Back to results
US 11,455,409 B2Granted
Storage layer data obfuscation
AssigneePure Storage, Inc.
InventorsJames Fisher, Brian Gold, Taylor Ericson, Ronald Karr
Life of this patent
Estimating the term…
Abstract
Storage layer data obfuscation, including: determining a subset of a dataset to obfuscate in accordance with a security policy; generating, based at least in part on the security policy, an obfuscated snapshot of the dataset that is representative of the dataset with the subset of the dataset obfuscated; and sending, to a target computer system, the obfuscated snapshot from which a restored version of the dataset includes the subset of the dataset obfuscated.
Claims20
A method comprising:
- determining, by a processor during a write operation to a storage system, a sensitive subset of a dataset to obfuscate in accordance with a security policy;
- indicating in metadata for the dataset that the sensitive subset of the dataset is to be obfuscated;
- generating, by the storage system and according to the security policy and a schedule, an obfuscated snapshot of the dataset by obfuscating the sensitive subset of the dataset based on the metadata for the dataset, wherein the sensitive subset remains obfuscated to an untrusted target computer system at a time that the untrusted target computer system restores the dataset from the obfuscated snapshot, and wherein the obfuscated snapshot captures the state of the dataset at a specific point in time with the sensitive subset obfuscated;
- and
- providing, to one or more untrusted target computer systems, the obfuscated snapshot for restoration of the dataset corresponding to the specific point in time with the sensitive subset of the dataset obfuscated at the one or more untrusted target computer systems.
2 more elements
An apparatus comprising:
- a computer processor configured to implement an obfuscation engine;
- and
- a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions implementing the obfuscation engine that, when executed by the computer processor, cause the apparatus to perform:
- determining, by the computer processor during a write operation to a storage system, a sensitive subset of a dataset to obfuscate in accordance with a security policy;
- indicating in metadata for the dataset that the sensitive subset of the dataset is to be obfuscated;
- generating, by the storage system and according to the security policy and a schedule, an obfuscated snapshot of the dataset by obfuscating the sensitive subset of the dataset based on the metadata for the dataset, wherein the sensitive subset remains obfuscated to an untrusted target computer system at a time that the untrusted target computer system restores the dataset from the obfuscated snapshot, and wherein the obfuscated snapshot captures the state of the dataset at a specific point in time with the sensitive subset obfuscated;
- and
- providing, to one or more untrusted target computer systems, the obfuscated snapshot for restoration of the dataset corresponding to the specific point in time with the sensitive subset of the dataset obfuscated at the one or more untrusted target computer systems.
5 more elements
A computer program product disposed upon a non-transitory computer readable medium, the computer program product comprising computer program instructions that, when executed, cause a computer to perform:
- determining, by a processor during a write operation to a storage system, a sensitive subset of a dataset to obfuscate in accordance with a security policy;
- indicating in metadata for the dataset that the sensitive subset of the dataset is to be obfuscated;
- generating, by the storage system and according to the security policy and a schedule, an obfuscated snapshot of the dataset by obfuscating the sensitive subset of the dataset based on the metadata for the dataset, wherein the sensitive subset remains obfuscated to an untrusted target computer system at a time that the untrusted target computer system restores the dataset from the obfuscated snapshot, and wherein the obfuscated snapshot captures the state of the dataset at a specific point in time with the sensitive subset obfuscated;
- and
- providing, to one or more untrusted target computer systems, the obfuscated snapshot for restoration of the dataset corresponding to the specific point in time with the sensitive subset of the dataset obfuscated at the one or more untrusted target computer systems.
2 more elements
Dependencies are inferred from the claim text.