# US 12,216,778 B2 · Distributing data amongst storage components using data sensitivity classifications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,216,778 B2 - Document ID: US12216778B2 - Status: Granted - Kind: B2 - Application number: 16/743,863 - Filed: 2020-01-15 - Published: 2021-07-15 - Granted: 2025-02-04 - Earliest claimed: 2020-01-15 - Assignees: EMC IP Holding Company LLC - Applicants: EMC IP Holding Company LLC - Inventors: Yossef Saad; Itay Glick - Web page: https://patentgrep.com/patent/US12216778B2 ## CPC - G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 3/062: {Securing storage systems} - G06F 3/0623: {in relation to content} - G06F 3/0649: {Lifecycle management} - G06F 3/065: {Replication mechanisms} - G06F 3/0659: {Command handling arrangements, e.g. command buffers, queues, command scheduling} - G06F 3/067: {Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]} - G06F 3/0685: {Hybrid storage combining heterogeneous device types, e.g. hierarchical storage, hybrid arrays} - G06F 11/1451: {by selection of backup contents} - G06F 16/13: File access structures, e.g. distributed indices (arrangements of input from, or output to, record carriers G06F3/06) - G06N 20/00: Machine learning - G06F 11/1448: {Management of the data involved in backup or backup restore} - G06F 2201/805: Real-time - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Described is a system for distributing data amongst storage components using data sensitivity (or security) classifications. The system may define categories for classifying data files and assign a sensitivity (or security) rating to each of the defined categories. The categories and/or associated sensitivity ratings may be determined using machine learning components that may leverage industry-specific information or data sensitivity information used by other clients. The system may then continuously reevaluate (or reclassify) data files to determine whether they are stored on a storage component that meets the necessary data sensitivity requirements. If the system determines particular data files are stored on a corresponding storage component that does not meet certain data sensitivity requirements, the system may perform an action to secure the particular data files. ## Claims ### Claim 1 A system comprising: one or more processors; and a non-transitory computer readable medium storing a plurality of instructions, which when executed, cause the one or more processors to: initialize a data distribution policy for a first client of a storage system including defining categories for classifying data files stored within one or more storage components of the storage system by analyzing attributes of the data stored within the one or more storage components, and assigning a data security rating to each of the defined categories, each of the categories describing a group of the data files based on a shared attribute of the data files, wherein defining the categories for classifying the data files associated with the first client is based on at least one of an industry associated with the first client, or categories used for a different set of data files associated with a second client of the storage system; determine, for each of the storage components, a security capability based on at least one or more network attributes or device attributes associated with the storage component, the security capability being associated with accessibility of the storage component and being proportional to a degree of security provided to the data files stored by the storage component, wherein security is associated with unauthorized access; scan the storage components to identify a stored first data file for reevaluation of whether the first data file is stored in an appropriate storage component having a security capability that corresponds to a data security rating of the first data file, the data security rating being proportional to a degree of protection from unauthorized access for the first data file; classify the first data file to a first category having an assigned data security rating from amongst the defined categories based on one or more attributes associated with the first data file; determine whether the data security rating which is assigned to the first category and which specifies a degree of protection required for the first data file against unauthorized access is satisfied by a degree of protection provided against unauthorized access as specified by the security capability for a first storage component that stores the first data file; and initiate an operation to secure the first data file, in response to determining the degree of protection required for the first data file against unauthorized access is not satisfied by the degree of protection provided against unauthorized access as specified by the security capability for the first storage component. ### Claim 2 (depends on 1) The system of claim 1, wherein the plurality of instructions, when executed, further cause the one or more processors to: determine the security capability for a second storage component corresponds to the data security rating assigned to the first category, in response to determining the data security rating assigned to the first category does not correspond to the security capability for the first storage component, and wherein the operation to secure the first data file includes storing data of the first data file within the second storage component as a second data file. ### Claim 3 (depends on 2) The system of claim 2, wherein the storing data of the first data file within the second storage component as the second data file includes: instructing a backup application to resend, to the storage system, the data of the first data file, the backup application directing storage of the data of the first data file to the second data file within the second storage component. ### Claim 4 (depends on 1) The system of claim 1, wherein the defining the categories includes: providing, as part of a set of inputs for a processing performed by a machine learning component, the attributes associated with the data files stored by the storage system; and receiving, as part of a set of outputs from the processing performed by the machine learning component, the defined categories for classifying data files stored within one or more storage components of a storage system, and the assigned data security ratings for each of the defined categories. ### Claim 5 (depends on 4) The system of claim 4, wherein the defining the categories further includes: providing, as part of the set of inputs for the processing performed by the machine learning component, an identifier for the industry associated with the first client. ### Claim 6 (depends on 4) The system of claim 4, wherein the defining the categories further includes: providing, as part of the set of inputs for the processing performed by the machine learning component, the categories or data security ratings used for the different set of data files associated with a second client of the storage system. ### Claim 7 (depends on 1) The system of claim 1, wherein the classifying the first data file to the first category based on one or more attributes associated with the first data file includes: determining, as at least one of the attributes, a file extension of a file associated with data stored within the first data file. ### Claim 8 (depends on 1) The system of claim 1, wherein the classifying the first data file to the first category based on one or more attributes associated with the first data file includes: performing a natural language processing of text of a file associated with data stored within the first data file to obtain at least one of the attributes. ### Claim 9 A method comprising: initializing a data distribution policy for a first client of a storage system including defining categories for classifying data files stored within one or more storage components of the storage system by analyzing attributes of the data stored within the one or more storage components, and assigning a data security rating to each of the defined categories, each of the categories describing a group of the data files based on a shared attribute of the data files, wherein defining the categories for classifying the data files associated with the first client is based on at least one of an industry associated with the first client, or categories used for a different set of data files associated with a second client of the storage system; determining, for each of the storage components, a security capability based on at least one or