Methods of and systems for virtual air-gapping network storage system

A system for providing virtual air-gapping of data in a network storage system, the system comprising:

• a computational device;
• a data storage medium;
• and
• one or more network interfaces, wherein the computational device is configured to:
• create a staging zone around a set of data within a global zone accessible over a network by the network storage system, the network storage system comprising a network data server;
• index the set of data within the staging zone of the network data server;
• reallocate the set of data in the staging zone, through at least one of a network file system and an operating system, by:
• transforming the set of data within the staging zone to become a staging dataset that is not mountable by the network data server;
• and
• creating a data vault containing vaulted data, the vaulted data being based on the staging dataset, the vaulted data being isolated from the global zone and logically disconnected from the network file system, the vaulted data further being accessible only to users that are permitted to access the vaulted data through an Application Programming Interface (API) of the network data server using a user encryption key;
• verify the vaulted data;
• and
• destroy the staging zone.

A method of providing a virtual air-gapping of data in a network storage system, the method comprising:

• creating a staging zone around a set of data that includes one or more files and a directory tree of files within a global zone accessible over a network by the network storage system, the network storage system comprising a network data server;
• indexing the set of data within the staging zone of the network data server, wherein the indexing the staging zone generates one or more manifest files and generates a hash for each of the one or more files and the directory of files;
• encrypting the one or more files and the directory tree of files;
• reallocating the set of data in the staging zone, through at least one of a network file system and an operating system, by:
• transforming the set of data within the staging zone to become a staging dataset that is not mountable by the network data server;
• reallocating the one or more manifest files;
• and
• creating a data vault containing vaulted data, the vaulted data being based on the staging dataset, the vaulted data being isolated from the global zone and logically disconnected from the network file system, the vaulted data further being accessible only to users that are permitted to access the vaulted data through an Application Programming Interface (API) of the network data server using a user encryption key;
• decrypting the one or more files and the directory tree of files;
• verifying the vaulted data, wherein the verifying the vaulted data includes:
• generating a vault manifest of the vaulted data;
• generating one or more vault hashes for each file in the vaulted data;
• and
• determining if the one or more manifest files match the one or more files;
• and
• destroying the staging zone.