Abstract: Applying data protection and control policies using content-based datasets by scanning data objects stored in the system to determine grouped data that is processed similarly with respect to data protection and access control operations defined by a policy. A dataset is produced comprising metadata the scanned data objects of the grouped data. The actions performed on the dataset will affect only the corresponding data objects referenced by the metadata. A policy attribute derivation (PAD) process determines a change in the policy affecting a subset of data objects of the dataset and dictating changed data protection and access control operations applied to this subset, and tags the change in the policy as a PAD tag to the dataset to affect the application of the changed data protection and access control operations only to the subset and not any remaining data objects of the dataset.

Abstract: Classifying data objects for the content-based protection and process control in a system and modifying a classification based on evolving data. Data objects stored in the system are scanned to identify data objects to be processed similarly with respect to data protection or access control. A dataset comprising metadata for corresponding data objects is generated, and a classifier labels the dataset with a classifier tag to indicate an ownership group. Data objects that belong to the dataset are similarly tagged with the classifier so that the same operations are performed on this data regardless of location. A monitor tracks changes in the dataset based system evolution to determine a change in the classifier for the dataset based on the change. A classifier behavior tag is appended to the dataset specify an operation of the classifier to accommodate the tracked change.

Abstract: Providing data protection by distributing backup data among a large plurality of distributed devices. A number of networked devices are deployed to protect data of a target device in the network. Each device of contains memory sufficient to store at least a portion of backed up data from the target device. Index information for backup data of the target device stored in each device. A cyber-attack condition is detected by a heartbeat or canary signal. Upon detection of an attack the devices enter a lockdown mode. The index information is used to reconstruct the backed up data from the portion of backed up data stored on each respective device.

Abstract: Providing content based data access protection for data stored in a system by creating a dataset by grouping metadata for data objects that are grouped together by one or more filters. The dataset can span multiple storage devices of different types to define a single data access protection unit for the corresponding content data. A user query generates the one or more filters, and an access rule is defined that allows or denies access to the dataset by users or processes as the single unit based on data content rather than location. The access rule can comprise at least one of an Access Control List (ACL) rule or a Role-Based Access Control (RBAC) rule, where the ACL lists permissions associated with certain data elements that grant access to specific users or processes, and the RBAC rules allow or deny access on the basis of role-permissions within the system.

Abstract: A data protection system includes a data protection server performing backup operations in accordance with defined policies. The system includes sensors measuring environmental and operating conditions to determine whether any such conditions exceed pre-defined threshold levels to indicate an event potentially affecting the system data or backup operations. Sensor data from one or more different sensors is aggregated in a sensor gateway and is transmitted to a trigger component that applies trigger logic to determine if any sensor data exceeds the threshold levels. The trigger logic also applies user-defined rules to trigger an ad-hoc backup operation if the threshold levels are exceeded and all rule conditions are met.

Abstract: Providing content-based protection and process control to data objects in a multi-network system, by scanning content data to identify metadata associated with data objects to be protected by a defined protection policy. The content data is stored in storage devices comprising network attached storage (NAS), object storage, local storage, or cloud networks, and where the storage devices are deployed in different networks including core networks, edge networks, and cloud networks. The gathered metadata is stored in a catalog, and a user entered query is executed against the catalog to generate a dataset. The defined protection policy is then applied to the dataset to operate on the corresponding data objects referenced by the dataset as a single unit based on data content rather than data location in a file directory or physical location within the multi-network system.

Abstract: Providing data protection by triggering backups for data protection based on data loss threshold. A protection policy is configured to protect an asset stored in a storage device in a network. A metric representing an amount of change of data of the asset is defined, along with a threshold value of the metric. The system is periodically monitored to determine if the metric reaches the threshold, and if so, a backup of the asset is triggered under the protection policy. The trigger-based data protection system backs up data on the basis specific data asset change thresholds, rather than on simple time periods or on a continuous basis.

Abstract: Embodiments applying data protection and control policies using content-based datasets by scanning data objects stored in the system to determine grouped data that is processed similarly with respect to data protection and access control operations defined by a policy. A dataset is produced comprising metadata the scanned data objects of the grouped data. The actions performed on the dataset will affect only the corresponding data objects referenced by the metadata. A policy attribute derivation (PAD) process determines a change in the policy affecting a subset of data objects of the dataset and dictating changed data protection and access control operations applied to this subset, and tags the change in the policy as a PAD tag to the dataset to affect the application of the changed data protection and access control operations only to the subset and not any remaining data objects of the dataset.

Abstract: Performing charge/showback operations in a large-scale data system by scanning multiple data sources to identify data objects for processing as a unitary group with respect to common characteristics that have an impact on finances within the system. Metadata of the identified data objects are stored in a dynamic dataset that defines a single data access unit for the referenced data objects. The system processes a user query regarding cost allocations, cost forecasts, and resource usage of respective groups within an organization. The query initiates a charge-back or show-back operation that allocates costs associated with each respective usage of resources by a department or cost center, and accesses the referenced data objects through the dataset as a single unit based on data content rather than data location in a file directory of the system.

Abstract: Embodiments are described for preventing undesired data deletion on protection storage by using delete restrictions and issuing user alerts if an excessive number of deletions are requested within a period of time. The number of deletions per time period is recorded and stored as hash counts. Deletion of data is delayed until confirmation by the user is received. One or more metrics are computed from the recorded count data and corresponding deleted data sizes. The computed metrics are compared to defined corresponding threshold values, and if any of the metrics exceeds the corresponding threshold value, an alert is sent to the user. The user can then choose to stop or investigate the deletions, or acknowledge the deletions to provide the confirmation.

