Snapshot Share Access Control for Secure Backup Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data protection systems face inefficiencies in managing access control for snapshot shares, leading to potential security risks and inefficient use of computing resources during backup and recovery operations.
Innovation Solution
Implementing a snapshot access control manager to dynamically manage access to snapshot shares by creating user-defined backup user groups, ensuring only authorized proxy data movers have controlled access for backup or recovery operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If snapshot shares are made accessible for backup operations, then backup efficiency is improved, but security risks increase due to potential unauthorized access
Solution Approach 1:
The system segments access control by creating distinct backup user groups with specific permissions for different snapshot shares. Each proxy data mover is assigned to specific backup user groups, enabling fine-grained control over which snapshots can be accessed by which backup operations, thus maintaining security while enabling efficient backups.
Solution Approach 2:
The patent introduces an intermediary access control mechanism that acts as a mediator between snapshot shares and proxy data movers. This intermediary layer verifies and manages access permissions dynamically, allowing legitimate backup operations to proceed efficiently while blocking unauthorized access attempts.
2Reliability
If access control for snapshot shares is strictly enforced, then data security is improved, but system complexity increases
Solution Approach 1:
The system implements a universal access control framework where backup user groups serve multiple functions: they define access permissions, manage proxy data mover assignments, and control snapshot share accessibility. This multi-functional approach consolidates access control management into a unified system, reducing overall complexity despite enforcing strict security.
Solution Approach 2:
The access control system operates with automated permission verification and dynamic assignment of proxy data movers to backup user groups. The system self-manages access control decisions based on predefined policies, reducing the need for manual intervention and simplifying administration while maintaining strict security enforcement.
3Productivity
If multiple proxy data movers are granted access to snapshot shares, then backup throughput is improved, but resource utilization efficiency decreases
Solution Approach 1:
The system dynamically manages proxy data mover assignments to backup user groups based on operational needs. Proxy data movers can be added or removed from backup user groups during backup operations, allowing the system to optimize resource utilization in real-time while maintaining high backup throughput through parallel processing.
Solution Approach 2:
The system changes operational parameters by dynamically adjusting the composition of backup user groups and their associated proxy data movers. This allows flexible control over the number and capacity of proxy data movers accessing snapshot shares, optimizing the balance between backup throughput and computing resource utilization based on current workload demands.
Data Source
AI summary
A method for protecting asset data includes obtaining, by a data protection system, a backup request for backing up an asset in a production environment, in response to the backup request: obtaining an asset snapshot associated with the asset, wherein the asset snapshot specifies a user list for users allowed access to the asset data associated with the asset snapshot, generating, by the data protection system, a backup user group comprising a backup user, updating a proxy data mover list with the backup user group and the user list, applying a snapshot share on the asset snapshot using the proxy data mover list, performing a backup session by a proxy data mover logged in as the backup user to store a backup of the asset data in a backup storage system, completing the backup session, and after completing the backup session, deleting the snapshot share.