Abstract: Systems and methods for securing objects in a computing environment. Objects are encrypted using keys that are also encrypted after encrypting the objects. In order to access the objects, a master key that is unknown to the service storing the objects and/or managing the keys is used to decrypt the keys so that the objects can be decrypted with the decrypted key. Thus, a key is needed to access the key needed to access the object. The master key is typically maintained separately from all of the encrypted objects and corresponding encrypted keys.

Abstract: In one example, a method includes defining a token protocol, creating, based on the token protocol, a set of tokens, each of the tokens being associated with data of an encrypted dataset, where the tokens exclude positional information regarding the data with which they are associated, encrypting the tokens, and creating an encrypted search index that includes the encrypted tokens.

Abstract: In one example, a method for managing of generating information suitable for use in managing backed up data includes defining a sequence format that includes multiple numeric fields that are each associated with a respective partial definition of one or more designated points in time. One or more of the numeric fields are parameterized so that those numeric fields each embrace a range of possible values. A condition is then specified for one or more of the parameterized numeric fields. Finally, a sequence of designated points in time is generated by running a sequence definition that includes the conditions and parameterized numeric fields. Each designated point in time corresponds to a curtain that is associated with one or more rules which, when executed, assign an expiration time to one or more backup versions.

Abstract: In one example, a method includes receiving, at a client where a version of a file is locally stored, an inversion patch concerning the local file version, the inversion patch including original content of one or more byte ranges that embrace changes reflected in the locally stored version of the file version that were made subsequent to creation of a target version of the file with which the locally stored file version is associated, unlocking the local file version, and applying the inversion patch to the unlocked local file version to create a restored file version that matches the target version of the file. The restored file version is then saved.

Abstract: In one example, a method includes receiving, from a client, a request for file system information, transmitting the requested file system information to the client, receiving, from the client, a request for data that includes a portion of a file that resides at the datacenter, where the file is compatible for use by an application residing at the client, where the request for data specifies a particular byte range associated with the file, and where the byte range spans a group of different backups of a baseline dataset residing at the datacenter. The example method further includes creating a virtual synthetic that is formed by the data in the requested byte range and includes respective portions of data from each of the group of backups residing at the datacenter, and transmitting the virtual synthetic to the client.

Abstract: In one example, a method for searching data includes creating a set of tokens corresponding to data of an encrypted dataset, and then encrypting the tokens. Next, an encrypted search index is created that includes the encrypted tokens and that excludes any positional information concerning the data to which the encrypted tokens correspond. A query is then defined that includes one or more encrypted search tokens. Next, search results are received that identify any matches between the encrypted search tokens and the encrypted tokens of the encrypted search index. Finally, the data that corresponds to any identified tokens that match a token of the encrypted search index is decrypted.

Abstract: Systems and methods for securing objects in a computing environment. Objects are encrypted using keys that are also encrypted after encrypting the objects. In order to access the objects, a master key that is unknown to the service storing the objects and/or managing the keys is used to decrypt the keys so that the objects can be decrypted with the decrypted key. Thus, a key is needed to access the key needed to access the object. The master key is typically maintained separately from all of the encrypted objects and corresponding encrypted keys.

Abstract: In one example, a method is provided for creating an inversion patch that can be used to locally restore a file to an earlier version of that file. Initially, a datacenter receives information concerning a target file version that resides at the datacenter and that is associated with a file stored locally at a client. The information includes an identification of the file and an identification of the target file version. Next, byte ranges are identified that are affected by changes that took place with respect to the file after the target file version was created. The byte ranges are then combined to form a unified set of byte ranges. Finally, the original content of the byte ranges in the unified set is identified and used to create the inversion patch.

Abstract: In one example, a method for managing backed up data includes marking a current backup version to indicate that the current backup version has no expiration time, and then determining a currency span for a backup version that immediately precedes the current backup version. Next, one or more curtains crossed by the currency span are identified, each curtain being associated with a respective expiration rule. The expiration rules are then applied to the immediately preceding backup version, and an expiration time assigned to the immediately preceding backup version based on application of the expiration rules.

Abstract: In one example, a method is provided for presenting cloud based storage as a virtual synthetic. The method begins when file system information is requested from a datacenter server. The requested file system information is then received at the requesting client from the datacenter server. Next, the received file system information is presented at the client in the form of a virtual file system interface that makes the file system information appear as a local file system to a user at the client, notwithstanding that the file system is not actually present at the client. Finally, user access at the client is enabled, by way of the file system interface, to data residing in the file system at the datacenter server, where the data is in the form of a virtual synthetic that includes respective portions of data from each of a plurality of backups residing at the datacenter.

Abstract: In one example, a method is provided for presenting cloud based storage as a virtual synthetic using a FUSE module at a client. Initially, a FUSE interface of a FUSE module to request file system information from a datacenter server. After the requested file system information has been received, it is presented, with the FUSE interface, in the form of a file system interface that represents a FUSE file structure. Next, the FUSE module requests a portion of a file that resides at the datacenter. The request specifies a particular byte range associated with the file, and the byte range spans less than the entire file. The received data form a virtual synthetic that includes respective portions of data from each of a plurality of backups residing at the datacenter, and the file system interface enables client access to the virtual synthetic.

Abstract: In one example, a method is provided for backing up client data at a datacenter. Initially, an incremental backup is received from a client and stored at the datacenter. Next, a table of contents for the incremental backup is created, and differences identified between the incremental backup and a dataset previously stored at the datacenter. The offsets imposed by any new or modified blocks present in the incremental backup can then be identified and recorded, and used to identify respective data ranges in the incremental backup for any new and modified blocks, which data ranges can then be recorded. Next, a reference block can be created for each block of the previously stored dataset that was not modified in the incremental backup. The reference block can then be stored at the datacenter in association with the incremental backup.