Comm Vault Systems, Inc.

Gopikannan Venugopalsamy

Pavan Kumar Reddy Bedadala

Manoj Kumar Pradhan

Hemant Mishra

Dmitriy Borisovich Zakharkin

Hetalkumar N Joshi

Divakar Radhakrishnan

Jayasree Yakkala

Rohit Sivadas

Sanath Kumar

Sunil Babu Telagamsetti

Parag Gokhale

Prakash Varadharajan

Pavlo Mazur

Marcelo Dos Reis Mansano

Ankur Varsheny

Amit Mitkar

Sumedh Pramod Degaonkar

Arun Prasad Amarendran

Yongtao Liu

Jitin Jindal

Chandan Singh

Backup data is leveraged to determine whether primary data has been encrypted by malware. The disclosed approach does not rely on recognizing particular malware instances or malware provenance, and thus can be applied to any body of data. Even a novel and previously unknown malware attack can be detected in this way. An illustrative data storage management system analyzes secondary copies it created over time, applies a multi-factor analysis to data recovered from the secondary copies and, based on the analysis, infers whether the primary data from which the secondary copies were created may be encrypted. The present approach uses successive versions of backup copies to find indicia of malware encryption, rather than trying to trace or identify the malware itself. Indicia of entropy correlate highly with encryption, such as encryption performed by malware attacks. Conversely, indicia of similarity correlate highly with lack of encryption of successive versions of documents.

Analysis of backup copies to identify malware-encrypted primary data

Certain embodiments disclosed herein reduce or eliminate a communication bottleneck at the storage manager by reducing communication with the storage manager while maintaining functionality of an information management system. In some implementations, a client obtains information for enabling a secondary storage job (e.g., a backup or restore) from a storage manager and stores the information (which may be referred to as job metadata) in a local cache. The client may then reuse the job metadata for multiple storage jobs reducing the frequency of communication with the storage manager. When a configuration of the information management system changes, or the availability of resources changes, the storage manager can push updates to the job metadata to the clients. Further, a client can periodically request updated job metadata from the storage manager ensuring that the client does not rely on out-of-date job metadata.

Network storage backup using distributed media agents

Indexing preferences generally associate each data source with a type of indexing technology and/or with an index/catalog and/or with a computing device that hosts the index/catalog for tracking backup data generated from the source data. Indexing preferences govern which index/catalog receives transaction logs for a given storage operation. Thus, indexing destinations are defined granularly and flexibly in reference to the source data. Load balancing without user intervention assures that the various index/catalogs are fairly distributed in the illustrative backup systems by autonomously initiating migration jobs. Criteria for initiating migration jobs are based on past usage and going-forward trends. An illustrative migration job re-associates data sources with a different destination media agent and/or index/catalog, including transferring some or all relevant transaction logs and/or indexing information from the old host to the new host.

Heterogeneous indexing and load balancing of backup and indexing resources

Failover systems and methods for performing backup operations, including heterogeneous indexing and load balancing of backup and indexing resources

Multi-tiered backup indexing

Certain embodiments described herein relate to an improved information management system that can perform provider-specific data protection methods for cloud-stored data. In one embodiment, the information management system accesses a pod specification that indicates information usable to execute a containerized application on behalf of a user, and determines the cloud provider system configured to provide one or more computing resources for execution the containerized application. Using a provider-specific interface that is specific to the determined cloud provider system, the information management system creates a snapshot of a cloud storage volume associated with the containerized application and accesses the data inside the snapshot. The accessed data is stored onto a secondary storage device, and the snapshot is removed from the cloud provider system, thereby providing an efficient backup solution for the data used for executing the containerized application on the container orchestrator system.

Platform-agnostic containerized application data protection

Certain embodiments disclosed herein reduce or eliminate a communication bottleneck at the storage manager by reducing communication with the storage manager while maintaining functionality of an information management system. In some implementations, operations performed as part of a backup process may be stored in transaction logs. These transaction logs may include information about a transaction performed between the client computing system and the network storage that hosts the backup of the client computing system. The transaction logs may be provided to a secondary storage system that can be used to form a backup index. The backup index may be used to facilitate accessing the data stored at the network storage. Advantageously, generating the transaction logs and separating the generation of the backup index from the backup process can reduce resource usage during performance of the backup and speed up the backup process while further reducing interaction with the storage manager.

Transaction log index generation in an enterprise backup system

Backup-based media agent configuration

Client managed data backup process within an enterprise information management system

Growing community of inventors

Sunnyvale, CA, United States of America

Gopikannan Venugopalsamy