System and method for secured backup of data
View Patent ↗A system and method of selectively providing encrypted data is provided. Embodiments of the invention may store data in encrypted form on a storage device. Embodiments of the invention may selectively provide encrypted or decrypted data to a requestor of data based on configuration or other parameters. A filter driver or other module or unit may examine a request for, or communication of data from the storage device and may determine if data is to be provided in encrypted or decrypted form. Decrypted data may be provided to a caching system. A filter driver or other module or unit may examine a request for, or communication of data from the caching system. Data provided from the caching system may be selectively encrypted based on configuration or other parameters.
1. A method comprising:
by a computerized platform, selectively providing data to different computerized processes that are associated with said computerized platform, wherein said providing comprises selectively providing data to a data-requesting process either in encrypted form or in decrypted form, by performing:
(a) storing encrypted data in a local storage unit of said computerized platform;
(b) analyzing a request, that was received from said data-requesting process which requests said encrypted data from said local storage unit;
(c) retrieving a set of one or more parameters that are associated with said data-requesting process;
(d) retrieving a pre-defined security policy that is associated with at least one parameter of said set of one or more parameters of said data-requesting process;
(e) determining whether (I) the set of one or more parameters of said data-requesting process, corresponds to (II) said security policy applied to at least one of said parameters;
(f) based on said one or more parameters of said data-requesting process, and based also on said pre-defined security policy that is associated with at least one parameter of said set of one or more parameters of said data-requesting process, determining both; (I) whether to provide said data to said data-requesting process in encrypted form or in decrypted form, and also (II) which encryption key to utilize if said data is to be provided in encrypted form to said data-requesting process;
performing kernel-level analysis of a destination of a data packet, by a kernel-level module that monitors at kernel level one or more requests for data;
based on kernel-level analysis by the kernel-level module of a kernel-level operating system event, determining whether or not said destination is part of a back-up system;
if it is determined, based on the kernel-level analysis of the kernel-level operating system event, that said destination is part of the backup system then; delivering said data in encrypted format to said destination;
if it is determined, based on the kernel-level analysis of the kernel-level operating system event, that said destination is not park of the backup system then: delivering said data in decrypted format to said destination.
2. The method of claim 1 , comprising:
determining whether the data-requesting process is associated with a backup system;
if said data-requesting process is associated with said backup system, then: encrypting said data, and delivering said data in encrypted form to said data-requesting process;
if said data-requesting process is not associated with said backup system, then; delivering said data in decrypted form to said data-requesting process.
3. The method of claim 1 , wherein the analyzing of step (b) comprises: intercepting a data-access request of said data-requesting process.
4. The method of claim 1 , comprising:
concurrently providing a data item in two different formats to two different requesting processes, by: (a) determining that a first requesting process is an authorized logged-in user; (b) delivering said data item in decrypted format to said authorized logged-in user; (c) determining that a second, concurrent, requesting process is a backup module; (d) delivering said data item in encrypted format to said second, concurrent, requesting process.
5. The method of claim 1 , comprising:
selectively determining whether to provide a data item to a requesting process, either in decrypted format or in encrypted format, based on classifying the requesting process as one of: (i) the requesting process is an authorized logged-in user, or (ii) the requesting process is a locally-running backup module, or (iii) the requesting process is a remote backup module that is requesting the data item through a shared network drive mechanism, or (iv) the requesting process is a non-backup requesting process.
6. The method of claim 1 , comprising:
defining and applying at least four different security policy rules, which selectively determine whether to provide a data item to a requesting process either in decrypted format or in encrypted format, by defining at least;
(i) a first security policy rule that applies when the requesting process is an authorized logged-in user,
(ii) a second security policy rule that applies when the requesting process is a locally-running backup module,
(iii) a third security policy rule that applies when the requesting process is a remote backup module that is requesting the data item through a shared network drive mechanism,
(iv) a fourth security policy rule that applies when the requesting process is a non-backup data-requesting process.
7. The method of claim 1 , comprising:
selectively determining whether to deliver a requested data item, either in decrypted format or in encrypted format, to said data requesting process, based cumulatively on both: (a) classification of said data requesting process into either a backup module or a non-backup module, and (b) a pre-defined security policy rule that indicates a first time-window in which data is provided in encrypted form and further indicates a second time-window in which data is provided in decrypted form.