# US 12,602,295 B2 · Isolated snapshot storage for fast ransomware recovery > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,602,295 B2 - Document ID: US12602295B2 - Status: Granted - Kind: B2 - Application number: 18/920,511 - Filed: 2024-10-18 - Published: 2026-01-08 - Granted: 2026-04-14 - Earliest claimed: 2024-07-05 - Assignees: NetApp, Inc. - Applicants: NetApp, Inc. - Inventors: Debabrata Chakraborty - Web page: https://patentgrep.com/patent/US12602295B2 ## CPC - G06F 11/1469: {Backup restoration techniques} - G06F 11/1448: {Management of the data involved in backup or backup restore} - G06F 21/568: {eliminating virus, restoring damaged files} - G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) - G06F 2201/84: Using snapshots, i.e. a logical point-in-time copy of the data - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A data vault system for quickly acquiring snapshots of primary storage of a data storage service and providing snapshots to the service for recovery. The data vault system is hosted on an isolated network with no communicative visibility from the storage service. The system is configured to minimize vulnerability to attackers by storing both data snapshots and data vault system configuration settings on the isolated network. Further, the snapshots are taken of primary storage, allowing for greatly improved performance compared to snapshots taken of backup data. The ports that facilitate communication between the data storage service and the data vault system can only be enabled from within the isolated network side, as the system is not visible from the data storage service. The system enables and disables ports before and after communication to the data storage service, minimizing vulnerability while the vault system both obtains and provides snapshots. ## Claims ### Claim 1 A method of operating a data vault system, comprising: receiving, by a configuration manager via a first port located on a switch in the data vault system, a snapshot recovery request corresponding to a data storage service; determining, based on the snapshot recovery request, to provide a snapshot to the data storage service to facilitate a snapshot recovery process; in response to determining to provide the snapshot, enabling a second port on the switch; retrieving the snapshot from a storage volume of the data vault system; transmitting, via the second port, the snapshot to provide the snapshot to the data storage service; and disabling the second port after transmitting the snapshot. ### Claim 2 (depends on 1) The method of claim 1, the method further comprising: hosting the data vault system on an isolated network remote to the data storage service. ### Claim 3 (depends on 2) The method of claim 2, the method further comprising: hosting the configuration manager on the isolated network. ### Claim 4 (depends on 3) The method of claim 3, the method further comprising: generating, in response to receiving the snapshot recovery request, a disable instruction; and transmitting the disable instruction to the configuration manager via the first port, wherein in response to receiving the disable instruction, the configuration manager enters a disabled state. ### Claim 5 (depends on 4) The method of claim 4, wherein the snapshot recovery request comprises a request for a snapshot of data contained within the data storage service. ### Claim 6 (depends on 5) The method of claim 5, wherein determining to provide the snapshot comprises: identifying, based on the snapshot recovery request, the snapshot, wherein the snapshot corresponds to content of the data storage service. ### Claim 7 (depends on 6) The method of claim 6, wherein retrieving the snapshot comprises: enabling a third port through which to retrieve the snapshot; acquiring the snapshot from the storage volume via the third port; and disabling the third port. ### Claim 8 A computing device, comprising: one or more computer readable storage media; one or more processors operatively coupled with the one or more computer readable storage media; and a data vault system comprising program instructions stored on the one or more computer readable storage media, wherein the program instructions, when executed by the one or more processors, direct the computing device to at least: receive, by a configuration manager via a first port located on a switch in the data vault system, a snapshot recovery request corresponding to a data storage service, determine, based on the snapshot recovery request, to provide a snapshot to the data storage service to facilitate a snapshot recovery process, in response to determining to provide the snapshot, enabling a second port on the switch; retrieve the snapshot from a storage volume of the data vault system, transmit, via the second port, the snapshot to provide the snapshot to the data storage service, and disable the second port on the switch after transmitting the snapshot. ### Claim 9 (depends on 8) The computing device of claim 8, wherein the program instructions further direct the computing device to: host the data vault system on an isolated network remote to the data storage service. ### Claim 10 (depends on 9) The computing device of claim 9, wherein the program instructions further direct the computing device to: host the configuration manager on the isolated network. ### Claim 11 (depends on 10) The computing device of claim 10, wherein the program instructions further direct the computing device to: generate, after the snapshot recovery request is received, a disable instruction; and transmit the disable instruction to the configuration manager via the first port, wherein in response to receiving the disable instruction, the configuration manager enters a disabled state. ### Claim 12 (depends on 11) The computing device of claim 11, wherein the snapshot recovery request comprises a request for a snapshot of data contained within the data storage service. ### Claim 13 (depends on 12) The computing device of claim 12, wherein the program instructions further direct the computing device to: identify, based on the snapshot recovery request, the snapshot, wherein the snapshot corresponds to content of the data storage service. ### Claim 14 (depends on 13) The computing device of claim 13, wherein the program instructions further direct the computing device to: enable a third port through which to retrieve the snapshot; acquire the snapshot from the storage volume via the third port; and disable the third port. ### Claim 15 One or more computer readable storage media having program instructions stored thereon that, when executed by one or more processors in a computing device, direct the computing device to at least: receive, by a configuration manager of a data vault system via a first port located on a switch in the data vault system, a snapshot recovery request corresponding to a data storage service; determine, based on the snapshot recovery request, to provide a snapshot to the data storage service to facilitate a snapshot recovery process; in response to determining to provide the snapshot, enabling a second port on the switch; retrieve the snapshot from a storage volume of the data vault system; transmit, via the second port, the snapshot to provide the snapshot to the data storage service; and disable the second port on the switch after transmitting the snapshot. ### Claim 16 (depends on 15) The one or more computer readable storage media of claim 15, wherein the program instructions further direct the computing device to: host the data vault on an isolated network remote to the data storage service. ### Claim 17 (depends on 16) The one or more computer readable storage media of claim 16, wherein the program instructions further direct the computing device to: host the configuration manager on the isolated network. ### Claim 18 (depends on 17) The one or more computer readable storage media of claim 17, wherein the program instructions further direct the computing device to: generate, after the snapshot recovery request is received, a disable instruction; and transmit the disable instruction to the configuration manager via the first port, wherein in response to receiving the disable instruction, the configuration manager enters a disabled state. ### Claim 19 (depends on 18) The one or more computer readable storage media of claim 18, wherein the snapshot recovery request comprises a request for a snapshot of data contained within the data storage service. ### Claim 20 (depends on 19) The one or more computer readable storage media of claim 19, wherein the program instructions further direct the computing device to: identify, based on the snapshot recovery request, the snapshot, wherein the snapshot corresponds to content of the data storage service.