EP2758898A1 - Procédé et appareil de gestion d'événement dans un système à plateformes multiples - Google Patents

Procédé et appareil de gestion d'événement dans un système à plateformes multiples

Info

Publication number
EP2758898A1
EP2758898A1 EP11770878.4A EP11770878A EP2758898A1 EP 2758898 A1 EP2758898 A1 EP 2758898A1 EP 11770878 A EP11770878 A EP 11770878A EP 2758898 A1 EP2758898 A1 EP 2758898A1
Authority
EP
European Patent Office
Prior art keywords
platform system
event
events
platform
data
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
EP11770878.4A
Other languages
German (de)
English (en)
Inventor
Yakov Faitelson
Ohad Korkus
Ophir Kretzer-Katzir
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Varonis Systems Inc
Original Assignee
Varonis Systems Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Varonis Systems Inc filed Critical Varonis Systems Inc
Publication of EP2758898A1 publication Critical patent/EP2758898A1/fr
Ceased legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10—File systems; File servers
    • G06F16/17—Details of further file system functions
    • G06F16/1734—Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs

Definitions

  • the present disclosure generally relates to file access events, and more specifically, to handling file access events in a multi-platform system.
  • Distributed multi-platform computerized systems are in common use. For example, in banking, investment houses, large corporations or others such as the military.
  • Such systems may include, for example, from tens of platforms to thousands of platforms, with a rate of millions or about a billion file accesses per hour.
  • One exemplary embodiment of the disclosed subject matter is a system for event handling in a multi-platform system, comprising a process installed in platforms of the multi-platform system for intercepting events of file access in the multi-platform system, and an at least one server connected to an at least one platform, the at least one server configured for acquiring events intercepted by the process and for processing the events by an at least one rule for deciding an action responsive to the event while taking into account an auxiliary data that is provided separately from event acquisition
  • Another exemplary embodiment of the disclosed subject matter is a method for event handling in a multi-platform system, comprising acquiring an event of a file access in the multi-platform system, processing the event taking account of an auxiliary data to decide or determine an action and optionally activating the action.
  • a platform implies a computer having data resources such as folders or files, possibly shared with another computer, wherein different platforms may be of different apparatus and/or software and possibly with different organization of the data objects or resources.
  • platforms may be different computer types running under different operating systems and using different file systems.
  • a platform is connected to one or more other platforms forming various connection patterns, such as interconnected clusters of platforms where the clusters are linked therebetween.
  • a server implies a computer additional or complementary to the multi-platform system.
  • a database implies any data structure additional or complementary to the data resources or objects of the multi-platform system, not precluding a conventional database of the art nor lookup tables.
  • a reference to an operating-system implies any software operative to control functions of a computer and particularly controlling access the file-system, such as Windows, Linux, MacOS or others.
  • a reference to a file-system implies any repository or organization of data objects or data resources in a platform or shared among a plurality of platforms.
  • referring to a file implies any data object or data resource of a file-system, for example, attachment within an email or a link to a web page or an ordinary file as used in the art.
  • an event is referred to as used in the art of computers and software, such as an interrupt, a signal or a procedure call, generally asynchronous yet without precluding a synchronous event.
  • a distributed multi-platform computerized system is referred to as a multi-platform system.
  • Fig. 1 schematically illustrates a system for event handling in a multi-platform system, according to exemplary embodiments of the disclosed subject matter
  • FIG. 2 schematically illustrates normalized event record, according to exemplary embodiments of the disclosed subject matter.
  • FIG. 3 schematically outlines operations in handling events from a multi-platform system, according to exemplary embodiments of the disclosed subject matter.
  • One technical problem dealt by the disclosed subject matter is responding in realtime to intercepted file access events in a multi-platform system.
  • Another technical problem dealt by the disclosed subject matter is condensing and reducing the amount of data related to intercepted file access events in a multi-platform system.
  • Yet another technical problem dealt by the disclosed subject matter is handling intercepted file access events in a multi-platform system in or according to an extended or expansive context beyond the event per se.
  • One technical solution according to the disclosed subject matter is linking or coupling to each platform or a part thereof a process that intercepts file access events.
