Abstract: Systems and methods for securing objects in a computing environment. Objects are encrypted using keys that are also encrypted after encrypting the objects. In order to access the objects, a master key that is unknown to the service storing the objects and/or managing the keys is used to decrypt the keys so that the objects can be decrypted with the decrypted key. Thus, a key is needed to access the key needed to access the object. The master key is typically maintained separately from all of the encrypted objects and corresponding encrypted keys.

Abstract: In one example, a method for a distributed model of data ingestion includes receiving multiple asynchronous backup requests from a plurality of clients, and performing primary processing with respect to data elements of a first one of the backup requests. Next, a job concerning a secondary process is added to a job queue. A handoff is then made for performance of the secondary processing with respect to data elements of the first backup request. The job is then accessed and the secondary processing is performed with respect to the data elements of the backup request, wherein the primary processing and secondary processing are respective first and second stages of an ingestion process, and the primary processing is performed prior to the secondary processing.

Abstract: In one example, a method includes receiving, at a datacenter, a request from a client, where the request identifies a data range required by an application residing at the client, and the data range embraces less than all the contents of a file, backed up at the datacenter, with which the data range is associated. The example method further includes accessing the data in the data range, and transmitting data in the data range to the client, where the data transmitted to the client from the datacenter comprises respective portions of multiple incremental backups stored at the datacenter.

Abstract: In one example, a method for managing data includes identifying a dependent relation between a first version and a second version of a data element, wherein the first version is dependent upon the second version, and inserting a strong reference between the first version of the data element and the second version of the data element. Next, respective expiration times are determined for each of the first version and the second version, and a determination made as to whether the first version expires prior to the second version. When the second version has an expiration time prior to an expiration time of the first version, expiration of the second version is suspended.

Abstract: In one example, a method includes receiving, at a client where a version of a file is locally stored, an inversion patch concerning the local file version, the inversion patch including original content of one or more byte ranges that embrace changes reflected in the locally stored version of the file version that were made subsequent to creation of a target version of the file with which the locally stored file version is associated, unlocking the local file version, and applying the inversion patch to the unlocked local file version to create a restored file version that matches the target version of the file. The restored file version is then saved.

Abstract: In one example, a method is provided for presenting cloud based storage as a virtual synthetic. The method begins when file system information is requested from a datacenter server. The requested file system information is then received at the requesting client from the datacenter server. Next, the received file system information is presented at the client in the form of a virtual file system interface that makes the file system information appear as a local file system to a user at the client, notwithstanding that the file system is not actually present at the client. Finally, user access at the client is enabled, by way of the file system interface, to data residing in the file system at the datacenter server, where the data is in the form of a virtual synthetic that includes respective portions of data from each of a plurality of backups residing at the datacenter.

Abstract: In one example, a method includes receiving, at a client where a version of a file is locally stored, an inversion patch concerning the local file version, the inversion patch including original content of one or more byte ranges that embrace changes reflected in the locally stored version of the file version that were made subsequent to creation of a target version of the file with which the locally stored file version is associated, unlocking the local file version, and applying the inversion patch to the unlocked local file version to create a restored file version that matches the target version of the file. The restored file version is then saved.

Abstract: In one example, a method for a distributed model of data ingestion includes receiving multiple asynchronous backup requests from a plurality of clients, and performing primary processing with respect to data elements of a first one of the backup requests. Next, a job concerning a secondary process is added to a job queue. A handoff is then made for performance of the secondary processing with respect to data elements of the first backup request. The job is then accessed and the secondary processing is performed with respect to the data elements of the backup request, wherein the primary processing and secondary processing are respective first and second stages of an ingestion process, and the primary processing is performed prior to the secondary processing.

Abstract: In one example, a method includes receiving a most recent backup version of client data, marking the most recent backup version to indicate that the most recent backup version has no expiration time, determining a currency span of an earlier backup version that is the backup version whose creation time is next most recent after a creation time of the most recent backup version, identifying all curtains in the currency span, each of the curtains being associated with a respective rule concerning a life of the earlier backup version, applying each of the rules to the earlier backup version, and whichever rule whose application results in the latest expiration time for the earlier backup version is the controlling rule, and assigning an expiration time to the earlier backup version according to the controlling rule.

Abstract: In one example, a method includes defining one or more curtains, each of which corresponds to a respective one or more designated points in time, using a calendar that is common to all of the curtains, defining one or more backup policies, defining, for each of the one or more backup policies, a respective set of one or more rules, associating each of the one or more backup policies with a respective curtain, and applying, to a backup version whose currency span includes one of the curtains, one of the backup policies that is associated with that curtain.

