Permissions for backup-related operations

Abstract

Example techniques for granting permission to perform an operation related to a backup copy are described. The backup copy corresponds to first device data, and the first device data is stored in a first device. In one example, in response to receiving a request to perform an operation related to the backup copy, telemetry data received from the first device is analyzed. Based on the analysis, it is determined that security of the first device is not compromised. Based on the determination, permission to perform the operation related to the backup copy is granted.

Description

Technical Field

[0001] Data stored in computing devices may become unavailable for various reasons, such as data corruption or deletion. To completely prevent data loss due to unavailability, backup copies of the data can be used to restore the data from the computing device. These backup copies can be stored remotely relative to the computing device, for example, on a cloud storage device. Attached Figure Description

[0002] The following detailed description refers to the accompanying drawings, in which:

[0003] Figure 1 The diagram illustrates a system for licensing backup-related operations according to an example implementation of this disclosure;

[0004] Figure 2 The diagram illustrates a network environment that implements the system as a permission to perform backup-related operations, according to an example implementation of this disclosure.

[0005] Figure 3 The illustration shows a network environment for security verification of a first device to permit backup-related operations, according to an example implementation of this disclosure;

[0006] Figure 4 The illustration shows a method for performing backup-related operations for a license, according to an example implementation of this disclosure;

[0007] Figure 5 The diagram illustrates a method for performing backup-related operations according to an example implementation of this disclosure; and

[0008] Figure 6 The illustration depicts a computing environment for licensing non-transitory computer-readable media to perform backup-related operations, based on an example implementation of this disclosure. Detailed Implementation

[0009] For example, data stored on a computing device may become unusable due to malware present on the device. Ransomware, for instance, is a type of malware that encrypts files on a computing device, preventing users from accessing them. After a ransom is paid, the key used to decrypt the files can be provided to the user.

[0010] If data becomes unavailable, a backup copy can be used to restore it. However, in some cases, a backup copy may also become unusable. For example, this could be if malware spreads to the backup copy during the backup process, rendering it unusable by means of modification or deletion.

[0011] This disclosure relates to licensing of backup-related operations. Utilizing the implementation methods of this disclosure, backup copies can be prevented from becoming unusable due to malware attacks.

[0012] According to one example implementation, a request can be received to authorize the execution of operations related to the backup copy. Operations related to the backup copy, also referred to as backup-related operations, can include, for example, the creation, modification, or deletion of the backup copy. The backup copy may correspond to first-device data stored on a first device. Furthermore, the backup copy may be stored on a second device. In one example, the first-device data may relate to a virtual machine (VM) hosted on the first device, and the backup copy may be a VM image from which the VM can be restored.

[0013] In response to a received request, telemetry data received from the first device is analyzed. The telemetry data may include information about operations performed on the first device. For example, the telemetry data may include login attempt information, number of file encryption attempts, number of file deletion attempts, workload parameters of the hardware components of the first device (which may be, for example, a processor, memory, and storage devices), or any combination thereof. In one example, telemetry data received within a specific time period relative to the time of the requested reception is analyzed. For example, telemetry data received in a first time period before the time of the request, telemetry data received in a second time period after the time of the request, or both are analyzed. In one example, the analysis of the telemetry data may be performed by a system that periodically receives telemetry data from the first device to identify or predict the occurrence of faults in the first device.

[0014] Based on the analysis, it is determined whether the security of the first device has been compromised. For example, if the number of login attempts within a specific time period exceeds the average number of login attempts, it can be determined that the security of the first device has been compromised. If it is determined that the security of the first device has not been compromised, backup-related operations are permitted. To grant permission for execution, in one example, a token grant can be transmitted to the first device, which can then send the token to the second device. Based on the token, the second device can perform backup-related operations. If the security of the first device is determined to be compromised, the request to perform backup-related operations is denied.

[0015] In one example, to determine whether the security of the first device has not been compromised, in addition to analyzing telemetry data, a security handshake-based authentication can be utilized. To perform security handshake-based authentication, the system analyzing the telemetry data can also attempt to establish a security handshake with the first device. In response to the establishment of the security handshake, the system can determine that the security of the first device has not been compromised.

[0016] This disclosure can prevent the loss or unusability of backup copies due to malware attacks on computing devices storing parent data (i.e., the data corresponding to the backup copy). Therefore, backup copies can be protected from malware attacks on the computing devices storing parent data. This disclosure utilizes telemetry data from the computing device sending requests for backup-related operations to determine whether the security of the computing device has been compromised. Therefore, this disclosure can provide a simpler and more effective determination related to the security of the computing device. Furthermore, this disclosure can utilize telemetry data received from the computing device to identify and predict failures. Therefore, the computing device may require little or no additional data to implement this disclosure.

[0017] The following description refers to the accompanying drawings. Where possible, the same reference numerals are used in the drawings and the following description to refer to the same or similar parts. Although several examples are described, modifications, adaptations, and other implementations are possible and are intended to be covered herein.

[0018] Figure 1 The illustration shows a system 100 for performing operations related to backup copying, according to an example implementation of this disclosure. System 100 can be implemented as a computing device, such as a desktop computer, laptop computer, server, etc. System 100 includes a processor 102 and a memory 104 coupled to the processor 102.

[0019] Processor 102 can be implemented as a microprocessor, microcomputer, microcontroller, digital signal processor, central processing unit, state machine, logic circuit, and / or any device capable of manipulating signals based on operating instructions. Among other capabilities, processor 102 can fetch and execute computer-readable instructions included in memory 104. Computer-readable instructions may include instructions 106-112. The functionality of processor 102 can be provided using dedicated hardware and hardware capable of executing machine-readable instructions.