  • Information of or related to events in one or in a group of platforms is monitored by a server, also referred to as a 'probe', connected to one platform or to each of the platforms in the group.
  • the information of the events is handled by the probe, thereby relieving the platform of the overload of processing the events information, thereby enabling to handle and respond in real-time to the events in the multi-platform system.
  • additional probes are connected to the platforms, reducing the burden on each probe and balancing the processing loads, thereby providing a scalable scheme for load balancing of responding to real-time events in a multi-platform system.
  • Another technical solution according to the disclosed subject matter is a process operating in the probes or in apparatus linked to the probes that, in conjunction with a data structure such as table or database, discard redundant data of intercepted events and/or abbreviate redundant data of intercepted events in a related code.
  • an accessed object is assigned a unique code, thereby avoiding repeatedly recording the full path string of the object.
  • an abbreviated unique code for that user name is used, thereby avoiding repeatedly recording the full name of that user.
  • Yet another technical solution according to the disclosed subject matter is one or more data structures, such as a database, stored in a server connected to the probes and/or in the probes, the one or more data structures holding auxiliary or extraneous or disjoint information with respect to the events.
  • the event may be handled and/or analyzed in a wider context of the multi-platform system or beyond.
  • an object such as a folder may be noted in the data structure as being of sensitive data to the organization.
  • an event is generated in a platform storing that object and the event is monitored or captured by a probe.
  • the data of the event that includes the object path, or code thereof, is checked with respect to the data in the data structure, and in case the object is recognized as sensitive further actions may be performed.
  • the data in the data structure may be predefined or may be determined or modified according to events or other operations in the multi-platform system.
  • the auxiliary or extraneous information may be incrementally updated in the course of operation of the multi-platform system. For example, if a particular user is repeatedly accessing a particular file within a certain time, the information is updated to that effect in the data structure. Consecutively, upon further event of access to that file by that user, as captured by a probe, the information in the data structure is consulted and further access to that file may be prevented from that user.
  • a potential technical effect of the disclosed subject matter is a multi -platform system that handles in real-time file access events within an extended context beyond the data included in the events.
  • real-time generally implies a sufficiently fast operation responsive to an event accomplished before another event occurs.
  • Operations on a file of a file-system such as a creation or deletion of a file or reading from or writing into a file, and in some cases modifying attributes of a file such as read-only, are generally well-defined procedures of an operating-system and/or a file- system.
  • Such operations on a file may be tracked, for example, by services of the operating-system, or by using API (Application Programming Interface), or by 'hooking' onto the file operation procedure, or any other method offered by the operating-system and/or the file-system.
  • API Application Programming Interface
  • Obtaining information on the occurrence and nature of a file operation is collectively referred to herein as 'file operation capturing', or, for brevity, as 'capturing', or variants thereof.
  • An event may be generated by capturing the file operation.
  • the operating-system and/or the file-system generate the events.
  • an event includes or is accompanied by or supplied with data, referred to as the event data.
  • the event data is also implied when an event is referred to.
  • the event data comprise items, or indications or references thereof, such as the accessed file with a partial of a full path, referred to as file path, the user who accessed the file, type of the event according to the performed operation such as open or delete, the time of the operations, referred to as a time stamp, the location or platform where the event originated, or any other data associated with the event such as the destination of the event in case of copying or moving, or any combination thereof.
  • a platform comprises or is linked to or is coupled with a process that captures the file operations and generates events, or, altematively, the process intercepts events generated by the operating-system and/or file-system.
  • the process is also referred to herein as a 'driver'.
  • the events are acquired from one or more drivers by a server that operates as an agent for the multi-platform system with regard to events, the server or agent are also referred to herein as a 'probe'.
  • the probe inquires a driver of events, or, alternatively, the driver sends events to the probe.
  • a combination of inquiry and receiving of events by the probe is used.
