Data Object Lockdown Using Internal Compliance Clock
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computing environments without access to a compliance application that understands specific data retention policies, data scanners may fail to instantaneously identify files for lockdown, leading to potential security vulnerabilities and data loss, and are vulnerable to system clock tampering.
Innovation Solution
Implementing an internal compliance clock that instantaneously determines if a file has not been modified within a specified auto commit time period, ensuring files are locked down promptly and securely, even if the data scanner has not yet evaluated them, and using this clock to resist tampering attempts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a data scanner is used to periodically or continuously walk a data container to identify files for compliance storage, then the system can operate without a compliance application, but files may not be auto committed to compliance storage at the time when they satisfy the auto commit time period, leading to security vulnerabilities and data loss
Solution Approach 1:
The patent implements preliminary action by having the storage server continuously monitor file modification times and automatically commit files to compliance storage the moment they satisfy the auto commit time period, rather than waiting for the data scanner to evaluate them. This proactive approach ensures files are locked down immediately when retention criteria are met, eliminating the delay and security vulnerability inherent in periodic scanning.
2Ease of manufacture
If a data scanner is used to evaluate files for auto commit, then the system can implement data retention policy, but the scanner cannot instantaneously traverse the data container, causing delays of up to 5 minutes from when files satisfy criteria to when they are evaluated
Solution Approach 1:
The patent applies continuity of useful action by implementing continuous monitoring of file modification times by the storage server, rather than periodic scanning. The server checks file timestamps continuously and immediately commits files when they satisfy the auto commit time period, ensuring no time loss between criteria satisfaction and evaluation.
3Device complexity
If the data scanner uses a system clock to determine how long a file has gone unmodified, then the implementation is simple, but the system clock is vulnerable to malicious tampering by users or storage administrators
Solution Approach 1:
The patent introduces an intermediary component - a dedicated compliance clock - that serves as a tamper-resistant time reference specifically for compliance operations. This separate clock mechanism isolates the timekeeping function from the main system clock, preventing malicious tampering while maintaining the simplicity of time-based retention logic.
4Measurement precision
If the compliance application scans each data container to identify data for compliance storage lockdown, then it can accurately identify files, but it may be unable to scale appropriately as more data containers are monitored
Solution Approach 1:
The patent implements self-service by enabling the storage server to autonomously identify and commit files to compliance storage based on file modification times and retention policies, without requiring the compliance application to scan and evaluate each file. This transfers the compliance enforcement capability to the storage layer, allowing scalable deployment across numerous data containers while maintaining accurate identification of compliance data through metadata-based filtering.
Data Source
AI summary
One or more techniques and/or computing devices are provided for data object retention. For example, a data retention policy may specify that files of a volume are to be locked down for a lockdown retention period (e.g., locked into a read only state for 4 months) when such files are not changed within an auto commit time period (e.g., files not changed within 13 hours). Waiting for a data scanner to evaluate files for lockdown may result in files violating the data retention policy until the data scanner evaluates such files. Accordingly, a file may be considered to be in the locked down state (e.g., instantaneous lockdown), such that commands to modify or delete the file are blocked, based upon a difference between a current time of an internal compliance clock and a current value of a data object change field exceeding the auto commit time period.