[0020] Memory 104 may include any non-transitory computer-readable medium, including volatile memory (e.g., RAM) and / or non-volatile memory (e.g., EPROM, flash memory, memristor, etc.). Memory 104 may also be an external memory unit, such as a flash memory drive, an optical disc drive, an external hard disk drive, etc.

[0021] In addition to processor 102 and memory 104, system 100 may also include (multiple) interfaces and system data ( Figure 1(Not shown in the image). The interfaces (multiple) can include various instruction-based interfaces and hardware interfaces that permit interaction with users and with other communication and computing devices, such as network entities, web servers, external repositories, and peripheral devices. System data can be used as a repository for storing data that can be acquired, processed, received, or created by instructions.

[0022] In operation, instruction 106 can be executed to receive a request for permission to perform operations related to the backup copy. Operations related to the backup copy can also be referred to as backup-related operations and can be, for example, backup creation, backup modification, or backup deletion operations. The request can also be referred to as a permission request. The backup copy can correspond to a first device ( Figure 1 The first device data is stored in a device (not shown in the image). For example, a backup copy could be an exact copy of the first device data. The backup copy could also be stored in a second device (not shown in the image). Figure 1 (Not shown in the image). In one example, the first device data and backup copy may include data corresponding to the first device. Furthermore, the backup copy may be an image from which the first device can restore itself to its operational state. For example, the first device data and backup copy may include data corresponding to a virtual machine (VM) hosted on the first device. Data corresponding to the VM may include, for example, files, folders, applications, and operating system (OS) of the VM. Therefore, the backup copy may be a VM image from which VMs can be instantiated. A license request may be sent by the first device to system 100.

[0023] In response to a request, telemetry data received from the first device is analyzed. In one example, the telemetry data may indicate operations performed on the first device, workload information of the first device's hardware components, data read counts of the first device, data write counts of the first device, the number of failed attempts to perform backup-related operations, backup policies, or combinations thereof. The data may include, for example, first device data. Operations performed on the first device may be, for example, the number of login attempts, the number of file encryption attempts, the number of file modifications, the number of file deletions, or combinations thereof. Workload information of the hardware components may include, for example, the workload of the first device's processor, the workload of the first device's memory, the number of input / output operations per second (IOPS) of the first device's storage device, or combinations thereof. Data read counts and data write counts represent the number of times data was read and written, respectively. The number of failed attempts to perform backup-related operations helps track previously identified backup problems. As will be explained later, for example, if the security of the first device is determined to have been compromised, attempts to perform backup-related operations may have failed. The backup policy of the first device may indicate the frequency of backup creation operations (i.e., how frequently backup copies are created), the backup retention period (i.e., how long backup copies will be retained), and the backup target (i.e., the location where backup copies are to be stored). In one example, telemetry data (rather than the backup policy) may include an identifier for the backup policy. Furthermore, system 100 may already have the backup policy and identifier stored therein. Therefore, upon receiving the identifier as part of the telemetry data, system 100 can retrieve and analyze the backup policy.

[0024] In one example, system 100 can analyze telemetry data received within a first time period (also referred to as the "first time period"). The first time period can be defined relative to the time when the request is received. For example, system 100 can analyze telemetry data received within the first time period before the request is received. As an alternative or supplement to analyzing telemetry data received within the first time period before the request is received, system 100 can analyze telemetry data received within a second time period after the request is received. When instruction 108 is executed, the analysis of the telemetry data can be performed.

[0025] Based on the analysis, it is determined whether the security of the first device has been compromised. For example, the security of the first device may be compromised due to a malware attack. When instruction 110 is executed, a determination related to the security of the first device is performed. If it is determined that the security of the first device has not been compromised, permission to perform backup-related operations is granted. To grant permission, system 100 may transmit a token indicating permission to the first device. Permission can be granted when instruction 112 is executed.

[0026] Figure 2The diagram illustrates a network environment 200 that implements system 100 as a network environment capable of performing backup-related operations. Network environment 200 includes a first device 202. In one example, the first device 202 may be a server computer. In another example, the first device 202 may be a hyperconverged infrastructure device in which computing, storage, and networking are integrated. The first device 202 may be provided in a data center or remote site, such as an offshore drilling platform. The first device 202 may have first device data 204 stored therein. The first device data 204 may include files, folders, etc. In one example, the first device data 204 may be associated with a VM hosted in the first device 202. Figure 2 (Not shown in the image) The corresponding data. In another example, the first device data 204 may be the data corresponding to the first device 202.

[0027] Network environment 200 also includes a second device 206 for storing backup copies of parent data stored in other devices. For example, the second device 206 may store a backup copy 208 corresponding to the first device data 204. The backup copy 208 may include a copy, replica, image, etc., of the first device data 204. In one example, the backup copy 208 may be a VM image hosted in the first device 202 from which a VM can be restored, or it may be an image from which the first device 202 can be restored. The second device 206 may include a storage device for storing the backup copy. Figure 2 (Not shown in the image), such as a hard drive or solid-state drive (SSD). In one example, the first device 202 may be an edge device, while the second device 206 may be a core device corresponding to the edge device. The core device corresponding to the edge device may refer to a device that can receive data from the edge device for further processing, can instruct the edge device to perform computing tasks, or both. Compared to the edge device, the core device may have more storage capacity, and therefore can store backup copies from the edge device.