Abstract: In one example, a method includes receiving, from a client, a request for file system information, transmitting the requested file system information to the client, receiving, from the client, a request for data that includes a portion of a file that resides at the datacenter, where the file is compatible for use by an application residing at the client, where the request for data specifies a particular byte range associated with the file, and where the byte range spans a group of different backups of a baseline dataset residing at the datacenter. The example method further includes creating a virtual synthetic that is formed by the data in the requested byte range and includes respective portions of data from each of the group of backups residing at the datacenter, and transmitting the virtual synthetic to the client.

Abstract: In one example, a method includes accessing a manifest that includes a listing of available versions of a dataset, selecting a dataset from the manifest, mounting the selected dataset, running an application that is associated with the dataset, requesting a specific subset of data of the mounted dataset, receiving the requested subset of data, performing a file system operation involving a change to the subset of data, and backing up the change to the subset of data.

Abstract: In one example, a method for a distributed model of data ingestion includes receiving multiple asynchronous backup requests from a plurality of clients, and performing primary processing with respect to data elements of a first one of the backup requests. Next, a job concerning a secondary process is added to a job queue. A handoff is then made for performance of the secondary processing with respect to data elements of the first backup request. The job is then accessed and the secondary processing is performed with respect to the data elements of the backup request, wherein the primary processing and secondary processing are respective first and second stages of an ingestion process, and the primary processing is performed prior to the secondary processing.

Abstract: Systems and methods for securing objects in a computing environment. Objects are encrypted using keys that are also encrypted after encrypting the objects. In order to access the objects, a master key that is unknown to the service storing the objects and/or managing the keys is used to decrypt the keys so that the objects can be decrypted with the decrypted key. Thus, a key is needed to access the key needed to access the object. The master key is typically maintained separately from all of the encrypted objects and corresponding encrypted keys.

Abstract: Systems and methods for securing objects in a computing environment. Objects are encrypted using keys that are also encrypted after encrypting the objects. In order to access the objects, a master key that is unknown to the service storing the objects and/or managing the keys is used to decrypt the keys so that the objects can be decrypted with the decrypted key. Thus, a key is needed to access the key needed to access the object. The master key is typically maintained separately from all of the encrypted objects and corresponding encrypted keys.

Abstract: In one example, a method includes defining a token protocol, creating, based on the token protocol, a set of tokens, each of the tokens being associated with data of an encrypted dataset, where the tokens exclude positional information regarding the data with which they are associated, encrypting the tokens, and creating an encrypted search index that includes the encrypted tokens.

Abstract: In one example, a method includes receiving, at a datacenter, a request from a client, where the request identifies a data range required by an application residing at the client, and the data range embraces less than all the contents of a file, backed up at the datacenter, with which the data range is associated. The example method further includes accessing the data in the data range, and transmitting data in the data range to the client, where the data transmitted to the client from the datacenter comprises respective portions of multiple incremental backups stored at the datacenter.

Abstract: In one example, a method includes receiving a most recent backup version of client data, marking the most recent backup version to indicate that the most recent backup version has no expiration time, determining a currency span of an earlier backup version that is the backup version whose creation time is next most recent after a creation time of the most recent backup version, identifying all curtains in the currency span, each of the curtains being associated with a respective rule concerning a life of the earlier backup version, applying each of the rules to the earlier backup version, and whichever rule whose application results in the latest expiration time for the earlier backup version is the controlling rule, and assigning an expiration time to the earlier backup version according to the controlling rule.

Abstract: In one example, a method includes defining one or more curtains, each of which corresponds to a respective one or more designated points in time, using a calendar that is common to all of the curtains, defining one or more backup policies, defining, for each of the one or more backup policies, a respective set of one or more rules, associating each of the one or more backup policies with a respective curtain, and applying, to a backup version whose currency span includes one of the curtains, one of the backup policies that is associated with that curtain.

Abstract: In one example, a method is provided for data restore request and data assembly processes. Initially, a data range required by an application residing is identified at the client. The data range can embrace less than all the contents of a file with which the data range is associated. Next, a request is formulated at the client that includes the identified data range, and the request is then transmitted to a datacenter where the file was previously backed up. The requested data is subsequently transmitted from the data center to the client in an unassembled form. The client then assembles the received data and is able to perform various operations on the assembled data.