# US 10,503,610 B1 · Methods and systems for software protection within an isolated environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,503,610 B1 - Document ID: US10503610B1 - Status: Granted - Kind: B1 - Application number: 15/724,010 - Filed: 2017-10-03 - Granted: 2019-12-10 - Earliest claimed: 2017-10-03 - Assignees: EMC IP Holding Company LLC - Applicants: EMC IP Holding Company LLC - Inventors: Jehuda Shemer; Assaf Natanzon - Web page: https://patentgrep.com/patent/US10503610B1 ## CPC - G06F 11/1464: {for networked environments} - G06F 11/1453: {using de-duplication of the data} - G06F 11/1458: {Management of the backup or restore process} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/725: {operating on a secure reference time value} - G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract According to some embodiments, an isolated storage system determines whether a secure network has been activated for data backup or data replication of a storage system. In response to determining that the secure network has been activated, the isolated storage system instantiates an instance of a backup software to perform the data backup or data replication of the storage system. The isolated storage system performs the data backup or data replication of the storage system via the instance of the backup software. ## Claims ### Claim 1 A computer-implemented method for software protection in an isolated environment, the method comprising: determining whether a secure network has been activated for data backup or data replication of a storage system; in response to determining that the secure network has been activated, instantiating an instance of a backup software to perform the data backup or data replication of the storage system; performing the data backup or data replication of the storage system via the instance of the backup software; determining whether the secure network has been deactivated; and destroying the instance of the backup software in response to determining that the secure network has been deactivated. ### Claim 2 (depends on 1) The method of claim 1, further comprising: in response to determining that the secure network has been activated, operating in a sleep or hibernation mode; wherein performing the data backup or data replication of the storage system via the instance of the backup software comprises receiving, via the instance of the backup software, backup data from the storage system, and storing the backup data to an intermediate storage. ### Claim 3 (depends on 2) The method of claim 2, further comprising: subsequent to destroying the instance of the backup software, resuming from the sleep or hibernation mode, retrieving and verifying the backup data from the intermediate storage, and storing the verified data to a protected region of a storage device as a protected copy if the backup data passes the verification. ### Claim 4 (depends on 1) The method of claim 1, wherein determining whether the data backup or data replication of the storage system has been completed comprises determining whether a predetermined time window has expired, wherein the secure network is only activated during the predetermined time window. ### Claim 5 (depends on 1) The method of claim 1, wherein the backup software is stored on a read-only memory (ROM) of a system situated within the isolated environment. ### Claim 6 A computer-implemented method for software protection in an isolated environment, the method comprising: determining whether a secure network has been activated for data backup or data replication of a storage system, wherein the secure network includes an air gap that is activated based on a scheduled time period, wherein the air gap is only activated during a predetermined time window; in response to determining that the secure network has been activated, instantiating an instance of a backup software to perform the data backup or data replication of the storage system; and performing the data backup or data replication of the storage system via the instance of the backup software. ### Claim 7 A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor, cause the processor to perform operations for, the operations comprising: determining whether a secure network has been activated for data backup or data replication of a storage system; in response to determining that the secure network has been activated, instantiating an instance of a backup software to perform the data backup or data replication of the storage system; performing the data backup or data replication of the storage system via the instance of the backup software; determining whether the secure network has been deactivated; and destroying the instance of the backup software in response to determining that the secure network has been deactivated. ### Claim 8 (depends on 7) The non-transitory machine-readable medium of claim 7, wherein the operations further comprise: in response to determining that the secure network has been activated, operating in a sleep or hibernation mode; wherein performing the data backup or data replication of the storage system via the instance of the backup software comprises receiving, via the instance of the backup software, backup data from the storage system, and storing the backup data to an intermediate storage. ### Claim 9 (depends on 8) The non-transitory machine-readable medium of claim 8, wherein the operations further comprise: subsequent to destroying the instance of the backup software, resuming from the sleep or hibernation mode, retrieving and verifying the backup data from the intermediate storage, and storing the verified data to a protected region of a storage device as a protected copy if the backup data passes the verification. ### Claim 10 (depends on 7) The non-transitory machine-readable medium of claim 7, wherein determining whether the data backup or data replication of the storage system has been completed comprises determining whether a predetermined time window has expired, wherein the secure network is only activated during the predetermined time window. ### Claim 11 (depends on 7) The non-transitory machine-readable medium of claim 7, wherein the backup software is stored on a read-only memory (ROM) of a system situated within the isolated environment. ### Claim 12 A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor, cause the processor to perform operations for, the operations comprising: determining whether a secure network has been activated for data backup or data replication of a storage system, wherein the secure network includes an air gap that is activated based on a scheduled time period, wherein the air gap is only activated during a predetermined time window; in response to determining that the secure network has been activated, instantiating an instance of a backup software to perform the data backup or data replication of the storage system; and performing the data backup or data replication of the storage system via the instance of the backup software. ### Claim 13 A system comprising: a secure network; a first storage system configured to backup data from or restore data to one or more client systems; a second storage system communicatively coupled to the first storage system over the secure network, the second storage system comprising: a processor; and a memory coupled to the processor to store instructions, which when executed by the processor, cause the processor to perform operations, the operations comprising: determining whether the secure network has been activated for data backup or data replication of the first storage system; in response to determining that the secure network has been activated, instantiating an instance of a backup software to perform the data backup or data replication of the first storage system; performing the data backup or data replication of the first storage system via the instance of the backup software; determining whether the secure network has been deactivated; and destroying the instance of the backup software in response to determining that the secure network has been deactivated. ### Claim 14 (depends on 13) The system of claim 13, wherein the operations further comprise: in response to determining that the secure network has been activated, operating in a sleep or hibernation mode; wherein performing the data backup or data replication of the first storage system via the instance of the backup software comprises receiving, via the instance of the backup software, backup data from the first storage system, and storing the backup data to an intermediate storage. ### Claim 15 (depends on 14) The system of claim 14, wherein the operations further comprise: subsequent to destroying the instance of the backup software, resuming from the sleep or hibernation mode, retrieving and verifying the backup data from the intermediate storage, and storing the verified data to a protected region of a storage device of the second storage system as a protected copy if the backup data passes the verification. ### Claim 16 (depends on 13) The system of claim 13, wherein determining whether the data backup or data replication of the first storage system has been completed comprises determining whether a predetermined time window has expired, wherein the secure network is only activated during the predetermined time window. ### Claim 17 (depends on 13) The system of claim 13, wherein the backup software is stored on a read-only memory (ROM) of the second storage system, and the second storage system is situated within an isolated environment. ### Claim 18 A system comprising: a secure network; a first storage system configured to backup data from or restore data to one or more client systems; a second storage system communicatively coupled to the first storage system over the secure network, the second storage system comprising: a processor; and a memory coupled to the processor to store instructions, which when executed by the processor, cause the processor to perform operations, the operations comprising: determining whether the secure network has been activated for data backup or data replication of the first storage system, wherein the secure network includes an air gap that is activated based on a scheduled time period, wherein the air gap is only activated during a predetermined time window; in response to determining that the secure network has been activated, instantiating an instance of a backup software to perform the data backup or data replication of the first storage system; and performing the data backup or data replication of the first storage system via the instance of the backup software.