[0028] When the first device data 204 becomes unavailable, it can be restored from the backup copy 208 in the first device 202. For example, the unavailability of the first device data 204 may be due to a problem with the storage device of the first device 202. Figure 2Unusable data on the first device 202 may be caused by damage, unintentional deletion, etc. (not shown in the image). Inaccessibility may also be due to compromised security of the first device 202. For example, the first device 202 may be infected with ransomware, which could lead to encryption of the data within the first device 202. In some cases, compromised security of the first device 202 may also affect the backup copy 208. For example, ransomware infected with the first device 202 may cause the deletion of the backup copy 208. Ransomware may also modify the backup copy 208, such as by causing the deletion of parts of the backup copy 208, encryption of the backup copy 208, or modification of the metadata of the backup copy 208, making it impossible for the data on the first device 204 to be recovered from the backup copy 208. Ransomware may also create an encrypted backup copy 206 in the second device 206 by instructing the second device to store an encrypted backup copy. The key used for encryption may be known to the creator of the ransomware rather than the user of the first device 202. Therefore, encryption renders the backup copy unusable. Ransomware can also cause the creation of new backup copies, which replace (and thus delete) undamaged backup copies, such as backup copy 208.

[0029] To help prevent the deletion, modification, or replacement of the backup copy 208 that could compromise the security of the first device 202, in one example, the first device 202 includes a backup processing engine 209. In one example, the backup processing engine 209 can be executed by the processor of the first device 202 by executing a set of group instructions (...). Figure 2 (Not shown in the image) This is implemented. The backup processing engine 209 receives requests to perform backup-related operations. The backup processing engine 209 can receive requests related to backup-related operations from, for example, a user of the first device 202 or a storage management device 210 that manages backup copies of data corresponding to the data in the first device 202. In the latter case, the storage management device 210 can send the request based on, for example, a backup policy or instructions from a storage administrator. In one example, if the first device 202 is attacked by malware, the malware can send a request to the backup processing engine 209.

[0030] In one example, the request may specify the backup-related operation to be performed. The request may also specify the name of the device data or the name of the backup copy corresponding to the backup-related operation. For example, the request may specify that a new backup copy of the first device data 204 will be created or that backup copy 208 will be deleted. Upon receiving a request, the backup processing engine 209 sends a permission request 212 to the system 100 to permit the execution of the backup-related operation. In one example, the permission request 212 may specify the backup-related operation to be performed and may specify either the name of the device data or the name of the backup copy, i.e., the first device data 204 or backup copy 208, or both corresponding to the backup-related operation. By sending a permission request to the system 100 in response to each received request, the backup processing engine 209 can prevent the execution of malicious requests generated by malware. In another example, the permission request 212 may be sent by a second device 206. The second device 206 may send the permission request 212 in response to receiving a request from the backup processing engine 209 to perform a backup-related operation. The license request 212 may be referred to as corresponding to the first device 202, because the first device 202 stores the parent data of the backup copy corresponding to the license request 212.

[0031] Upon receiving license request 212, system 100 can determine whether the security of first device 202 (the device corresponding to license request 212) has been compromised. This determination of whether the security of first device 202 has been compromised can also be referred to as verifying the security of first device 202.

[0032] System 100 includes a backup protection engine 213 that receives license requests, such as license requests 212, from computing devices such as first device 202 and queues the license requests. Furthermore, backup protection engine 213 enables analysis engine 214 to verify the security of the device corresponding to each queued license request. In one example, backup protection engine 213 and analysis engine 214 can each be deployed independently of processor 102 by executing instruction sets (…). Figure 2 (not shown in the image) to achieve this.

[0033] To verify the security of the first device 202, the analysis engine 214 can utilize telemetry data sent by the first device 202. Information included in the telemetry data can be used to verify whether the first device 202 has been attacked by malware. For example, as part of the telemetry data, the number of login attempts can indicate the number of successful and unsuccessful attempts to log in to the first device 202 within a time period. A large number of unsuccessful login attempts within a short period may indicate unauthorized attempts to intrude into the first device 202. A large number of encryptions within a short period may indicate ransomware activity on the first device 202. Similarly, a large number of file modifications or deletions, high workloads on hardware components, a large number of read or write operations, or a large number of failed attempts to perform backup-related operations may all indicate ransomware activity. Furthermore, new backup policies (which may be part of the telemetry data) indicating reduced backup retention periods or increased backup creation frequency may also indicate ransomware activity. Therefore, based on the analysis of the telemetry data, the analysis engine 214 can verify the security of the first device 202.

[0034] In one example, the analysis of telemetry data includes comparing actual parameter values ​​received as part of the telemetry data with expected parameter values. Expected parameter values ​​may be predefined ranges or values ​​that the corresponding portion of the telemetry data should satisfy when the security of the first device 202 is not compromised. For example, if the actual parameter values ​​differ significantly from the expected parameter values, it can be determined that the security of the first device 202 has been compromised. Expected parameter values ​​may be provided by the user, for example, or may be determined by the analysis engine 214.

