Proxy Device Routing Backup Data Through Dual Firewalls
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in securely backing up data from computing devices located outside an enterprise network without exposing internal IP address information to untrusted networks, due to firewall limitations and constantly changing IP addresses of portable devices.
Innovation Solution
A dual-firewall topology with a dedicated proxy device in a demilitarized zone (DMZ) is used to accept and route network connections, establishing secure connections between a remote computing device and an enterprise backup system, while keeping internal IP addresses hidden from untrusted networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a firewall is used to protect the enterprise network, then security is improved, but communication between remote devices and backup servers is limited
Solution Approach 1:
A proxy server is introduced as an intermediary component between the enterprise network and external networks. The proxy server receives backup requests from remote devices, authenticates them, and forwards authorized requests to internal backup servers. This mediator enables communication while maintaining firewall security rules, as the proxy handles external connections without requiring direct firewall openings to internal resources.
2Ease of operation
If ports are opened on the enterprise network firewall to enable backup communication, then communication availability is improved, but internal IP address information is exposed to untrusted networks
Solution Approach 1:
The proxy server acts as an intermediary that masks internal network topology. External devices communicate only with the proxy server's public IP address, while the proxy translates these requests to internal backup servers using private IP addresses. This prevents exposure of internal IP address information to untrusted networks while maintaining communication functionality.
Solution Approach 2:
The network architecture is segmented into distinct zones: an external network zone, a proxy server zone, and an internal enterprise network zone. The proxy server resides in an intermediate position, creating a buffer zone that separates external access from internal resources. This segmentation allows controlled communication while protecting internal network structure from external exposure.
3Productivity
If direct connection is established between remote devices and backup servers, then backup speed is improved, but security control is worsened
Solution Approach 1:
The proxy server serves as an intermediary that maintains security control while enabling efficient backup operations. It authenticates remote devices, establishes secure sessions, and manages data transfer to backup servers. The proxy can optimize transfer protocols and maintain connection persistence, ensuring both security policies are enforced and backup productivity is maintained.
Data Source
AI summary
According to certain aspects, a method for performing remote backup operations is provided that includes receiving a first unidirectional connection request from a media agent module to a proxy device within an enterprise network, through a firewall. The method also includes receiving a second unidirectional connection request from a remote device coupled to an untrusted network, such as through a second firewall. Secure connections are established from the media agent module to the proxy and from the remote device to the proxy. Additionally, the method can include routing with the proxy device backup data from the remote computing device to the media agent over the secured connections. The method also may include storing the backup data on a storage device within the enterprise network. In certain embodiments, during establishment of the secure connections, identification of the media agent or the storage device is not exposed to the untrusted network.