  • probe may be connected to one platform or to a plurality of platforms. In some embodiments, a plurality of probes is used, each probe connected to a different plurality of platforms, optionally with connections redundancy.
  • the probe stores the event data in a database according to a storage regime, such as responsive to events, or periodically such as once an hour or a day.
  • all the probes are connected to the same database.
  • a plurality of databases is used, optionally accessible by all the probes.
  • the database comprises information about the files or other information regarding the multi-platform system or any other auxiliary or disjoint information with respect to the events.
  • the database is supplied with information gathered during the operation of the multi-platform system and/or by the probe. For example, file permissions, classifications of the files such as sensitivity of groups, or identity of users who accessed certain files and in what rate or within what time interval, or removal or introductions of users to the multi-platform system.
  • the probe Upon acquiring an event the probe checks the event data, possibly also with respect to the data in the database, and performs one or more operations according to one or more rules, resembling, to a limited extent, mailbox rules of email clients of the art.
  • a rule may read like: if a deleted file is marked as sensitive, then generate an alert; consequently, suspending the operation unless acknowledged by an authorized user.
  • FIG. 1 schematically illustrates an event handling system 100 in a multi-platform system 190, according to exemplary embodiments of the disclosed subject matter, wherein the arrows between the components of event handling system 100 generally indicate data flow between the components.
  • Multi-platform system 190 comprises a plurality of instances of a platform 110, representing any number of platform 110, as indicated by broken lines 192 and 194.
  • Platform 1 10 comprises an operating-system 114 and a file-system 1 16, or to that effect, any structure and/or mechanism for holding, managing and accessing data objects.
  • the event handling system 100 comprises a server as a probe 120 connected to one or more platforms such as platform 110, representing any number of platform 1 10 connected to probe 120, as indicated by dotted lines 192.
  • the illustrated two instances of probe 120 represent any number of probes, such as probe 120, connected to any number of platforms, such as platform 1 10, as indicated by a dashed line 194.
  • Probe 120 comprises or coupled with or linked to one or more rules, collectively referred to as rules 122.
  • Rules 122 use events or event data, or part thereof, as parameters or arguments for logic or a procedure of rules 122, according to which an action is decided or determined.
  • Platform 1 10 comprises a process denoted as a driver 1 12 that generates and/or intercepts file access events in platform 1 10, generally and without limiting referred to as 'intercepting'. The events are provided to and/or acquired by probe 120.
  • driver 112 is not necessarily installed in or coupled with each platform 1 10 but, rather, driver 1 12 is installed in or coupled with any platform 1 10 having accessible files or for which file access events are being handled.
  • probe 120 responsive to obtaining an event, executes the rules 122 using the obtained event as parameter for the procedural logic of rules 122. In case an action is decided by rules 122, probe 120 performs the action or invokes or initiates in or delegates the decided action to other components of event handling system 100 or multi-platform system 190.
  • using probe 120 to process and handle events reduces processing load on multi-platform system 190 and/or minimizes or reduces intervention with the operation of multi-platform system 190 where driver 1 12 non-intrusively captures event of file access in multi-platform system 190.
  • probe 120 obtains events from platform 1 10 via another component or components such as proxy servers that reduce communication load in event handling system 100 and/or reduce processing load by pre-processing such as filtering events before reaching probe 120.
  • another component or components such as proxy servers that reduce communication load in event handling system 100 and/or reduce processing load by pre-processing such as filtering events before reaching probe 120.
  • probe 120 stores the events in a database 130, enabling further reference and/or analysis thereof.
  • probe 120 stores the events via a proxy such as a server and/or via intermediate storage such as a cache.
  • database 130 is implemented on a server or any other apparatus, where database 130 represents any kind of storage repository or organization, possibly split or distributed in a plurality of servers or apparatuses.
  • events are stored in a structure or apparatus different or separate from where auxiliary data, further explained below, is stored.
  • auxiliary data further explained below, is stored.
  • either storage apparatus or structures are referred to as database 130.
  • the events are stored using condensed forms and/or structures as described below.
  • rules 122 are not necessarily stored in probe 120 and, alternatively or additionally, rules 122 may be stored in another apparatus such as a server linked to probe 120. It is noted that driver 1 12 is not necessarily stored in platform 1 10 and, alternatively or additionally, driver 1 12 is stored in another apparatus such as a server linked to platform 1 10.