[0035] In one example, to verify the security of the first device 202 based on telemetry data, the analysis engine 214 may utilize machine learning techniques, such as an Autoregressive Integrated Moving Average (ARIMA) linear regression model, which can detect anomalies in the received data. The analysis engine 214 can monitor parameters of previously received telemetry data and predict expected parameter values ​​that corresponding portions of the telemetry data should satisfy. The analysis engine 214 can also compare the expected parameter values ​​with the corresponding actual parameter values ​​received as part of the telemetry data. If the actual parameter values ​​received in the telemetry data differ significantly from the expected parameter values ​​(e.g., if the difference between the actual and expected parameter values ​​exceeds a threshold), the analysis engine 214 can determine that the security of the first device 202 has been compromised. For example, if the number of actual login attempts is significantly higher than the expected number of login attempts, it can be determined that the security of the first device 202 has been compromised. The analysis engine 214 can also compare telemetry data received during a previous malware attack with the current telemetry data. If two telemetry datasets are similar (e.g., if the difference between the parameter values ​​of the two telemetry datasets is less than a threshold), the analysis engine 214 can determine that the security of the first device 202 has been compromised. In one example, the analysis engine 214 can identify suspicious changes in the backup policy, such as a reduction in the backup retention period or an increase in the frequency of backup creation, by comparing the backup policy received in the telemetry data with past telemetry data.

[0036] As previously described, telemetry data may include read counts and write counts. In one example, system 100 may analyze the read counts and write counts corresponding to license request 212, but may not analyze the read counts and write counts of other data. For example, since license request 212 corresponds to first device data 204, system 100 may analyze the read counts and write counts of first device data 204, but not the read counts and write counts of other data. Therefore, wasteful analysis of other read counts and write counts is avoided.

[0037] After verifying the security of the first device 202 based on telemetry data, the analysis engine 214 can provide the analysis results to the backup protection engine 213. Based on the results, the backup protection engine 213 can authorize the execution of backup-related operations. For example, if it is determined that the security of the first device 202 has not been compromised, the backup protection engine 213 can grant permission to the first device 202 to perform backup-related operations, for example, by sending a token 216 to the first device 202. If the security of the first device 202 has been compromised, the backup protection engine 213 can, for example, by not sending a token 216 and / or by sending a denial message (in...). Figure 2 (Not shown in the image) to deny permission to perform backup-related operations.

[0038] In one example, token 216 may indicate the backup-related operation for which a license is granted and may indicate the name of the first device data 204 and / or backup copy 208 corresponding to the execution of the backup-related operation. For example, token 216 may indicate that a license is granted to create a new backup copy of the first device data 204 or to delete backup copy 208. Details of the backup-related operation indicated in token 216 and the device data / backup copy may be obtained from license request 212.

[0039] Upon receiving token 216, the first device 202 may transmit an execution request 218 to the second device 206 for performing backup-related operations. The execution request 218 may include details of the backup-related operations, such as a new backup copy to be stored in the second device 206, changes to be made to backup copy 208, or instructions to delete backup copy 208. In addition to the execution request 218, the first device 202 may also transmit token 216 to the second device 206. Based on token 216, the second device 206 can determine that the security of the first device 202 has been verified. Furthermore, the second device 206 can verify whether token 216 permits the execution of the backup-related operations specified in the execution request 218.

[0040] The second device 206 can also verify whether the token 216 specifies the name of the device data or the name of the backup copy to which the operation is targeted. For example, if execution request 218 instructs that a new backup copy of the first device data 204 be created, the second device 206 can check whether the token 216 permits the creation of a backup copy of the first device data 204. Therefore, the second device 206 verifies that execution request 218 is consistent with token 216. In response to successful verification, the second device 206 performs the backup-related operation as specified in execution request 218. The specification of the backup copy name and / or device data name in the backup-related operation and token 216, as well as the verification of token 216 by the second device 206, ensure that the performed backup-related operation is the same as the operation permitted by system 100.

[0041] In one example, instead of verifying the consistency between execution request 218 and token 216, second device 206 can determine whether token 216 is authentic. To perform this determination, second device 206 can send an authentication request to system 100, requesting system 100 to verify whether token 216 was issued by system 100 and whether token 216 is valid. Upon receiving this request, system 100 can verify the authenticity and validity of token 216. For example, system 100 can verify that token 216 was indeed issued by system 100 and that token 216 was issued in response to a recent permission request. In response to successful verification of token 216, system 100 can send a message to second device 206 indicating that token 216 is authentic. Performing backup-related operations after token 216 authentication prevents scenarios where backup-related operations are performed based on fake tokens created by malware.

[0042] If the security of the first device 202 is compromised, the backup protection engine 213 can, for example, by not sending a token 216 and / or by sending a rejection message (in... Figure 2 (Not shown in the image), permission to perform backup-related operations is denied. Therefore, the first device 202 does not send execution request 218 to the second device 206. Even if the first device 202 sends execution request 218 to the second device 206, the second device 206 refuses to perform backup-related operations because token 216 was not sent to the second device 206. In another example, when verifying the security of the first device 202, the system 100 may send token 216 to the second device 206 instead of the first device 202. Based on token 216, the second device 206 can perform the backup-related operations as indicated by execution request 218.

[0043] Therefore, granting or denying permission to perform backup-related operations can be done without analyzing the contents of backup copy 208 or first device data 204. For example, system 100 does not need to compare the newly created backup copy for backup copy 208. Similarly, system 100 does not need to process suggested changes to backup copy 208 or analyze actions performed on first device data 204. Instead, as described above, permission can be granted and denied based on analysis of telemetry data received from first device 202. This can help improve the privacy 208 of user data that is part of first device data 204 and backup copy 208. Furthermore, since first device data 204 and backup copy 208 are not transmitted to system 100, and since the size of telemetry data is small (e.g., in the range of kilobytes), the amount of data to be transmitted to system 100 is minimal.

