Backup Snapshot Scanning in Temporary Environments Without Production Strain

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Vulnerability scans on primary systems strain system resources and can lead to reduced scanning frequency or omission, increasing the risk of system compromise, especially in cloud-based environments where operators have limited control over infrastructure updates.

Innovation Solution

A method where backup snapshots are stored in a storage system that performs vulnerability scans on a temporary environment, using a scanning score to select snapshots for analysis, reducing resource allocation on the primary system and maintaining a database of vulnerabilities for informed restoration.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If vulnerability scans are performed on the primary system, then security detection capability is improved, but system performance deteriorates due to resource strain

Engineering Contradiction:

Improvesecurity detection capabilityVSAvoidsystem performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent creates a copy of the primary system in a temporary environment using backup snapshots. The vulnerability scan is performed on this copy rather than the original primary system, allowing security detection without impacting production performance. The temporary environment mirrors the primary system's state at a specific point in time, enabling comprehensive scanning while the primary system continues operating uninterrupted.

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The system performs vulnerability scanning on backup snapshots that are created in advance of actual vulnerability detection needs. By maintaining a library of backup snapshots and scanning them proactively, the system can identify vulnerabilities before they affect the primary system, allowing for preventive remediation without disrupting ongoing operations.

Inventive Principle:

Principle #10Preliminary action

2Productivity

If vulnerability scan frequency is reduced to avoid performance impact, then system performance is maintained, but security risk increases

Engineering Contradiction:

Improvesystem performanceVSAvoidsecurity risk

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The vulnerability scanning process continues uninterrupted through the use of backup snapshots. While the primary system operates continuously, the scanning process runs in parallel on temporary environment copies, ensuring that security detection is an ongoing continuous activity rather than periodic interruptions to production operations.

Inventive Principle:

Principle #20Continuity of useful action

3Reliability

If an agent is installed on the primary system to perform vulnerability scans, then scanning capability is improved, but system complexity increases due to agent maintenance requirements

Engineering Contradiction:

Improvescanning capabilityVSAvoidagent maintenance complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The vulnerability scanning functionality is extracted from the primary system and placed in a separate temporary environment. Instead of installing and maintaining an agent on the production system, the solution uses standalone vulnerability scanning tools that analyze backup snapshots in an isolated temporary environment, eliminating agent maintenance requirements while preserving scanning capability.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The backup snapshot serves as an intermediary medium between the primary system and the vulnerability scanning process. Rather than having the scanner directly interact with the primary system (which would require agent installation), the snapshot acts as a mediator that allows scanning without establishing persistent connections or installing software on the production environment.

Inventive Principle:

Principle #24Intermediary (Mediator)

4Reliability

If backup snapshots are scanned to detect vulnerabilities, then vulnerability detection is improved, but storage and processing resources are consumed

Engineering Contradiction:

Improvevulnerability detectionVSAvoidstorage and processing resources

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The vulnerability scanning process applies different levels of analysis to different portions of the backup snapshot based on their importance and risk profile. Critical systems and high-risk components receive more intensive scanning, while less critical areas receive reduced scanning intensity, optimizing resource allocation to achieve adequate vulnerability detection without consuming excessive storage and processing resources.

Inventive Principle:

Principle #3Local quality

Data Source

PatentEP4328775B1Scanning a backup for vulnerabilities

Publication Date: 2025.08.13 COHESITY INC

Figure 1
Figure 2
Figure 3

AI summary

A plurality of scanned backup snapshots is generated. A backup snapshot among a plurality of backup snapshots is selected. At least a portion of the selected backup snapshot is restored in a temporary environment to create a restored instance of at least the portion of the selected backup snapshot. A vulnerability scan of the restored instance of at least the portion of the selected backup snapshot is performed to identify one or more vulnerabilities. The one or more vulnerabilities of the scanned portion of the selected backup snapshot are tracked by storing an indication of the one or more vulnerabilities in association with the scanned portion of the selected backup snapshot.