hierarchy of said at least two objects based on relative characteristics of said respective object types; as well as Means for performing a safety action, the safety action comprising: receiving at least one access rule, the at least one access rule controlling access by at least one user to the at least two objects of the plurality of objects; as well as The at least one access rule, the hierarchical structure of the objects, and the at least two objects of the plurality of objects are stored in at least one storage device in the information retention system.

16. The system of claim 15, wherein the at least one access rule denies the at least one user access to at least one corresponding portion of the hierarchical structure.

17. The system according to claim 15 or 16, wherein the security action further comprises: receiving an additional access rule that controls access by the at least one user to at least one corresponding object of the plurality of objects; as well as At least a portion of the received access rules are combined into at least one combined access rule.

18. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to: receiving, at the computing device, metadata associated with an object type of respective objects of a plurality of objects, wherein at least two of the respective objects are in different domains; determining the corresponding object types of at least two objects of the plurality of objects from the metadata; forming a hierarchy of the at least two objects based on relative characteristics of the corresponding object types; as well as Performing a security action, the security action comprising: receiving at least one access rule, the at least one access rule controlling access by at least one user to the at least two objects of the plurality of objects; as well as The at least one access rule, the hierarchical structure of the objects, and the at least two objects of the plurality of objects are stored in at least one storage device in the information retention system.

19. The non-transitory computer-readable medium of claim 18, wherein the at least one access rule denies the at least one user access to at least one corresponding portion of the hierarchical structure.

20. The non-transitory computer readable medium of claim 18 or 19, wherein the security action further comprises: receiving an additional access rule that controls access by the at least one user to at least one corresponding object of the plurality of objects; as well as At least a portion of the received access rules are combined into at least one combined access rule.

Images