[0044] In one example, system 100 may periodically receive telemetry data from first device 202. For example, system 100 may receive a telemetry dataset after a specific time interval has elapsed. Furthermore, the telemetry dataset may indicate, for example, operations performed on first device 202 during that time interval, workload information of the hardware components of first device 202 during that time interval, a valid backup policy during that time interval, or any combination thereof. For example, zeroth telemetry dataset 220 may indicate operations performed during the time interval between T=0 minutes and T=1 minutes, the workload of hardware components, or a valid backup policy, and first telemetry dataset 222 may indicate operations performed during the time interval between T=1 minutes and T=2 minutes, the workload of hardware components, or a valid backup policy, etc. The received telemetry datasets may be stored in a data repository 224. Data repository 224 may be, for example, a data lake.

[0045] In one example, to verify the security of the first device 202, the analysis engine 214 can utilize telemetry datasets that are temporally close to the time of receipt of the permission request 212. For example, the analysis engine 214 can analyze telemetry datasets received within a first time period prior to receiving the permission request 212. Telemetry datasets received within this first time period can be considered qualified past telemetry data. Consider a first time period of 5 minutes and permission request 212 received at minute t from a reference time point. Accordingly, the analysis engine 214 can analyze telemetry datasets received between minute t and the 5 minutes prior to minute t. Therefore, if the zeroth telemetry dataset 220 is received between minute t and the 5 minutes prior to minute t, then the zeroth telemetry dataset 220 is part of the qualified past telemetry data and is analyzed by the analysis engine 214.

[0046] Instead of analyzing qualified past telemetry data, analysis engine 214 can analyze telemetry datasets received within a second time period after receiving permission request 212. Telemetry datasets received within this second time period can be considered qualified future telemetry data. Consider a second time period of 5 minutes and permission request 212 received at minute t from a reference time point. Accordingly, analysis engine 214 can analyze multiple telemetry datasets received between minute t and 5 minutes after minute t. Therefore, if a first telemetry dataset 222 is received between minute t and 5 minutes after minute t, the first telemetry dataset 222 is part of the qualified future telemetry data and is analyzed by analysis engine 214. Furthermore, if a second telemetry dataset 226 is received 5 minutes after minute t, analysis engine 214 does not analyze the second telemetry dataset 226. Analysis of telemetry data that is temporally close to permission request 212 ensures that relevant data is considered for verifying the security of the first device 202.

[0047] In one example, the analysis of telemetry data may include comparing telemetry data that is temporally close to license request 212 with the remaining telemetry data received from first device 202 and stored in data repository 224. Based on the comparison, if it is determined that there is a significant deviation between the telemetry data that is temporally close to license request 212 and the rest of the telemetry data, system 100 may determine that the security of first device 202 has been compromised.

[0048] In one example, the length of the second time period can be equal to the length of the first time period. Furthermore, in one example, the lengths of both the first and second time periods can be multiples of the time interval between receiving the telemetry dataset from the first device 202. For example, the telemetry dataset can be received once per minute, and both the first and second time periods can have a length of five minutes.

[0049] In one example, system 100 may periodically receive heartbeat messages from first device 202. Heartbeat messages can indicate that first device 202 is operational and can be sent at a higher frequency than telemetry data. Furthermore, if a heartbeat message is received after permission request 212, system 100 can initiate the aforementioned analysis of the telemetry dataset. Therefore, permission request 212 is processed after ensuring that first device 202 is operational. Thus, this disclosure prevents the waste of resources used to process requests corresponding to non-operating devices.

[0050] Telemetry data can be received from the first device 202 regardless of whether a backup-related request is received. In one example, the system 100 may be a system that periodically receives and analyzes at least some portions of the aforementioned telemetry data to identify or predict failures in the operation of the first device 202. For example, the system 100 may perform analysis on certain portions of the telemetry data (such as workload information of hardware components) and predict that a component of the first device 202 is about to fail. Since the first device 202 has transmitted at least some portions of the aforementioned telemetry data to the system 100 to identify and predict failures, this disclosure ensures that the first device 202 transmits virtually no additional data to verify the security of the first device 202 and to process backup-related requests corresponding to the first device 202. Therefore, the techniques of this disclosure can be implemented with minimal overhead for the first device 202.

[0051] Although system 100 is described as periodically receiving telemetry data, in one example, another device connected to system 100 ( Figure 2 (Not shown) can receive telemetry data. In addition, in response to receiving a backup-related request, system 100 can obtain past and / or future telemetry data to be analyzed from other devices.

[0052] Although not shown, various components of network environment 200 can communicate with each other through a communication network, which can be a wireless or wired network or a combination thereof. The communication network can be a collection of separate networks interconnected and used as a single large network (e.g., the Internet or an intranet). Examples of such separate networks include Global System for Mobile Communications (GSM) networks, Universal Mobile Telecommunications System (UMTS) networks, Personal Communication Services (PCS) networks, Time Division Multiple Access (TDMA) networks, Code Division Multiple Access (CDMA) networks, Next Generation Networks (NGN), Public Switched Telephone Networks (PSTN), and Integrated Services Digital Networks (ISDN). Depending on the technology, the communication network can include various network entities such as transceivers, gateways, and routers.

[0053] Figure 3 The diagram illustrates a network environment 300 according to an example implementation of this disclosure, which implements security verification of the first device 202, thereby authorizing backup-related operations. Network environment 300 may correspond to network environment 200.

