Systems and methods for performing secure backup operations
View Patent ↗The disclosed computer-implemented method for performing secure backup operations may include (i) identifying a group of backup servers with heterogeneous computing environments that provide backup services for a backup client, (ii) determining, for each backup server within the group, a trust level of the backup server by identifying at least one security characteristic of the backup server, (iii) deploying, on each of the backup servers, a signed certificate that enables the backup server to transfer backup data with a security level that corresponds to the trust level of the backup server, and (iv) performing secure backup operations for the backup client by (a) identifying a sensitivity level of a backup task initiated by the backup client and (b) assigning the backup task to a backup server within the group of backup servers that has a signed certificate with a security level appropriate for the sensitivity level of the backup task.
1. A computer-implemented method for performing secure backup operations, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying a plurality of backup servers with heterogeneous computing environments that provide backup services for at least one backup client;
determining, for each of the plurality of backup servers, a trust level of the backup server by identifying at least one security characteristic of the backup server;
for each of the plurality of backup servers, selecting, within a plurality of types of signed certificates that provide various security levels for transferring backup data, an appropriate type of signed certificate for the backup server, wherein:
types of signed certificates that provide high security levels for transferring backup data are appropriate for backup servers with high trust levels; and
types of signed certificates that provide low security levels for transferring backup data are appropriate for backup servers with low trust levels;
deploying, on each of the plurality of backup servers, a signed certificate of the appropriate type selected for the backup server such that the backup server is capable of transferring backup data with a security level that corresponds to the trust level of the backup server; and
performing secure backup operations for the backup client by:
identifying a backup task to be performed;
identifying a sensitivity level of the backup task based at least in part on a type of data involved in the backup task; and
assigning the backup task to at least one backup server within the plurality of backup servers that has a signed certificate that facilitates transferring backup data with a security level appropriate for the sensitivity level of the backup task.
2. The method of claim 1 , wherein identifying the security characteristic of the backup server comprises identifying a security characteristic of at least one of:
a network the backup server uses to transfer backup data;
a data storage system of the backup server; and
settings of a security infrastructure of the backup server.
3. The method of claim 1 , wherein:
identifying the security characteristic of the backup server comprises identifying an initial security characteristic that indicates the backup server meets an initial trust level that is appropriate for a sensitivity level of a type of backup task the backup server will likely perform; and
deploying the signed certificate on the backup server comprises deploying an initial signed certificate that facilitates transferring backup data with a security level that corresponds to the initial trust level.
4. The method of claim 3 , wherein assigning the backup task to the backup server further comprises:
determining that the security level with which the initial signed certificate facilitates transferring backup data is not appropriate for the sensitivity level of the backup task assigned to the backup server;
identifying an additional security characteristic of the backup server that indicates the backup server meets an additional trust level that is appropriate for the sensitivity level of the backup task, the additional trust level being higher than the initial trust level; and
deploying an additional signed certificate on the backup server that facilitates transferring backup data with a security level corresponding to the additional trust level.
5. The method of claim 1 , wherein:
deploying the signed certificate on the backup server further comprises storing, within the signed certificate, the security characteristic of the backup server; and
performing the secure backup operations for the backup client further comprises authenticating, by the backup client, the backup server based on the security characteristic within the signed certificate.
6. The method of claim 1 , wherein the plurality of types of signed certificates comprises at least one of:
signed certificates manually deployed by an administrator of the plurality of backup servers;
signed certificates deployed using an authorization token;
signed certificates deployed using a challenge-response protocol; and
self-signed certificates that are not signed by a certificate authority.
7. The method of claim 1 , wherein identifying the sensitivity level of the backup task further comprises identifying at least one of:
a type of backup operation involved in the backup task;
a desired level of confidentiality of data involved in the backup task; and
a security characteristic of the backup client.
8. The method of claim 1 , wherein assigning the backup task to the backup server that has the signed certificate that facilitates transferring backup data with the appropriate security level comprises assigning backup tasks with high sensitivity levels to backup servers that have signed certificates that facilitate transferring backup data with high security levels.
9. The method of claim 1 , further comprising:
determining a trust level of the backup client by identifying at least one security characteristic of the backup client; and
deploying a signed certificate on the backup client that enables the backup client to facilitate backup operations with a security level that corresponds to the trust level of the backup client.
10. The method of claim 9 , wherein performing the secure backup operations for the backup client further comprises ensuring that the security level of the signed certificate deployed on the backup client is appropriate for the sensitivity level of the backup task.
