DDBoost OAuth Authentication for Legacy Backup Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data protection systems face challenges in securely authenticating backup clients due to the incompatibility between modern open authorization protocols like OAuth2 and legacy authentication mechanisms, preventing seamless access to data protected by older credentials and ticket-based systems.
Innovation Solution
Implementing a DDBoost system that uses an identity and access management (IAM) framework to authenticate backup clients via OAuth2-based identity providers, issuing JSON Web Tokens (JWTs) for secure access to Data Domain storage systems, enabling interoperability with legacy protocols through TLS-encrypted connections and custom claims for user identification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If open authorization protocols like OAuth2 are used for authentication, then authentication security and modernization are improved, but compatibility with legacy authentication mechanisms deteriorates
Solution Approach 1:
The patent introduces an intermediary layer (the backup server acting as a mediator) that translates between OAuth2.0 authentication tokens and legacy authentication mechanisms. The backup server receives OAuth2.0 tokens from clients, validates them against the storage system, and converts them into appropriate legacy authentication credentials or access tokens, enabling seamless interoperability between modern and legacy systems without requiring direct compatibility between the two protocols.
2Adaptability or versatility
If legacy authentication mechanisms are used, then compatibility with existing systems is maintained, but authentication modernization and security improvements are hindered
Solution Approach 1:
The patent implements a dynamic authentication system where the backup server can adapt its behavior based on the client's authentication needs. The system dynamically switches between OAuth2.0 token validation and legacy credential verification depending on the storage system's requirements and the client's capabilities, allowing the authentication mechanism to evolve and adapt to different system architectures without requiring complete replacement of legacy infrastructure.
3Ease of operation
If OAuth2.0 protocol is implemented for backup clients, then single-sign-on capability is achieved, but integration with legacy data path protocols becomes problematic
Solution Approach 1:
The patent segments the authentication and data transfer functions into separate components. The backup server handles OAuth2.0 authentication and token validation as a separate control path, while the data path protocols (DDBoost, NFS, CIFS) remain unchanged and continue to handle data transfer using their native mechanisms. This segmentation allows single-sign-on capability to be achieved without complicating the data path protocols, as authentication and data transfer operate in independent layers.
Data Source
AI summary
Embodiments for using open authorization of backup clients in a DDBoost system to access legacy protected data. A DDBoost server on a Data Domain storage system registers itself as an open authorization (OIDC) client with an identity provider server. Third party applications can leverage open authorization without needing to interact with the identity provider. Identity provider server details are stored on the DDBoost to creates a single point of configuration to plug in. Cloud providers that provide their own identity provider can be configured and used with the Data Domain system for the DDBoost data path. This allows a user to access data stored and protected using legacy (non-open authorization) protocols.