[0054] First equipment data 204 ( Figure 3(Not shown) may be associated with VM 302 hosted in the first device 202. Furthermore, the second device 206 may include a backup copy 304 corresponding to VM 302. The backup copy 304 corresponding to VM 302 may be referred to as a VM backup copy. In the following explanation, this disclosure is explained with reference to an example in which the backup copy stored in the second device 206 is a VM backup copy.

[0055] System 100 can receive permission request 306 to perform VM backup-related operations, such as modifying or deleting VM backup copy 304 or creating a new VM backup copy. As described above, in response to receiving a request, system 100 can analyze telemetry data of first device 202 to verify the security of first device 202. Based on the telemetry data, if the security of first device 202 is determined to be compromised, in one example, system 100 can verify the security of first device 202 by establishing a secure handshake with first device 202.

[0056] The secure handshake-based authentication 308 involves system 100 transmitting message 310 to first device 202. Message 310 is encrypted using a shared secret key 312 known to both first device 202 and system 100. The secret key 312 may be stored in the storage device or memory of first device 202. Figure 3 (Not shown in the image). If the first device 202 is not infected with ransomware, that is, if the security of the first device 202 is not compromised, the shared secret key 312 can be stored in the first device 202 in an unencrypted state. Therefore, the shared secret key 312 is accessible to the first device 202 and used by the first device 202 to decrypt message 310. Once decrypted, the first device 202 can send a response 314 to message 310. In one example, the response 314 can be sent as part of a heartbeat message. Receipt of response 314 establishes a secure handshake between the first device 202 and system 100. If the security of the first device 202 is compromised, because the malware may have encrypted data stored on the first device, the shared secret key 312 can be stored in the first device 202 in an encrypted state and may not be accessible to the first device 202. Therefore, the first device 202 cannot send response 314 to system 100. Therefore, the secure handshake is not established, and system 100 determines that the security of the first device 202 is compromised. In one example, system 100 determines that the security of the first device 202 has been compromised in response to not receiving a response 314 within a predetermined transmission period of message 310.

[0057] System 100 can grant permission to perform backup-related operations during a security handshake and can deny permission in response to failure to establish a security handshake. As indicated by arrow 316, the granting or denying of permission can be sent to either first device 202 or second device 206. As previously described, permission granting can be indicated by a transmission token. After granting permission, first device 202 can send an execution request 318 to second device 206. Execution request 318 can include instructions to create a new VM backup copy, propose changes to the VM backup copy 304, or delete the VM backup copy 304. Therefore, the security handshake-based verification 308 acts as a second phase of security verification for first device 202. This increases the accuracy of security verification, thereby preventing the backup copy from becoming unusable.

[0058] Figure 4 and Figure 5 Methods 400 and 500 for performing backup-related operations according to exemplary implementations of this disclosure are illustrated respectively. The order in which methods 400 and 500 are described is not intended to be construed as limiting, and any number of method blocks described can be combined in any order to implement method 400 or alternative methods. Furthermore, methods 400 and 500 can be implemented by means of any suitable hardware, non-transitory machine-readable instructions, or a combination thereof, by (multiple) processing resources or computing devices.

[0059] It is understood that the methods 400 and 500 can be executed by a programmed computing device and can be executed based on instructions stored in a non-transitory computer-readable medium. Non-transitory computer-readable media can include, for example, digital memory, magnetic storage media (such as disks and magnetic tapes), hard disk drives, or optically readable digital data storage media. Although method 400 can be implemented in a variety of systems, for ease of explanation, method 400 is described with respect to system 100. In one example, method 400 can be executed by a system such as system 100.

[0060] refer to Figure 4 At box 402, a permission request for permission to perform operations related to the backup copy is received. The backup copy corresponds to first device data stored in the first device. The backup copy may be stored or may need to be stored in the second device. In one example, the permission request may be a request to modify or delete the backup copy stored in the second device. In another example, the permission request may be a request to create a new backup copy in the second device.

[0061] The license request may be received from, for example, a first device or a second device, and may be, for example, license request 212 or license request 306. The first device may be first device 202, the second device may be second device 206, the first device data may be first device data 204, and the backup copy may be backup copy 208. In one example, the first device data belongs to a VM hosted on the first device, such as VM 302. Furthermore, the backup copy includes an image from which the VM can be restored, such as VM backup copy 304. In another example, the first device data belongs to the first device, and the backup copy includes an image from which the first device can restore itself to its operational state.

[0062] At box 404, in response to the permission request, telemetry data received from the first device is analyzed to determine whether the security of the first device has been compromised. The telemetry data may indicate operations performed in the first device, workload information of the first device's hardware components, backup policies, or as referenced... Figure 1 and Figure 2 Other data explained. In one example, the telemetry data does not include the contents of the backup copy or the first device data. For example, if the operation associated with the backup copy is a backup copy modification operation, the telemetry data may not indicate changes made to the first device data. Furthermore, if the operation associated with the backup copy is a backup creation operation, the telemetry data may not include the new backup copy. Similarly, if the operation associated with the backup copy is a backup deletion operation, the telemetry data may not include the backup copy to be deleted.

[0063] In one example, as referenced Figure 2 The telemetry data being analyzed includes telemetry data received in a first time period before receiving a license request, or telemetry data received in a second time period after receiving a license request, or both. In one example, the telemetry data can be received periodically from the first device. Furthermore, the length of each time period in the first and second time periods can be a multiple of the interval length from which telemetry data is periodically received from the first device. For example, as mentioned above, the interval length can be 1 minute, and both the first and second time periods can be five minutes.

