Automatic authentication of backup clients

• US 20070203957A1
• Filed: 02/03/2006
• Published: 08/30/2007
• Est. Priority Date: 02/03/2006
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Desai, Asit, Zulch, Richard
• Granted Patent: US 7,890,746 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/1464 for networked environments
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2103 Challenge-response

Abstract

A method of automatically authenticating clients on a computer system network enables clients on the network to be automatically logged in and added to a backup database and assigned for backup. The method employs a public key/private key encryption system in which clients have a public key and the backup server has a private key. The backup server interrogates new clients to determine client status and whether the client supports the public key/private key certificate. If it does, the backup server uses key values from the client decrypted using its private key to generate encryption keys which are employed in an algorithm for securely communicating with the client to log the client into a backup database. Otherwise, the backup server uses a password entered by a user in the client for generating the encryption keys. Additionally, the method enables backup software and public keys to be automatically push installed on the clients.

Claims

1. A method of automatically authenticating a client computer in a backup process, comprising:

obtaining by a backup computer first information from the client computer;

determining from the first information whether the client computer is included in a backup database for backup by the backup computer;

upon determining that the client computer is not included in the database, requesting from the client computer second information encrypted using one of a plurality a public keys of the client computer;

decrypting the encrypted second information using a private key of the backup computer;

determining whether the decrypted second information includes expected information; and

adding the client computer to the backup database for backup upon the decrypted second information containing said expected information.

2. The method of claim 1, wherein the expected information comprises a key value, and said adding comprises using the key value in an encryption algorithm to communicate encrypted login information between the client computer and the backup computer.

3. The method of claim 2, wherein said first and second information comprises a key hash of a number generated by the client computer.

4. The method of claim 3 further comprising comparing the key hash of the first information with a decrypted key hash of the second information to determine whether the key hashes match.

5. The method of claim 4, wherein, upon said key hashes not matching, encrypting said second information with another one of said plurality of public keys;

and repeating said decrypting, said comparing, and said adding steps.

6. The method of claim 1 further comprising password protecting the private key in the backup computer.

7. The method of claim 1, wherein said client computer and said backup computer are connected by a network having a plurality of computers, and wherein said method further comprises broadcasting to said plurality of computers a request for said first information, the first information including an identity of each computer;

receiving responses to said request;

identifying said client computer from said responses; and

determining from said responses whether the client computer is included in said backup database.

8. The method of claim 7, wherein said network is connected to a plurality of other networks, each of said other networks having a backup computer for backing up client computers on such other networks, and wherein each of said backup computers has one or more private keys, and the client computers of each of said other networks have a plurality of public keys, comprising public keys associated with the private keys of the backup computers of the other networks.

9. The method of claim 8 further comprising installing a plurality of public keys on said client computer that are associated with the private keys of the backup computers on said networks, and automatically authenticating said client computer on a backup computer of one or more of said networks using appropriate ones of said plurality of public keys installed on said client computer.

10. The method of claim 9, wherein said installing further comprises installing client backup software that cooperates with server backup software installed on backup computers.

11. The method of claim 10, wherein said plurality of public keys and said client backup software are stored on and installed from storage of a server on said network.

12. The method of claim 1 further comprising push installing on said client computer client backup software that cooperates with server backup software on the backup computer, and installing with said client software a plurality of public keys that correspond to respective private keys of a plurality of backup servers.

13. Computer readable media comprising instructions executed by a computer system to perform a method for authenticating a client computer for backup by a backup computer, the method comprising:

obtaining first information from the client computer;

determining from the first information whether the client computer is included in a backup database;

upon determining that the client computer is not included in the database, requesting from the client computer second information encrypted using one of a plurality of public keys of the client computer;

decrypting the encrypted second information using a private key of the backup computer;

determining whether the decrypted second information includes expected information; and

adding the client computer to the backup database for backup upon the decrypted second information containing said expected information.

14. The computer readable media of claim 13, wherein the method is performed by said backup computer.

15. The computer readable media of claim 14, wherein the instructions cause the client computer to generate a key value as part of said second information, and said adding comprises using the key value in an encryption algorithm to communicate encrypted login information between the client computer and the backup computer.

16. The computer readable media of claim 14, wherein said client computer and said backup computer are connected by a network comprising having a plurality of computers, and wherein said requesting comprises broadcasting to said plurality of computers a request for said first information, the first information including an identity of each computer;

receiving responses to said request;

identifying said client computer from said responses; and

determining from said responses whether the client computer is included in said backup database.

17. The computer readable media of claim 16, wherein, upon said decrypted second information not matching containing said expected information, the instructions causing the client computer to encrypt the second information with another of said plurality of public keys;

and repeating in said backup computer said decrypting, said comparing and said adding steps.

18. A system for automatically authenticating a client computer for backup, comprising a backup computer;

a backup database storing identities of computers for backup; and

computer readable media comprising computer program code instructions executable by the backup computer for controlling the operation the backup computer, the instructions controlling the backup computer to receive first information from the client computer and determine whether the client computer is included in the backup database;

upon determining that the client computer is not included in the database, to receive second information from the client computer encrypted using one of a plurality of public keys in the client computer;

to decrypt said second information using a private key in said backup computer; and

, upon the decrypted second information containing expected information, to add the client computer to the backup database.

19. The system of claim 18, wherein said backup computer and said client computer are connected to a network having a plurality of connected computers, each connected computer having a plurality of public keys, at least one public key corresponding to the private key of the backup computer, and wherein said instructions control the backup computer to add authenticated ones of such computers to said backup database upon decrypted information from such computers containing said expected information.

20. The system of claim 18, wherein said backup computer has a plurality of private keys, and said backup computer decrypts said information using multiple ones of said private keys.