  • probe 120 is not necessarily a separate apparatus from platform 1 10 and, alternatively or additionally, probe 120 is comprised in platform 1 10 such as using an additional processor and memory thereof.
  • rules 122 use additional information for deciding an action.
  • the additional information also referred to as auxiliary data, is used in conjunction with the event data or as reference, thereby affecting or enabling to affect the procedural course of the logic or procedures of rules 122 and/or the decided actions.
  • the auxiliary data is stored in database 130 and/or in any apparatus or structure represented by database 130.
  • probe 120 responsive to obtaining an event, queries at database 130 for auxiliary data related to the event, and in case the auxiliary data is present in database 130, probe 120 retrieves the auxiliary data and incorporates the auxiliary data with rules 122.
  • probe 120 retrieves, optionally repeatedly or periodically, auxiliary data from database 130 and stores data according to a regime such as according to frequency of repeated events.
  • probe 120 caches data, optionally keeping cached auxiliary data related to frequent events.
  • the auxiliary data comprise information regarding files in the file-system of a platform or file-systems of a plurality of platforms.
  • the auxiliary data may include permissions to access a file-system or part thereof, memberships in groups related to file-system or part thereof, classification of files or group of files, classified such a sensitive or public, tagging of files for any purpose or history or recommendations, designated owners of files or group thereof, or any other data such as sandbox results, that is 'what if results, or a combination thereof.
  • some or part of the auxiliary data is preset before the operation of multi-platform system 190 and/or event handling system 100.
  • the auxiliary data or part thereof is provided from the operation of multi-platform system 190, as schematically illustrated by auxiliary data 140 and dashed arrow 142. For example, auditing or collecting history of activities of users with respect to files to generate permissions, or input by users.
  • the auxiliary data or part thereof is provided by operations of event handling system 100, such as records of events and/or results of rules 122, provided from probe 120.
  • database 130 is incrementally supplied or updated with auxiliary data during the operation of multi-platform system 190 and/or event handling system 100.
  • auxiliary data related to an event comprises at least a part of data that is related to or associated with a file or group of files, such as a file name, or location of destination that belongs to or relates to or associated with the file.
  • the events are stored in database 130 by probe 120 separately from the auxiliary data.
  • probe 120 is connected to and communicates with database 130 via a proxy such as a server; optionally the proxy caches some of the events data from probe 120 and/or auxiliary data from database 130.
  • a proxy such as a server; optionally the proxy caches some of the events data from probe 120 and/or auxiliary data from database 130.
  • probe 120 at least potentially facilitates rapid response or realtime response to events since multi-platform system 190 is relieved from processing the events.
  • Such redundant operations could adversely affect the response time and/or may necessitate additional processors, such as probe 120, in order to respond and process events in real-time.
  • items of multi- platform system 190 or and optionally of event handling system 100 are expressed or coded in a short forms or codes.
  • only items that are repeatedly referenced and/or determined to be repeatedly referenced are coded. Coding items is also referred to herein as 'normalization' or a variant thereof.
  • the codes are stored in a structure or structures such as lookup tables, optionally using or assisted by mechanisms for sufficiently rapid retrieval, such as binary trees or hash tables.
  • a structure or structures such as lookup tables, optionally using or assisted by mechanisms for sufficiently rapid retrieval, such as binary trees or hash tables.
  • UNC Universal Naming Convention
  • only the respective codes are recorded, thereby saving operation times and also storage overhead such as in multiple access to a storage and generally saving storage space.
  • Fig. 2 schematically illustrates normalized event record, according to exemplary embodiments of the disclosed subject matter.
  • the lookup tables 210 comprise strings indicated as 206 for file path, location and user names, respectively, and associated with codes 204 as binary numbers, shown for clarity as decimal numbers.
  • the codes are used to normalize an event record 202 using codes instead of the respective strings.
  • similar or redundant information is further reduced by condensing the information in a structure that reflects the repeated or similar information, an approach also referred to as aggregation.
  • a file F accessed N times by a user U within between time Tl and time T2 is recorded only once as N accesses in time interval T1-T2.
  • file F and user U are optionally recorded by respective codes thereof rather than full paths and names strings.