[0064] At box 406, in response to determining that the security of the first device has not been compromised, an attempt is made to establish a secure handshake with the first device. This attempt may include transmitting a message encrypted using a secret key known to the first device (such as shared secret key 312). See reference... Figure 3 As explained, if a response to the message is received from the first device, it can be determined that a secure handshake has been established.

[0065] At box 408, in response to the establishment of a secure handshake, permission is granted to perform operations related to the backup copy. In one example, the execution of the permission operation includes transmitting a token, such as token 216, to the first device.

[0066] Figure 5 The illustration shows a method 500 for performing backup-related operations according to an example implementation of this disclosure. Method 500 can be executed, for example, by a first device 202 and a second device 206. Furthermore, method 500 can be executed when the first device receives a token from the system.

[0067] In one example, the license request specifies either the name of the first device data or the name of the backup copy. Additionally, the token can specify either the name of the first device data or the name of the backup copy, either of which is specified in the license request. After receiving the token, at box 502, the first device transmits an execution request, such as execution request 218 or execution request 318, to the second device to perform backup-related operations. At box 504, the second device can then determine whether the token specifies the name of the first device data or the name of the backup copy. Subsequently, the second device can perform operations related to the backup copy.

[0068] In one example, before performing backup-related operations, at box 506, the second device can send an authentication request to the system to verify a token. In response to the system's authentication of the token, at box 508, as referenced... Figure 2 As explained, the second device determines that the operation can be performed. Subsequently, at box 510, the second device can perform operations related to the backup copy.

[0069] Figure 6 The illustration depicts a computing environment 600 that uses a non-transitory computer-readable medium to permit the performance of backup-related operations, according to an example implementation of this disclosure. In one example, the non-transitory computer-readable medium 602 may be used by a system such as system 100. In one example, the computing environment 600 may include a processing resource 604 communicatively coupled to the non-transitory computer-readable medium via a communication link 606. The processing resource 604 may be, for example, a processor 102.

[0070] The non-transitory computer-readable medium 602 can be, for example, an internal or external memory device. In one example, the communication link 606 can be a direct communication link, such as any memory read / write interface. In another example, the communication link 606 can be an indirect communication link, such as a network interface. In this case, the processing resource 604 can access the non-transitory computer-readable medium 602 via a network 608. The network 608 can be a single network or a combination of multiple networks and can use a variety of different communication protocols.

[0071] Processing resource 604 and non-transitory computer-readable medium 602 can also be communicatively coupled to first device 610, which may be a storage device for data. Figure 6 A computing device (not shown in the image), and a backup copy storing data corresponding to the data in the first device (not shown in the image). Figure 6 The second device 612 (not shown in the image). The first device 610 and the second device 612 can be the first device 202 and the second device 206, respectively. Further, the first device data and the backup copy can be the first device data 204 and the backup copy 208, respectively.

[0072] In one example implementation, the non-transitory computer-readable medium 602 includes a set of computer-readable instructions for authorizing the execution of backup-related operations. This set of instructions can be accessed and subsequently executed by processing resource 604 via communication link 606.

[0073] refer to Figure 6 In one example, the non-transitory computer-readable medium 602 includes instructions 614 that cause processing resource 604 to receive a request to authorize the deletion of a backup copy corresponding to the first device data. The request may, for example, be authorization request 212 or authorization request 306. As previously described, the first device data is stored in the first device, and a backup copy is stored in the second device.

[0074] Non-transitory computer-readable medium 602 includes instructions 616 that cause processing resource 604 to analyze telemetry data received from the first device in response to a request. In one example, as referenced... Figure 2 The telemetry data being analyzed can be telemetry data received during a first time period before the requested reception time and telemetry data received during a second time period after the requested reception time.

[0075] The non-transitory computer-readable medium 602 includes instructions 618, which cause analysis to determine whether the security of the first device has been compromised. In response to determining that the security of the first device has not been compromised, instructions 620 cause permission to delete the backup copy. Deletion can be authorized, for example, by sending a token (such as token 216) to the first device, the token indicating permission to delete the backup copy.

[0076] In one example, in response to a determination based on analysis of telemetry data that the security of the first device has not been compromised, instructions can be executed to transmit messages encrypted using a secret key, such as a shared secret key 312, which is known to the first device. Furthermore, as referenced... Figure 3 As explained, in response to receiving a message from the first device, deletion is permitted.

[0077] In one example, in addition to granting and denying permission to delete backup copies, the instructions also grant and deny permission to modify backup copies. For example, the instructions cause a request to modify a second backup copy corresponding to data on a first device to be received. The second backup copy could be, for example, a backup copy of the first device data created after the deletion of the first backup copy. In response to determining that the security of the first device has not been compromised, the instructions may grant permission to modify the second backup copy. Similarly, in one example, the instructions may also grant and deny permission to create backup copies.

[0078] This disclosure can prevent the loss and unusability of backup copies due to malware attacks on computing devices storing parent data. This disclosure utilizes telemetry data from the computing device sending requests for backup-related operations to determine whether the security of the computing device has been compromised. Therefore, it is not necessary to analyze the details of backup-related operations, such as changes made to backup copies or new backup copies. Thus, this disclosure can provide a simpler and more effective determination related to the security of computing devices. Furthermore, this disclosure can utilize telemetry data received from the computing device to identify and predict failures. Therefore, it may not be necessary to receive additional data from the computing device to implement this disclosure.