11. A system for performing secure backup operations, the system comprising:
an identification module, stored in memory, that identifies a plurality of backup servers with heterogeneous computing environments that provide backup services for at least one backup client;
a determination module, stored in memory, that determines, for each of the plurality of backup servers, a trust level of the backup server by identifying at least one security characteristic of the backup server;
a deployment module, stored in memory, that:
for each of the plurality of backup servers, selects, within a plurality of types of signed certificates that provide various security levels for transferring backup data, an appropriate type of signed certificate for the backup server, wherein:
types of signed certificates that provide high security levels for transferring backup data are appropriate for backup servers with high trust levels; and
types of signed certificates that provide low security levels for transferring backup data are appropriate for backup servers with low trust levels; and
deploys, on each of the plurality of backup servers, a signed certificate of the appropriate type selected for the backup server such that the backup server is capable of transferring backup data with a security level that corresponds to the trust level of the backup server;
a backup module, stored in memory, that performs secure backup operations for the backup client by:
identifying a backup task to be performed;
identifying a sensitivity level of the backup task based at least in part on a type of data involved in the backup task; and
assigning the backup task to at least one backup server within the plurality of backup servers that has a signed certificate that facilitates transferring backup data with a security level appropriate for the sensitivity level of the backup task; and
at least one physical processor configured to execute the identification module, the determination module, the deployment module, and the backup module.
12. The system of claim 11 , wherein the determination module determines the security characteristic of the backup server by identifying a security characteristic of at least one of:
a network the backup server uses to transfer backup data;
a data storage system of the backup server; and
settings of a security infrastructure of the backup server.
13. The system of claim 11 , wherein:
the determination module identifies the security characteristic of the backup server by identifying an initial security characteristic that indicates the backup server meets an initial trust level that is appropriate for a sensitivity level of a type of backup task the backup server will likely perform; and
the deployment module deploys the signed certificate on the backup server by deploying an initial signed certificate that facilitates transferring backup data with a security level that corresponds to the initial trust level.
14. The system of claim 13 , wherein:
the backup module further determines that the security level which with the initial signed certificate facilitates transferring backup data is not appropriate for the sensitivity level of the backup task assigned to the backup server;
the determination module further identifies an additional security characteristic of the backup server that indicates the backup server meets an additional trust level that is appropriate for the sensitivity level of the backup task, the additional trust level being higher than the initial trust level; and
the deployment module further deploys an additional signed certificate on the backup server that facilitates transferring backup data with a security level corresponding to the additional trust level.
15. The system of claim 11 , wherein:
the deployment module further deploys the signed certificate on the backup server by storing, within the signed certificate, the security characteristic of the backup server; and
the backup client facilitates the secure backup operations by authenticating the backup server based on the security characteristic within the signed certificate.
16. The system of claim 11 , wherein the plurality of types of signed certificates comprises at least one of:
signed certificates manually deployed by an administrator of the plurality of backup servers;
signed certificates deployed using an authorization token;
signed certificates deployed using a challenge-response protocol; and
self-signed certificates that are not signed by a certificate authority.
17. The system of claim 11 , wherein the backup module further identifies the sensitivity level of the backup task by identifying at least one of:
a type of backup operation involved in the backup task;
a desired level of confidentiality of data involved in the backup task; and
a security characteristic of the backup client.
18. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
identify a plurality of backup servers with heterogeneous computing environments that provide backup services for at least one backup client;
determine, for each of the plurality of backup servers, a trust level of the backup server by identifying at least one security characteristic of the backup server;
for each of the plurality of backup servers, select, within a plurality of types of signed certificates that provide various security levels for transferring backup data, a type of signed certificate for the backup server, wherein:
types of signed certificates that provide high security levels for transferring backup data are appropriate for backup servers with high trust levels; and
types of signed certificates that provide low security levels for transferring backup data are appropriate for backup servers with low trust levels;
deploy, on each of the plurality of backup servers, a signed certificate of the appropriate type selected for the backup server such that the backup server is capable of transferring backup data with a security level that corresponds to the trust level of the backup server; and
perform secure backup operations for the backup client by:
identifying a backup task to be performed;
identifying a sensitivity level of the backup task based at least in part on a type of data involved in the backup task; and
assigning the backup task to at least one backup server within the plurality of backup servers that has a signed certificate that facilitates transferring backup data with a security level appropriate for the sensitivity level of the backup task.