  • accessing records Rl, R2 and R3 in a database DB by a user U is not recorded three times but, rather, as DB and Rl, R2, R3 and user U, with optional time interval, and optionally, DB and user U are recorded as the respective codes thereof.
  • normalization data and structures are stored in database 130.
  • normalization data and structures, or part thereof is stored in auxiliary apparatus or storage, such as a proxy cache in probe 120 for rapid reference.
  • the events are stored in aggregated forms in database 130 separately of the auxiliary data and/or in combination with or the auxiliary data or part thereof.
  • auxiliary data is also normalized in codes or formed in aggregations, further decreasing the response and/or processing of events, enabling to reduce the number of probe 120, at least potentially.
  • rules 122 operate as 'if then else' construct.
  • rules 122 operate according to other constructs such as multi-branch or as inference machine.
  • rules 122 stored in probe 120 are executed in parallel or multi-tasking or multi-threading, optionally processing a plurality of events are processed, at least partially, in parallel.
  • rules 122 are arranged and/or operate according to one or more precedence criteria. For example, events from a user input are processed in precedence to events from a background database.
  • decisions and/or derived actions of rules 122 respective to an event are divided into three categories, namely, filter, alert and workflow, wherein the actions are optionally invoked or initiated in real-time responsive to an event or designed therefore.
  • the events are dropped or ignored, thereby saving processing time and storage space. For example, events related to temporary or trivial files, or events related to backup operations.
  • a message and/or a signal is sent to an appropriate user and/or destinations, such as by an email or by storing in an event log. For example, announcing to a supervisor user when someone tries to access a sensitive file or when a user that is a member of a particular group tries to access files or a different group.
  • a workflow action operation and/or operations are invoked or initiated.
  • the operations may be user-defined or otherwise defined and/or based on a computerized or software engine that can be extended or modified such as by API's or other system calls. For example, blocking permission to a user that deletes multiple files within a determined or a preset time interval.
  • FIG. 3 schematically outlines operations in handling events from a multi-platform system, according to exemplary embodiments of the disclosed subject matter.
  • an event from a distributed multi-platform computerized system is acquired or received such as in probe 120, the event intercepted and/or generated from the multi-platform system by way of driver 112.
  • the events implying also data thereof, are acquired in a condensed form such as a normalized form by codes.
  • auxiliary data or additional data disjoint of the event is retrieved, such as from database 130 or from any source optionally from a cache.
  • the event is processes, such as by rules 122, in view of or by taking into account the auxiliary data, optionally determining on one or more actions.
  • the determined action is initiated or carried out, optionally by an apparatus such as probe 120 or by another apparatus optionally comprised in multi-platform system 190.
  • the events in some embodiments implying also data thereof, is optionally stored such as in database 130, optionally in a condensed form by using codes and/or aggregations.
  • storing is carried out before and/or after processing or activation of the action, optionally performed based on a periodic regime or responsive to an event of a plurality of events.
  • auxiliary data may have been stored or cached together with the processing codes, such as rules 122, so that no further retrieval of the auxiliary data is performed.
  • the company receives information that one of the company's employees is about to leave the company. Asserting that the employee has access to sensitive information about the company, the administrator of the multi-platform system sets a rule, such as in rules 122, so that whenever the employee copies data that was flagged as sensitive, alert will is sent allowing spotting the employee and/or preventing copying the data by the employee.
  • a rule such as in rules 122
  • the administrator of the multi-platform system sets a rule, such as in rules 122, that if a user deleted more than three files within a minute on a folder that has permissions to 'everyone', this user's permissions will be removed, ensuring that the user will need to ask for access permissions afterwards.
  • a rule such as in rules 122
  • the techniques of the present disclosure is not limited to file access events but, in some embodiments, may be applied to other events or processes such as input-output events or communications between processes or apparatuses.
  • a system for event handling in a multi-platform system comprising a process installed in platforms of the multi-platform system for intercepting events of file access in the multi-platform system, and an at least one server connected to an at least one platform, the at least one server configured for acquiring events intercepted by the process and for processing the events by an at least one rule for deciding an action responsive to the event while taking into account an auxiliary data.
