User authorization for file level restoration from image level backups

1. A backup server, comprising:

a processor configured to execute a backup application; and

a storage configured to store at least one image level backup of a machine located on a host system,

wherein the backup application, when executed by the processor, is configured to:

save, during backup or replication activity to a database, a plurality of user accounts belonging to an access control group associated with the machine;

receive a restoration request via a backup application user interface on the machine from a user system, the restoration request including a first machine identifier and a user identifier of a user currently logged onto the machine through the user system, wherein the restoration request is configured to request access to the at least one image level backup;

retrieve, by the backup server, a second machine identifier associated with the machine from the at least one image level backup;

perform a comparison between the first machine identifier and the second machine identifier associated with the machine; and

accept the restoration request based at least in part on the comparison between the first machine identifier and the second machine identifier; and

based on accepting the restoration request, transmit an acceptance response to the machine, wherein the acceptance response is configured to cause the backup application user interface to provide, to the user system, an interface for selecting an object for restoration from the at least one image level backup.

2. The backup server of claim 1 , wherein the access control group is a local administrators group.

3. The backup server of claim 1 , wherein the backup application is further configured to deny the restoration request if the first machine identifier does not match the second machine identifier.

4. The backup server of claim 1 , wherein the backup application is further configured to:

identify whether the user identifier contained in the restoration request belongs to the access control group associated with the machine; and

accept or deny the restoration request based at least in part on whether or not the user identifier belongs to the access control group associated with the machine.

5. The backup server of claim 4 , wherein the access control group is a local administrators group.

6. The backup server of claim 1 , wherein the backup application is further configured to deny the restoration request if the user identifier contained in restoration request does not belong to the access control group associated with the machine.

7. The backup server of claim 6 , wherein the access control group is a local administrators group.

8. The backup server of claim 1 , wherein the backup application is further configured to:

write an authentication cookie to a location within a file system of the machine accessible to at least the user system initiating the restoration request;

prompt the user system to provide the authentication cookie to the backup application;

deny the restoration request if no authentication cookie is received from the user within a predetermined time interval; and

if an authentication cookie is received within the predetermined time interval from the user system,

accept the restoration request if the received authentication cookie matches the written authentication cookie; and

deny the restoration request if the received authentication cookie does not match the written authentication cookie.

9. A computer-implemented method, comprising:

saving, during backup or replication activity to a database, a plurality of user accounts belonging to an access control group associated with a machine, the machine having at least image level backup stored on a backup server;

receiving, by the backup server, a restoration request from a user system via a host system, the restoration request including a first machine identifier and a user identifier of a user currently logged onto the machine through the user system, wherein the restoration request is configured to request access to the at least one image level backup;

retrieving, by the backup server, a second machine identifier associated with the machine from the at least one image level backup;

performing a comparison between the first machine identifier and the second machine identifier associated with the machine;

based on the comparison between the first machine identifier and the second machine identifier, transmitting a prompt to the user system via the host system to provide an authentication cookie; and

accepting the restoration request based at least in part on the comparison between the first machine identifier and the second machine identifier and receiving the authentication cookie in response to the prompt.

10. The computer-implemented method of claim 9 , where the access group is a local administrators group.

11. The computer-implemented method of claim 9 , further comprising:

denying the restoration request if the first machine identifier does not match the second machine identifier.

12. The computer-implemented method of claim 9 , further comprising:

identifying whether the user identifier contained in the restoration request belongs to the access control group associated with the machine; and

accepting or denying the restoration request based at least in part on whether or not the user identifier belongs to the access control group associated with the machine.

13. The computer-implemented method of claim 12 , where the access control group is a local administrators group.

14. The computer-implemented method of claim 9 , further comprising:

denying the restoration request if the user identifier does not belong to the access control group associated with the machine.

15. The computer-implemented method of claim 13 , where the access control group is a local administrators group.

16. The computer-implemented method of claim 9 , wherein, the method further comprises:

prior to transmitting the prompt for the authentication cookie, writing the authentication cookie to a location within a file system of the machine accessible to at least the user system initiating the restoration request;

denying the restoration request if no authentication cookie is received from the user system within a predetermined time interval; and

if an authentication cookie is received within the predetermined time interval from the user system,

accepting the restoration request if the received authentication cookie matches the written authentication cookie; and

denying the restoration request if the received authentication cookie does not match the written authentication cookie.

17. A computer program product comprising a non-transitory computer readable medium including computer control logic stored therein, wherein the computer control logic, when executed by one or more processors, enables a method for user authorization for file level restoration from an image level backup, the method comprising:

saving, during backup or replication activity to a database, a plurality of user accounts belonging to an access control group associated with a machine located on a host system, the machine having at least one image level backup stored on a backup server;

receiving, by the backup server, a restoration request from a user system via a backup application user interface on the virtual machine, the restoration request including a first machine identifier and a user identifier of a user currently logged onto the machine through the user system, wherein the restoration request is configured to request access to the at least one image level backup;

retrieving, by the backup server, a second machine identifier associated with the machine from the at least one image level backup;

performing a comparison between the first machine identifier and the second machine identifier associated with the machine;

accepting the restoration request based at least in part on the comparison between the first machine identifier and the second machine identifier; and

based on accepting the restoration request, transmitting an acceptance response to the machine, wherein the acceptance response is configured to cause the backup application user interface to provide an interface to the user system for selecting an object for restoration from the at least one image level backup.

