System and method for secure authentication of backup clients using short-term tokens
Embodiments for a system and method for secure authentication of backup clients in a way that eliminates the need to create users for backup client authentication anywhere in the backup ecosystem, and which eliminates the need for credentials, such as passwords that need protection, updating and synchronization. Such embodiments use a short-term token, such as a JSON web token, for both client and server authentication within the system, and verifies that the tokens grant access using the public key corresponding to the private key assigned to the directory objects by the creator of the directory objects.
1. A computer-implemented method of backing up data, comprising:
sending, from a backup server, a request to a storage system to create a directory for storing data to be backed up for a client, with a public key to be associated with the directory;
creating a short-term token signed with a private key associated with the public key;
upon the client starting a backup operation, passing a name of the directory and the short-term token to the client;
sending, from the client to the storage system, a backup request, the name of the directory, and the short-term token received from the backup server;
using, by the storage system, the public key to ensure that the backup server has access to the directory;
verifying, through a name comparison, that the backup server has given the permission to the client to do perform the backup operation; and
extracting permission and privileges from the short-term token to ensure that the client has access to a file path so that the backup operation can commence.
2. The method of claim 1 wherein the public key establishes the backup server ownership over the directory it is creating.
3. The method of claim 1 wherein the short-term token comprises a JavaScript Object Notation (JSON) web token (JWT).
4. The method of claim 3 wherein the JWT comprises:
the directory name where the backup files will be created;
the backup client name; and
permissions and privileges for the backup client on the directory.
5. The method of claim 4 wherein the backup client name comprises the common name (CN) or subject alternative name (SAN) of a X.509 certificate of the backup client.
6. The method of claim 5 wherein the name comparison comprises:
extracting, by the storage system, the backup client name from the JWT; and
comparing the extracted name with CN or SAN of the X.509 certificate.
7. The method of claim 3 wherein the backup server comprises a Data Domain server executing a deduplication backup process.
8. The method of claim 7 wherein the deduplication backup process is a distributed system at least partially having a client-side deduplication process executed by a Data Domain Boost server.
9. A method of backing up data in a computer network comprising a backup server backing up client data generated by a client to a storage system, comprising:
associating the backup server with a directory of the storage system using a public key of a public/private key pair;
generating, by the backup server, a short-term token specifying a storage unit, permissions for the client, a backup job type, and a token expiration time;
encrypting the short-term token with a private key of the public/private key pair for transmission from the backup server to the client with a name of the directory;
sending the short-term token from the client to the directory; and
verifying, by the storage system valid access by the backup server to the directory, valid path access to the directory, and valid access by the client to the directory by comparing a client name extracted from the short-term token with a name provided in a key certificate of the client.
10. The method of claim 9 wherein the short-term token comprises a JavaScript Object Notation (JSON) web token (JWT).
11. The method of claim 10 wherein the backup client name comprises the common name (CN) or subject alternative name (SAN) of a X.509 certificate of the backup client.
12. The method of claim 9 wherein the backup server comprises a Data Domain server executing a deduplication backup process.
13. The method of claim 12 wherein the deduplication backup process is a client-side process executed by a Data Domain Boost server.
14. A system comprising:
a backup server sending a request to a storage system to create a directory for storing data to be backed up for a client in a backup operation, with a public key to be associated with the directory, and creating a short-term token signed with a private key associated with the public key;
the client receiving a backup operation request including a name of the directory and a short-term token from the backup server, and sending to a storage system the short-term token received from the backup server; and
the storage system using the public key to ensure that the backup server has access to the directory;
the storage server further verifying, through a name comparison, that the backup server has given permission to the client to do perform the backup operation and extracting permission and privileges from the short-term token to ensure that the client has access to a file path so that the backup operation can commence.
15. The system of claim 14 wherein the public key establishes the backup server ownership over the directory it is creating.
16. The system of claim 14 wherein the short-term token comprises a JavaScript Object Notation (JSON) web token (JWT), and further wherein the JWT comprises:
the directory name where the backup files will be created;
the client name; and
permissions and privileges for the client on the directory.
17. The system of claim 16 wherein the backup client name comprises the common name (CN) or subject alternative name (SAN) of a X.509 certificate of the backup client.
18. The system of claim 17 wherein the name comparison comprises:
extracting, by the storage system, the backup client name from the JWT; and
comparing the extracted name with CN or SAN of the X.509 certificate.
19. The system of claim 18 wherein the backup server comprises a Data Domain server executing a deduplication backup process.
20. The system of claim 19 wherein the deduplication backup process is a client-side process executed by a Data Domain Boost server.