  • the auxiliary data is provided separately from acquisition of the events.
  • the auxiliary data comprises at least one of: a preset data related to the multi-platform system, a data accumulated responsive to the operation of the multi-platform system, or an updated data responsive to the operation of the multi-platform system, or any combination thereof.
  • the auxiliary data is stored in a database connected to the at least one server.
  • the database is stored on an at least one apparatus separate from the at least one server and from the multi-platform system.
  • the at least one server is configured to at least one of: acquire the events in a condensed form, process the events in a condensed form, store the events in a condensed form, or any combination thereof, thereby facilitating real-time response to the events.
  • the condensed form comprises at least one of coded event data or aggregated event data, or a combination thereof.
  • the at least one rule is stored in the at least one server, wherein, in some embodiments, the at least one server is configured to initiate an action decided by the at least one rule.
  • the at least one rule comprises a plurality of rules.
  • the at least one platform comprises a plurality of platforms.
  • the at least one server comprises a plurality of platforms.
  • the process is installed on each platform of the multi- platform system having accessible files. It is thus further provided in accordance with the disclosed subject matter is a method for event handling in a multi-platform system, comprising acquiring an event of a file access from the multi-platform system, processing the event taking account of an auxiliary data to decide an action and activating the action.
  • processing the event comprises using an at least one rule, wherein, in some embodiments, the at least one rule comprises a plurality of rules.
  • the auxiliary data comprises at least one of: a preset data related to the multi-platform system, a data accumulated responsive to the operation of the multi-platform system, or an updated data responsive to the operation of the multi-platform system, or any combination thereof.
  • acquiring an event is carried out on an at least server connected to and separate from the multi-platform system.
  • the at least one server is configured to at least one of: acquire the events in a condensed form, process the events in a condensed form, store the events in a condensed form, or any combination thereof, thereby facilitating real-time response to the events.
  • the condensed form comprises at least one of coded event data or aggregated event data, or a combination thereof.
  • the auxiliary data is stored in a database connected to the at least one server.
  • 'processor' or 'computer', or 'server' or system thereof are used herein as ordinary context of the art, such as a general purpose processor or a micro-processor, RISC processor, or DSP, possibly comprising additional elements such as memory or communication ports.
  • the terms 'processor' or 'computer' or derivatives thereof denote an apparatus that is capable of carrying out a provided or an incorporated program and/or is capable to controlling and/or accessing data storage apparatus and/or other apparatus such as input and output ports.
  • the terms 'processor' or 'computer' denote also a plurality of processors or computers connected, and/or linked and/or otherwise communicating, possibly sharing one or more other resources such as a memory.
  • the terms 'software', 'program', 'software procedure' or 'procedure' or 'software code' or 'code' may be used interchangeably according to the context thereof, and denote one or more instructions or directives or circuitry for performing a sequence of operations that generally represent an algorithm and/or other process or method.
  • the program is stored in or on a medium such as RAM, ROM, or disk, or embedded in a circuitry accessible and executable by an apparatus such as a processor or other circuitry.
  • the processor and program may constitute the same apparatus, at least partially, such as an array of electronic gates, such as FPGA or ASIC, designed to perform a programmed sequence of operations, optionally comprising or linked with a processor or other circuitry.
  • an array of electronic gates such as FPGA or ASIC
  • the term computerized apparatus or a similar one denotes an apparatus having one or more processors operable or operating according to a program.
  • configuring for a objective or a variation thereof implies using a software and/or electronic circuit designed and/or operable or operative to achieve the objective.
  • a module represents a part of a system such as a part program operating together with other parts on the same unit, or a program component operating on different unit, and a process represents a collection of operations for achieving a certain outcome.
  • each block in the flowchart or block diagrams may represent a module, segment, or portion of program code, which comprises one or more executable instructions for implementing the specified logical function(s).
  • illustrated operations may occur in deferent order or as concurrent operations instead of sequential operations to achieve the same or equivalent effect.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Databases & Information Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