18. The computer program product of claim 17 , the method further comprising:

denying the restoration request if the first machine identifier does not match the second machine identifier.

19. The computer program product of claim 17 , the method further comprising:

identifying whether the user identifier contained in the restoration request belongs to the access control group associated with the machine; and

accepting or denying the restoration request based at least in part on whether or not the user identifier belongs to the access control group associated with the machine.

20. The computer program product of claim 19 , where the access control group is a local administrators group.

21. The computer program product of claim 17 , the method further comprising:

denying the restoration request if the user identifier contained in the restoration request does not belong to the access control group associated with the machine.

22. The computer program product of claim 21 , where the access control group is a local administrators group.

23. The computer program product of claim 17 , wherein the method further comprises:

writing an authentication cookie to a location within a file system of the machine accessible to at least the user system initiating the restoration request;

prompting the user system to provide the authentication cookie;

denying the restoration request if no authentication cookie is received from the user system within a predetermined time interval; and

if an authentication cookie is received within the predetermined time interval from the user system,

accepting the restoration request if the received authentication cookie matches the written authentication cookie; and

denying the restoration request if the received authentication cookie does not match the written authentication cookie.

24. A backup server, comprising:

a processor configured to execute a backup application; and

a storage configured to store at least one image level backup of a machine located on a host system,

wherein the backup application when executed by the processor is configured to:

save, during backup or replication activity to a database, a plurality of user accounts belonging to an access control group associated with the machine, wherein the plurality of user accounts include a plurality of user identifiers;

receive a restoration request from a user system via a backup application user interface on the machine, the restoration request including a machine identifier and a user identifier of a user currently logged onto the machine through the user system, wherein the restoration request is configured to request access to the at least one image level backup;

compare the user identifier to the plurality of user identifiers, wherein the plurality of user identifiers are included with the at least one image level backup of the machine;

accept the restoration request based at least in part on whether or not the user identifier matches one of the plurality of user identifiers; and

based on accepting the restoration request, transmit an acceptance response to the machine, wherein the acceptance response is configured to cause the backup application user interface to provide an interface to the user system for selecting an object for restoration from the at least one image level backup.

25. The backup server of claim 24 , wherein the access control group is a local administrators group.

26. The backup server of claim 24 , wherein the backup application is further configured to deny the restoration request if the user identifier does not match any of the plurality of user identifiers.

27. The backup server of claim 24 , wherein the backup application is further configured to use the machine identifier to limit visible scope of content of the at least image level backup.

28. A computer-implemented method, comprising:

saving, during backup or replication activity to a database, a plurality of user accounts belonging to an access control group associated with a machine located on a host system, the plurality of user accounts including a plurality of user identifiers, the machine having at least one image level backup stored on a backup server;

receiving a restoration request from a user system via a backup application user interface on the machine, the restoration request including a machine identifier and a user identifier of a user currently logged onto the machine through the user system, wherein the restoration request is configured to request access to the at least one image level backup;

comparing the user identifier to the plurality of user identifiers, wherein the plurality of user identifiers are included with the at least one image level backup of the machine;

accepting the restoration request based at least in part on whether or not the user identifier matches one of the plurality of user identifiers; and

based on accepting the restoration request, transmitting an acceptance response to the machine, wherein the acceptance response is configured to cause the backup application user interface to provide an interface to the user system for selecting an object for restoration from the at least one image level backup.

29. The computer-implemented method of claim 28 , wherein the access control group is a local administrators group.

30. The computer-implemented method of claim 28 , further comprising:

denying the restoration request if the user identifier does not match any of the plurality of user identifiers.

31. The computer-implemented method of claim 28 , further comprising:

using the machine identifier to limit visible scope of content of the at least one image level backup.

32. A computer program product comprising a non-transitory computer readable medium including computer control logic stored therein, wherein the computer control logic, when executed by one or more processors, enables a method for user authorization for file level restoration from an image level backup, the method comprising:

saving, during backup or replication activity to a database, a plurality of user accounts belonging to an access control group associated with a machine located on a host system, the plurality of user accounts including a plurality of user identifiers, the machine having at least one image level backup stored on a backup server;

receiving a restoration request from a user system via a backup application user interface on the machine, the restoration request including a machine identifier and a user identifier of a user currently logged onto the machine through the user system, wherein the restoration request is configured to request access to the at least one image level backup;

comparing the user identifier to the plurality of user identifiers, wherein the plurality of user identifiers are included with the at least one image level backup of the machine;

accepting or denying the restoration request based at least in part on whether or not the user identifier matches one of the plurality of user identifiers; and

based on accepting the restoration request, transmitting an acceptance response to the machine, wherein the acceptance response is configured to cause the backup application user interface to provide an interface to the user system for selecting an object for restoration from the at least one image level backup.

33. The computer program product of claim 32 , wherein the access control group is a local administrators group.

34. The computer program product of claim 32 , further comprising:

denying the restoration request if the user identifier does not match any of the plurality of user identifiers.

35. The computer program product of claim 32 , further comprising:

using the machine identifier to limit visible scope of content of the at least one image level backup.

36. The backup server of claim 1 , wherein the backup application is further configured to:

limit a visible scope of content of the at least one image level backup based on the first machine identifier.