Abstract: Embodiments for executing selected remediation scripts to remedy issues in a data storage system through an API/script recorder component or process that presents a DVR (digital video recorder)-like interface and capability to capture scripts and API calls as they are used when navigating a graphical user interface (GUI). Internal components of this function perform the recording and macro creation to allow constant playback of these recorded and selected scripts. By easily generating and managing scripts macros, system administrators can easily re-execute customer workflows to apply known fixes to current issues in the data storage system.

Abstract: Providing data protection by distributing backup data among a large plurality of distributed devices. A number of networked devices are deployed to protect data of a target device in the network. Each device of contains memory sufficient to store at least a portion of backed up data from the target device. Index information for backup data of the target device stored in each device. A cyber-attack condition is detected by a heartbeat or canary signal. Upon detection of an attack the devices enter a lockdown mode. The index information is used to reconstruct the backed up data from the portion of backed up data stored on each respective device.

Abstract: Providing data protection by triggering backups for data protection based on data loss threshold. A protection policy is configured to protect an asset stored in a storage device in a network. A metric representing an amount of change of data of the asset is defined, along with a threshold value of the metric. The system is periodically monitored to determine if the metric reaches the threshold, and if so, a backup of the asset is triggered under the protection policy. The trigger-based data protection system backs up data on the basis specific data asset change thresholds, rather than on simple time periods or on a continuous basis.

Abstract: Providing content-based sensitivity classification to content data in a data processing system, by defining sensitivity designations for data objects stored in the system, and creating datasets by grouping metadata for data objects that are intended to classified with a same sensitivity designation, wherein each dataset spans multiple storage devices of different storage types, and wherein each dataset defines a single data sensitivity unit for the data objects referenced by a respective dataset. A sensitivity classifier component tags each dataset with a sensitivity tag to specify a protection or control operation on the data objects referenced by the respective dataset, and a processing component then processes data objects for each tagged dataset in accordance with the specified protection or control operation.

Abstract: Embodiments are described for a method and system of applying data protection software mechanisms to network devices to auto-discover the networking equipment, save changes from memory (TCAM) to local storage, backup changes to protection storage, provide auditing and tracking history of changes, and provide the ability to deploy test/development copies of changes using software defined networking techniques. A coordinator protects network devices organized into a plurality of partitions by creating a backup of each network device, pushing backup policies to individual data protection units for the network devices within each partition to provide a consistent-state backup of the network devices, and backing up the configuration changes of the network devices to a protection storage device.

Abstract: Providing content-based encryption to content data in a data processing system by creating datasets by grouping metadata for data objects that are intended to be encrypted with a common encryption key, where each dataset spans multiple storage devices of different storage types, and defines a single data encryption unit for the data objects referenced by a respective dataset. Each dataset is tagged with an encryption tag to enable or disable use of a self-selected encryption key. Encryption keys stored in or made available to the system are accessed for encrypting the data objects using an encryption process. A key management component maps each dataset to a corresponding encryption key of the encryption keys, and an encryption component encrypts, for each dataset, referenced data objects using a corresponding mapped encryption key.

Abstract: Providing content based data protection for data stored in a large-scale data storage system by scanning data stored in one or more databases for discovery of metadata, and extracting the discovered metadata, for storage in a data catalog, the data catalog having a scanning function performing the scanning step, and comprising a database storing the metadata in one or more tables. A protection policy is defined to commonly protect content data referenced by metadata in the data catalog, and applied to the referenced content data to perform a data protection operation the content data. Datasets stored in the catalog are generated by running queries on the catalog, where a query comprises metadata selectors as tags applied to the catalog, where the tags define at least one of a file type, name, location, creation time, or file characteristic.

Abstract: Managing a lifecycle of data by identifying data objects that are subject to same control rules in each stage of the lifecycle as grouped data, where the control rules allow only authorized access to or authorized operations on the grouped data based on a current stage of the lifecycle. A dataset is generated for the grouped data by identifying metadata of the grouped data to be processed similarly within the lifecycle, and storing the metadata in the dataset. The control rules associated with the grouped data as stage tags for the dataset. Actions performed on the data referenced by the dataset are monitored to ensure that the monitored actions comply with control rules using the stage tags of the dataset.

Abstract: Embodiments are described for a method and system of applying data protection software mechanisms to network devices to auto-discover the networking equipment, save changes from memory (TCAM) to local storage, backup changes to protection storage, provide auditing and tracking history of changes, and provide the ability to deploy test/development copies of changes using software defined networking techniques. Embodiments include an efficient visual mapping aspect provided through a GUI to display the topography and backup/protection configuration of network devices in a system.

Abstract: Embodiments of monitoring data assets in a system to apply rules to optimize storage and access of the data assets based on data content rather than data location, by defining rules based on the monitoring attributes, wherein a rule dictates a storage location of selected data or access permissions to the data by one or more persons or groups in the system. The selected data is tagged with a defined metadata tag, and a dataset is created by running a query against a data catalog to derive the dataset. A component monitors data usage and access of data elements referenced by the dataset to detect any violations of the defined rules, and provides a notification of any violation to facilitate remedial action by a user or process. The dataset can span multiple storage devices of different types to define a single processing unit for the monitoring attributes.