L'invention concerne un procédé de gestion d'événement dans un système à plateformes multiples, lequel procédé consiste à acquérir un événement d'un accès à un fichier à partir du système à plateformes multiples, à traiter l'événement en prenant en compte des données auxiliaires pour décider d'une action et à activer l'action. L'invention concerne également un appareil pour réaliser ce procédé.
EP11770878.4A 2011-09-19 2011-09-19 Procédé et appareil de gestion d'événement dans un système à plateformes multiples Ceased EP2758898A1 (fr)

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/IL2011/000742 WO2013042102A1 (fr) 2011-09-19 2011-09-19 Procédé et appareil de gestion d'événement dans un système à plateformes multiples

Publications (1)

Publication Number Publication Date
EP2758898A1 true EP2758898A1 (fr) 2014-07-30

Family

ID=45688055

Family Applications (1)

Application Number Title Priority Date Filing Date
EP11770878.4A Ceased EP2758898A1 (fr) 2011-09-19 2011-09-19 Procédé et appareil de gestion d'événement dans un système à plateformes multiples

Country Status (3)

Country Link
EP (1) EP2758898A1 (fr)
CN (2) CN103858120B (fr)
WO (1) WO2013042102A1 (fr)

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020138501A1 (en) * 2000-12-30 2002-09-26 Dake Steven C. Method and apparatus to improve file management
US20080060080A1 (en) * 2005-12-29 2008-03-06 Blue Jungle Enforcing Access Control Policies on Servers in an Information Management System

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7512673B2 (en) * 2001-01-11 2009-03-31 Attune Systems, Inc. Rule based aggregation of files and transactions in a switched file system
EP1563389A4 (fr) * 2001-08-01 2008-06-25 Actona Technologies Ltd Reseau de partage de fichier virtuel
US7426515B2 (en) * 2002-01-15 2008-09-16 International Business Machines Corporation Edge deployed database proxy driver
CN1367439A (zh) * 2002-02-10 2002-09-04 苏州市蜗牛电子有限公司 多客户端互动的负载均衡方法及系统
US7711847B2 (en) * 2002-04-26 2010-05-04 Sony Computer Entertainment America Inc. Managing users in a multi-user network game environment
CN101515308A (zh) * 2009-03-31 2009-08-26 上海同济同捷科技股份有限公司 汽车产品数据管理系统及其协同设计方法
CN102073706B (zh) * 2010-12-30 2013-02-13 北京锐安科技有限公司 分布式文件存储系统和关系数据库的结合应用方法

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020138501A1 (en) * 2000-12-30 2002-09-26 Dake Steven C. Method and apparatus to improve file management
US20080060080A1 (en) * 2005-12-29 2008-03-06 Blue Jungle Enforcing Access Control Policies on Servers in an Information Management System

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of WO2013042102A1 *

Also Published As

Publication number Publication date
CN103858120B (zh) 2017-12-15
WO2013042102A1 (fr) 2013-03-28
CN107871003A (zh) 2018-04-03
CN103858120A (zh) 2014-06-11
CN107871003B (zh) 2021-12-14

Similar Documents

Publication Publication Date Title
US11561931B2 (en) Information source agent systems and methods for distributed data storage and management using content signatures
US11516289B2 (en) Method and system for displaying similar email messages based on message contents
EP2904495B1 (fr) Antémémoire a deux niveaux pour empreintes considérant la localité
JP6336675B2 (ja) 複数の異種データ管理システムからの情報資産メタデータを集約するためのシステム及び方法
US9183205B1 (en) User-based backup
US20120185445A1 (en) Systems, methods, and computer program products for identifying identical files
US8095509B2 (en) Techniques for retaining security restrictions with file versioning
EP3545431A1 (fr) Traitement d'extraction, de transformation et de charge (etl) déclenché par des événements
US20100306176A1 (en) Deduplication of files
US8510331B1 (en) System and method for a desktop agent for use in managing file systems
JP6576563B2 (ja) データオブジェクトを効率よく分類するシステム及び方法
JP2014529833A (ja) バックアップ及びアーカイビングのための企業及び私用データの自動分離
US10346361B2 (en) Method and apparatus for scalable events handling in a multi-platform system
JP2009181590A (ja) 選択的データバックアップ
EP2758898A1 (fr) Procédé et appareil de gestion d'événement dans un système à plateformes multiples
US11770388B1 (en) Network infrastructure detection
US9779237B2 (en) Detection of non-volatile changes to a resource

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20140327

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

DAX Request for extension of the european patent (deleted)
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: EXAMINATION IS IN PROGRESS

17Q First examination report despatched

Effective date: 20180627

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: EXAMINATION IS IN PROGRESS

APBK Appeal reference recorded

Free format text: ORIGINAL CODE: EPIDOSNREFNE

APBN Date of receipt of notice of appeal recorded

Free format text: ORIGINAL CODE: EPIDOSNNOA2E

APBR Date of receipt of statement of grounds of appeal recorded

Free format text: ORIGINAL CODE: EPIDOSNNOA3E

APAF Appeal reference modified

Free format text: ORIGINAL CODE: EPIDOSCREFNE

APBT Appeal procedure closed

Free format text: ORIGINAL CODE: EPIDOSNNOA9E

REG Reference to a national code

Ref country code: DE

Ref legal event code: R003

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION HAS BEEN REFUSED

18R Application refused

Effective date: 20221116