# US 12,007,849 B2 · System and method for securing instant access of data in file based backups in a backup storage system using metadata files > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,007,849 B2 - Document ID: US12007849B2 - Status: Granted - Kind: B2 - Application number: 17/486,064 - Filed: 2021-09-27 - Published: 2023-03-30 - Granted: 2024-06-11 - Earliest claimed: 2021-09-27 - Assignees: EMC IP Holding Company LLC - Applicants: EMC IP Holding Company LLC - Inventors: Sunil Yadav; Shelesh Chopra; Ravi Vijayakumar Chitloor - Web page: https://patentgrep.com/patent/US12007849B2 ## CPC - G06F 11/1464: {for networked environments} - G06F 11/1451: {by selection of backup contents} - G06F 11/1458: {Management of the backup or restore process} - G06F 11/1469: {Backup restoration techniques} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 2201/84: Using snapshots, i.e. a logical point-in-time copy of the data - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Embodiments described herein relate to a method for managing file based backups (FBBs). The method may include obtaining a FBB mount request for a FBB mount of a FBB from an application, wherein the application is executing in a production host environment and the FBB is stored on backup storage; in response to the FBB mount request: enabling access to a portion of the FBB by the application; notifying a cyber sense device that the access is enabled; providing, to the cyber sense device, a storage location of the portion of the FBB for which access was enabled; receiving, from the cyber sense device, a security event notification; and performing, in response to the security event notification, a security action set. ## Claims ### Claim 1 A method for managing file based backups (FBBs), the method comprising: obtaining, by a FBB metadata file manager, a FBB mount request for a FBB mount of a FBB from an application, wherein the application is executing in a production host environment and the FBB is stored on backup storage; in response to the FBB mount request: enabling, by the FBB metadata file manager, access to a portion of the FBB by the application; notifying, by the FBB metadata file manager, a cyber sense device that the access is enabled; providing, by the FBB metadata file manager and to the cyber sense device, a storage location of the portion of the FBB for which access was enabled; receiving, by the FBB metadata file manager and from the cyber sense device, a security event notification; and performing, by the FBB metadata file manager and in response to the security event notification, a security action set. ### Claim 2 (depends on 1) The method of claim 1, wherein the FBB comprises file system data and the FBB metadata file. ### Claim 3 (depends on 1) The method of claim 1, wherein the security action set comprises disabling the access to the portion of the FBB. ### Claim 4 (depends on 1) The method of claim 1, wherein the security action set comprises discarding writes made by the application to the portion of the FBB. ### Claim 5 (depends on 1) The method of claim 1, wherein the cyber sense device sends the security event notification after detecting a security event. ### Claim 6 (depends on 5) The method of claim 5, wherein the detecting of the security event by the cyber sense device is based on an analysis of a write being passed through the cyber sense device. ### Claim 7 (depends on 5) The method of claim 5, wherein the detecting of the security event by the cyber sense device is based on an analysis of a behavior pattern during the enabled access. ### Claim 8 (depends on 1) The method of claim 1, wherein enabling the access to the portion of the FBB comprises storing a FBB virtual file system in the production host environment. ### Claim 9 (depends on 1) The method of claim 1, wherein enabling the access to the portion of the FBB comprises: initiating, by the FBB metadata file manager, generation of a temporary storage device; and storing a copy of the portion of the FBB in the temporary storage device. ### Claim 10 A non-transitory computer readable medium comprising computer readable program code, which when executed by a computer processor enables the computer processor to perform a method for managing file based backups (FBBs), the method comprising: obtaining, by a FBB metadata file manager, a FBB mount request for a FBB mount of a FBB from an application, wherein the application is executing in a production host environment and the FBB is stored on backup storage; in response to the FBB mount request: enabling, by the FBB metadata file manager, access to a portion of the FBB by the application; notifying, by the FBB metadata file manager, a cyber sense device that the access is enabled; providing, by the FBB metadata file manager and to the cyber sense device, a storage location of the portion of the FBB for which access was enabled; receiving, by the FBB metadata file manager and from the cyber sense device, a security event notification; and performing, by the FBB metadata file manager and in response to the security event notification, a security action set. ### Claim 11 (depends on 10) The non-transitory computer readable medium of claim 10, wherein the FBB comprises file system data and the FBB metadata file. ### Claim 12 (depends on 10) The non-transitory computer readable medium of claim 10, wherein the security action set comprises disabling the access to the portion of the FBB. ### Claim 13 (depends on 10) The non-transitory computer readable medium of claim 10, wherein the security action set comprises discarding writes made by the application to the portion of the FBB. ### Claim 14 (depends on 10) The non-transitory computer readable medium of claim 10, wherein the cyber sense device sends the security event notification after detecting a security event. ### Claim 15 (depends on 14) The non-transitory computer readable medium of claim 14, wherein the detecting of the security event by the cyber sense device is based on an analysis of a write being passed through the cyber sense device. ### Claim 16 (depends on 14) The non-transitory computer readable medium of claim 14, wherein the detecting of the security event by the cyber sense device is based on an analysis of a behavior pattern during the enabled access. ### Claim 17 (depends on 10) The non-transitory computer readable medium of claim 10, wherein enabling the access to the portion of the FBB comprises storing a FBB virtual file system in the production host environment. ### Claim 18 (depends on 10) The non-transitory computer readable medium of claim 10, wherein enabling the access to the portion of the FBB comprises: initiating, by the FBB metadata file manager, generation of a temporary storage device; and storing a copy of the portion of the FBB in the temporary storage device. ### Claim 19 A system for managing file based backups (FBBs), the system comprising: a processor comprising circuitry; memory; and a FBB metadata file manager executing using the processor and the memory, operatively connected to a cyber sense device, and configured to: obtain a FBB mount request for a FBB mount of a FBB from an application, wherein the application is executing in a production host environment and the FBB is stored on backup storage; in response to the FBB mount request: enable access to a portion of the FBB by the application; notify the cyber sense device that the access is enabled; provide, to the cyber sense device, a storage location of the portion of the FBB for which access was enabled; receive, from the cyber sense device, a security event notification; and perform, in response to the security event notification, a security action set. ### Claim 20 (depends on 19) The system of claim 19, wherein the security action set comprises disabling the access to the portion of the FBB and discarding writes made by the application to the portion of the FBB.