more network attributes or device attributes associated with the storage component, the security capability being associated with accessibility of the storage component and being proportional to a degree of security provided to the data files stored by the storage component, wherein security is associated with unauthorized access; scanning the storage components to identify a stored first data file for reevaluation of whether the first data file is stored in an appropriate storage component having a security capability that corresponds to a data security rating of the first data file, the data security rating being proportional to a degree of protection from unauthorized access for the first data file; classifying the first data file to a first category having an assigned data security rating from amongst the defined categories based on one or more attributes associated with the first data file; determining whether the data security rating which is assigned to the first category and which specifies a degree of protection required for the first data file against unauthorized access is satisfied by a degree of protection provided against unauthorized access as specified by the security capability for a first storage component that stores the first data file; and initiating an operation to secure the first data file, in response to determining the degree of protection required for the first data file against unauthorized access is not satisfied by the degree of protection provided against unauthorized access as specified by the security capability for the first storage component. ### Claim 10 (depends on 9) The method of claim 9, further comprising: determining the security capability for a second storage component corresponds to the data security rating assigned to the first category, in response to determining the data security rating assigned to the first category does not correspond to the security capability for the first storage component, and wherein the operation to secure the first data file includes storing data of the first data file within the second storage component as a second data file. ### Claim 11 (depends on 10) The method of claim 10, wherein the storing data of the first data file within the second storage component as the second data file includes: instructing a backup application to resend, to the storage system, the data of the first data file, the backup application directing storage of the data of the first data file to the second data file within the second storage component. ### Claim 12 (depends on 9) The method of claim 9, wherein the defining the categories includes: providing, as part of a set of inputs for a processing performed by a machine learning component, the attributes associated with the data files stored by the storage system; and receiving, as part of a set of outputs from the processing performed by the machine learning component, the defined categories for classifying data files stored within one or more storage components of a storage system, and the assigned data security ratings for each of the defined categories. ### Claim 13 (depends on 12) The method of claim 12, wherein the defining the categories further includes: providing, as part of the set of inputs for the processing performed by the machine learning component, an identifier for the industry associated with the first client. ### Claim 14 (depends on 12) The method of claim 12, wherein the defining the categories further includes: providing, as part of the set of inputs for the processing performed by the machine learning component, the categories or data security ratings used for the different set of data files associated with a second client of the storage system. ### Claim 15 A computer program product comprising a non-transitory computer-readable medium having a computer-readable program code embodied therein to be executed by one or more processors, the program code including instructions to: initialize a data distribution policy for a first client of a storage system including defining categories for classifying data files stored within one or more storage components of the storage system by analyzing attributes of the data stored within the one or more storage components, and assigning a data security rating to each of the defined categories, each of the categories describing a group of the data files based on a shared attribute of the data files, wherein defining the categories for classifying the data files associated with the first client is based on at least one of an industry associated with the first client, or categories used for a different set of data files associated with a second client of the storage system; determine, for each of the storage components, a security capability based on at least one or more network attributes or device attributes associated with the storage component, the security capability being associated with accessibility of the storage component and being proportional to a degree of security provided to the data files stored by the storage component, wherein security is associated with unauthorized access; scan the storage components to identify a stored first data file for reevaluation of whether the first data file is stored in an appropriate storage component having a security capability that corresponds to a data security rating of the first data file, the data security rating being proportional to a degree of protection from unauthorized access for the first data file; classify the first data file to a first category having an assigned data security rating from amongst the defined categories based on one or more attributes associated with the first data file; determine whether the data security rating which is assigned to the first category and which specifies a degree of protection required for the first data file against unauthorized access is satisfied by a degree of protection provided against unauthorized access as specified by the security capability for a first storage component that stores the first data file; and initiate an operation to secure the first data file, in response to determining the degree of protection required for the first data file against unauthorized access is not satisfied by the degree of protection provided against unauthorized access as specified by the security capability for the first storage component. ### Claim 16 (depends on 15) The computer program product of claim 15, wherein the program code includes further instructions to: determine the security capability for a second storage component corresponds to the data security rating assigned to the first category, in response to determining the data security rating assigned to the first category does not correspond to the security capability for the first storage component, and wherein the operation to secure the first data file includes storing data of the first data file within the second storage component as a second data file. ### Claim 17 (depends on 16) The computer program product of claim 16, wherein the storing data of the first data file within the second storage component as the second data file includes: instructing a backup application to resend, to the storage system, the data of the first data file, the backup application directing storage of the data of the first data file to the second data file within the second storage component. ### Claim 18 (depends on 15) The computer program product of claim 15, wherein the defining the categories includes: providing, as part of a set of inputs for a processing performed by a machine learning component, the attributes associated with the data files stored by the storage system; and receiving, as part of a set of outputs from the processing performed by the machine learning component, the defined categories for classifying data files stored within one or more storage components of a storage system, and the assigned data security ratings for each of the defined categories. ### Claim 19 (depends on 18) The computer program product of claim 18, wherein the defining the categories further includes: providing, as part of the set of inputs for the processing performed by the machine learning component, an identifier for the industry associated with the first client. ### Claim 20 (depends on 18) The computer program product of claim 18, wherein the defining the categories further includes: providing, as part of the set of inputs for the processing performed by the machine learning component, the categories or data security ratings used for the different set of data files associated with a second client of the storage system.