US 2021/0173689 A1 · ASSOCIATING SECURITY TAGS TO CONTINUOUS DATA PROTECTION CHECKPOINTS/SNAPSHOTS/POINT-IN-TIME IMAGES

Abstract

An in-guest agent in a virtual machine (VM) operates in conjunction with a replication module. The replication module performs continuous data protection (CDP) by saving images of the VM as checkpoints at a disaster recovery site over time. Concurrently, the in-guest agent monitors for behavior in the VM that may be indicative of the presence of malicious code. If the in-guest agent identifies behavior (at a particular point in time) at the VM that may be indicative of the presence of malicious code, the replication module can tag a checkpoint that corresponds to the same particular point in time as a security risk. One or more checkpoints generated prior to the particular time may be determined to be secure checkpoints that are usable for restoration of the VM.

Claims21

Dependent claims

A method for a host in a virtualized computing environment to restore a virtual machine supported by the host, the method comprising:

performing, by the host, a replication process to store point-in-time images of the virtual machine at a storage location;
performing, by the host, a monitoring process concurrently with the replication process to monitor operational behavior of the virtual machine;
in response to the monitored operational behavior at a particular time being in violation of expected operational behavior of the virtual machine, identifying, by the host, a point-in-time image that corresponds to the particular time as an unsecure image with a security risk;
performing, by the host, an action on the unsecure image to restrict use of the unsecure image for restoration of the virtual machine;
and
using, by the host, a point-in-time image generated prior to the particular time and determined as being secure for the restoration of the virtual machine.

3 more elements

A non-transitory computer-readable medium having instructions stored thereon, which in response to execution by one or more processors, cause the one or more processors to perform or control performance of operations for a host in a virtualized computing environment to restore a virtual machine supported by the host, the operations comprising:

performing, by the host, a replication process to store point-in-time images of the virtual machine at a storage location;
performing, by the host, a monitoring process concurrently with the replication process to monitor operational behavior of the virtual machine;
in response to the monitored operational behavior at a particular time being in violation of expected operational behavior of the virtual machine, identifying, by the host, a point-in-time image that corresponds to the particular time as an unsecure image with a security risk;
performing an action on the unsecure image to restrict use of the unsecure image for restoration of the virtual machine;
and
using a point-in-time image generated prior to the particular time and determined as being secure for the restoration of the virtual machine.

3 more elements

A host in a virtualized computing environment, the host comprising:

a processor;
and
a non-transitory computer-readable medium coupled to the processor and having instructions stored thereon, which in response to execution by the processor, cause the processor to perform or control performance of operations for the host to restore a virtual machine supported by the host, wherein the operations include:
perform a replication process to store point-in-time images of the virtual machine at a storage location;
perform a monitoring process concurrently with the replication process to monitor operational behavior of the virtual machine;
in response to the monitored operational behavior at a particular time being in violation of expected operational behavior of the virtual machine, identify a point-in-time image that corresponds to the particular time as an unsecure image with a security risk;
perform an action on the unsecure image to restrict use of the unsecure image for restoration of the virtual machine;
and
use a point-in-time image generated prior to the particular time and determined as being secure for the restoration of the virtual machine.

6 more elements

Dependencies are inferred from the claim text.

Associating security tags to continuous data protection checkpoints/snapshots/point-in-time images

Life of this patent

Associating security tags to continuous data protection checkpoints/snapshots/point-in-time images

Life of this patent

Abstract

Claims21