Back to results
US 11,238,152 B2Granted
Data correlation using file object cache
AssigneeRubrik, Inc.
InventorsDi Wu, Chenyang Zhou, Shanthi Kiran Pendyala
Life of this patent
Estimating the term…
Abstract
Some examples relate generally to computer architecture software for data classification and information security and, in some more particular aspects, to verifying audit events in a file system.
Claims18
A data management system, comprising:
- at least one storage device storing a base file and one or more forward incremental files;
- a mini-filter including one or more processors in communication with the at least one storage device, the one or more processors configured to perform operations including:
- identifying audit events associated with user file accesses in a monitored computer system, the audit events including a create event and a subsequent event,
- the subsequent event including a read, write, or cleanup event;
- identifying a pair value including a user ID and remote IP address at the create event;
- associating the pair value with a file object id for the base file or the one or more forward incremental files;
- storing the associated file object id and pair value in a map in a file object cache in the at least one storage device;
- and
- retrieving the file object id from the file object cache at the subsequent event.
6 more elements
A computer-implemented method at a data management system, the method comprising:
- identifying audit events associated with user file accesses in a monitored computer system, the audit events including a create event and a subsequent event, the subsequent event including a read, write, or cleanup event;
- identifying a pair value including a user ID and remote IP address at the create event;
- associating the pair value with a file object id for the base file or the one or more forward incremental files;
- storing the associated file object id and pair value in a map in a file object cache in the at least one storage device;
- and
- retrieving the file object id from the file object cache at the subsequent event.
3 more elements
A non-transitory, machine-readable medium storing instructions which, when read by a machine, cause the machine to perform operations comprising, at least:
- identifying audit events associated with user file accesses in a monitored computer system, the audit events including a create event and a subsequent event, the subsequent event including a read, write, or cleanup event;
- identifying a pair value including a user ID and remote IP address at the create event;
- associating the pair value with a file object id for the base file or the one or more forward incremental files;
- storing the associated file object id and pair value in a map in a file object cache in the at least one storage device;
- and
- retrieving the file object id from the file object cache at the subsequent event.
3 more elements
Dependencies are inferred from the claim text.