Rubrik, Inc.

Google Inc.

Hao Wu

Xiang Xu

Nikhil Rao

Anshul Mohan Gupta

Adam Coimbra

Ian Baker

Jay Akkad

Seungyeop Han

Kevin Mu

Shrihari Kalkar

Michael Wronski

Zhebin Zhang

Prasanta Ranjan Dash

Xiaoqing Tao

Sean Lobo

Anam Bhatia

Lokesh Jagasia

Sai Tanay Desaraju

Tiffany Lin

Alex Medovar

Xiaopeng Xu

Arvind Swaminathan

Arohi Kumar

David Anthony Terei

Sai Kiran Katuri

Prateek Pandey

Pragyan Chakraborty

Michelle Nguyen

Jinshuo Zhang

Jordan Marcell Barkley

Secure digital assistant integration with web pages is provided. The system receives an intent manifest data structure that maps actions of a digital assistant with link templates of an electronic resource developed by a third-party developer device. The system validates the electronic resource based on the intent manifest data structure. The system receives, from a data exchange component of an iframe of the electronic resource loaded by a client computing device, an identifier of the client computing device. The system receives a foreground state of the electronic resource from an onsite state sharing API. The system selects a data value for a parameter based on the foreground state and the intent manifest data structure. The system provides the data value. An authorization component generates an authorization prompt, receives input, and transmits the data value to an onsite intent execution API of the electronic resource to execute an action.

Secure digital assistant integration in web pages

Methods, systems, and devices for data management are described. A data management system (DMS) may receive a federated login request from a user associated with one or more tenants of the DMS. The DMS may direct the federated login request to a centralized management service. The DMS may receive a security assertion markup language (SAML) assertion that indicates an identity of the user, a set of object-level permissions assigned to the user, and an identifier of a first tenant associated with the user. The DMS may identify one or more computing objects in a cluster of storage nodes that correspond to the first tenant based on the identifier from the SAML assertion. The DMS may determine that the user is authorized to perform a set of actions on the one or more computing objects based on the set of object-level permissions indicated by the SAML assertion.

Federated login mechanisms for multi tenant role based access control

Methods, systems, and devices for data management are described. A multi-tenancy data management system (DMS) may include multiple computing objects organized as a hierarchy of computing objects. The DMS may receive a request for report data associated with a first set of computing objects of the DMS. The DMS may identify context information for a log-in session associated with the request. The context information may include a tenant identifier (ID) for a tenant associated with the request. The DMS may apply a filter to the first set of computing objects. The filter may be based on a second set of computing objects to which the tenant has access within the hierarchy of computing objects. The DMS may output the report data for at least one computing object of the first set based on the at least one computing object being included in the second set of computing objects.

Access authorization for report data in a multi-tenancy data management system

Methods, systems, and devices for data management are described. A data management system (DMS) may create a first key family including a first key to encrypt and decrypt first data encryption keys associated with first data management jobs. The DMS may create a second key family after encrypting the first data encryption keys using the first key. A first key of the second key family may be used to encrypt and decrypt second data encryption keys that are associated with second data management jobs. The DMS may create a second key of both the first and second key families. The second key of the first key family may be used to decrypt the first data encryption keys. The second key of the second key family may be used to encrypt third data encryption keys and to decrypt the second data encryption keys and the third data encryption keys.

Unified key management

Methods, systems, and devices for data management are described. A data management system (DMS) may provide backup services for multiple tenants. The DMS may receive a request to provide a first user of the DMS with audit information associated with an entity of the DMS. The DMS may identify context information for a log-in session associated with the request. The context information may include an identifier (ID) of a tenant associated with the request. The DMS may identify, based on the ID of the tenant, authorization information associated with the tenant. The authorization information may indicate that the tenant has access to a set of entities within a hierarchy associated with the DMS. The DMS may determine whether to output the requested audit information to the first user based on a hierarchical relationship, within the hierarchy, between the tenant and the entity.

Access authorization for audit information in a multi-tenancy data management system

Methods, systems, and devices for data management are described. A data management system may configure backup and recovery resources for tenant of the data management system. The data management system may receive an indication to create a set of subtenants within the resources configured for the tenant. The data management system may assign a first subset of resources configured for the tenant, and the first subset may be different from a second subset configured for a second subtenant. The data management system may activate a first backup procedure for the first subtenant. The first backup procedure may be configured to backup a first data source associated with the first subtenant of the tenant using the first subset of the set of backup and recovery resources, and the first backup procedure may be separate from a second backup procedure for a second data source associated with the second subtenant.

Multi-tenancy for large scale data management

In some examples, a centralized management system comprises a central management console including a federated login system embedded in the centralized management system. The federated login system includes at least one processor configured to perform operations in a method of federated login and authorization allowing a user of the centralized management system to manage connected clusters or products without performing an individual cluster or product login.

Federated login with centralized control

A second data source may retrieve metadata for one or more versions of a set of versions of a file stored at the first data source. In some examples, the metadata for the one or more versions of the file may include at least an identifier of the file, a timestamp, and a cryptographic signature. In some examples, generation of the cryptographic signature may be based on the identifier of the file, the timestamp, and a cryptographic key. The second data source may identify a set of versions of the file that were uploaded from a trusted data source to the first data source based on a comparison of the cryptographic signature to a computed cryptographic signature. The second data source may then determine a targeted version of the file and retrieve the targeted version of the file from the first data source.

Techniques for data retrieval using cryptographic signatures

A method for updating configuration settings of a backup database supported by a data management system is described. The method may include receiving, from a first user in a first user group, a request to update configuration settings of the backup database. The method may further include determining that the first user is authorized to update the configuration settings of the backup database based on a set of permissions associated with the first user. The method may further include identifying a second user in a second user group that is authorized to approve the request from the first user. The method may further include transmitting an indication of the request to the second user and receiving a notification that the second user has approved the request from the first user. The method may further include updating the configuration settings of the backup database in response to the notification.

Two person rule enforcement for backup and recovery systems

Growing community of inventors

Mountain View, CA, United States of America

Hao Wu