[0079] Because this disclosure verifies the security of the computing device before permitting changes to the backup copy, the teachings of this disclosure can be implemented to avoid using data immutability features on the backup device to prevent the loss or unavailability of the backup copy. Therefore, genuine backup-related operations, such as those initiated by a storage administrator, can be performed.

[0080] Although implementations of the license for backup-related operations have been described in language specific to structural features and / or methods, it should be understood that this disclosure is not necessarily limited to the specific features or methods described. Rather, specific features and methods are disclosed and explained as example implementations.

Claims

1. A system comprising: processor; as well as A non-transitory storage medium including instructions executable on the processor, the instructions being used for: Receive a permission request for authorizing operations related to a backup copy, the backup copy corresponding to first device data stored in a first device, and the backup copy to be stored in a second device; In response to the permission request, analyze the telemetry data received from the first device within a first time period relative to the time of receipt of the permission request; Based on the analysis, it is determined whether the security of the first device has been compromised; Based on the determination that the security of the first device has not been compromised, the operation related to the backup copy is authorized by sending a token from the system to the first device; The system receives the token from the second device, the token being sent from the first device to the second device as part of an execution request from the first device to perform the operation related to the backup copy; The system verifies the token received from the second device. as well as Based on verifying the token, the system sends a response indicating that the token is genuine to authorize the second device to perform the operation related to the backup copy.

2. The system according to claim 1, wherein the telemetry data includes one or more of the following: number of login attempts, number of file encryption attempts, number of file modifications, number of file deletions, workload information of the hardware components of the first device, backup strategy, read count of the first device data, or write count of the first device data.

3. The system of claim 1, wherein, for analyzing the telemetry data received from the first device, the instructions executable on the processor are used to: The actual parameter values, which are part of the telemetry data, are compared with the expected parameter values ​​corresponding to the undamaged safety state of the first device.

4. The system of claim 1, wherein the instructions executable on the processor are used for: The time at which the license request was received is identified; Determine the first time period before or after the time of receipt of the permission request; As part of the analysis, the telemetry data received from the first device during the first time period is compared with the remaining portion of the telemetry data received from the first device.

5. The system of claim 1, wherein the token from the second device is part of an authentication request requesting the system to verify whether the token is valid, and the authentication request is sent from the second device to the system based on the determination at the second device that the execution request from the first device is consistent with the token.

6. The system of claim 1, wherein the operation associated with the backup copy is a backup creation operation, a backup modification operation, or a backup deletion operation.

7. A method comprising: A system including a hardware processor receives a permission request for permission to perform operations related to a backup copy, the backup copy corresponding to first device data stored in a first device, and the backup copy to be stored in a second device; In response to the permission request, the system analyzes the telemetry data received from the first device to determine whether the security of the first device has been compromised. Based on the determination that the security of the first device has not been compromised, the operation related to the backup copy is authorized by sending a token from the system to the first device; The system receives the token from the second device, the token being sent from the first device to the second device as part of an execution request from the first device to perform the operation related to the backup copy; The system verifies the token received from the second device. as well as Based on verifying the token, the system sends a response indicating that the token is genuine to authorize the second device to perform the operation related to the backup copy.

8. The method according to claim 7, wherein the telemetry data includes: Telemetry data received during a first time period prior to receiving the license request, and telemetry data received during a second time period after receiving the license request.

9. The method of claim 7, comprising: Based on the determination that the security of the first device has not been compromised, the system attempts to establish a secure handshake with the first device. The system's permission for operations related to the backup copy is also based on the establishment of the security handshake.

10. The method of claim 9, wherein attempting to establish the secure handshake comprises: The method involves transmitting a message encrypted using a secret key known to the first device, and includes determining that a secure handshake has been established in response to receiving a response to the message from the first device.

11. The method of claim 7, wherein the token from the second device is part of an authentication request requesting the system to verify whether the token is valid, and the authentication request is sent from the second device to the system based on the determination at the second device that the execution request from the first device is consistent with the token.

12. The method of claim 7, wherein the first device data relates to a virtual machine (VM) hosted in the first device, and the backup copy includes an image from which the VM can be restored.

13. A non-transitory computer-readable medium comprising instructions executable by a system for: Receive a permission request for authorizing operations related to a backup copy, the backup copy corresponding to first device data, the first device data being stored in a first device and the backup copy to be stored in a second device; In response to the permission request, analyze the telemetry data received from the first device; Based on the analysis, it is determined whether the security of the first device has been compromised; Based on the determination that the security of the first device has not been compromised, the operation related to the backup copy is authorized by sending a token from the system to the first device; The system receives the token from the second device, the token being sent from the first device to the second device as part of an execution request from the first device to perform the operation related to the backup copy; The system verifies the token received from the second device. as well as Based on verifying the token, the system sends a response indicating that the token is genuine to authorize the second device to perform the operation related to the backup copy.

14. The non-transitory computer-readable medium of claim 13, wherein the token from the second device is part of an authentication request requesting the system to verify whether the token is valid, and the authentication request is sent from the second device to the system based on the determination at the second device that the execution request from the first device is consistent with the token.

15. The non-transitory computer-readable medium of claim 14, wherein the token includes the name of the first device data or the backup copy, and the token specifies the permitted operation associated with the backup copy, wherein, Based on the determination that the operation specified by the execution request is consistent with the operation related to the backup copy specified by the token, it is determined that the execution request from the first device is consistent with the token.

Images