Password protection for file backups

• US 7,941,405 B2
• Filed: 03/30/2007
• Issued: 05/10/2011
• Est. Priority Date: 03/30/2007
• Status: Expired due to Fees

• Current Assignee: Veritas Technologies, LLC (Whitehouse Group Ltd.)
• Original Assignee: Data Speed Technology LLC (Empire IP LLC)
• Inventors: De Coninck, Tom, Pype, Hans
• Primary Examiner(s): Vy; Hung T
• Assistant Examiner(s): CAO, PHUONG THAO
• Application Number:
  US11/731,113
• Publication Number:
  US 20080244732A1
• Time in Patent Office: 1,502 Days
• Field of Search: 707/204, 707/652, 707/821, 707/999.204, 726/28
• US Class Current: 707/652
• CPC Class Codes: G06F 11/1458 Management of the backup or restore process
• CPC Class Codes: G06F 11/1464 for networked environments
• CPC Class Codes: G06F 11/1469 Backup restoration techniques
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself

Abstract

Various embodiments of a system and method for performing file backup operations are described. The method may operate to enable a user of a computer system to provide a password or other authentication information to associate with files on the computer system, e.g., in order to protect files that are backed up. For example, when the user (or another person or software agent) attempts to restore or otherwise access a backup copy of a password-protected file, the user may be prompted to enter the password. The method may operate to verify that the entered password matches the password associated with the file before granting permission to restore the file.

Claims

1. A computer-readable memory medium storing program instructions for backing up and restoring a file split into a plurality of segments, wherein the program instructions are executable to:

create first authentication information on a client computer based on input received from a first user during an installation of backup client software on the client computer;

store the first authentication information on one or more backup server computers of a plurality of backup server computers;

in response to an automatic request from the backup client software on the client computer to backup said file;

at each respective backup server computer of the plurality of backup server computers;

receive a respective subset of the plurality of segments of the file; and

store each segment of the respective subset for backup storage;

at one or more backup server computers of the plurality of backup server computers, automatically store information that associates the file with the first authentication information and indicates that the first authentication information is required to restore the file;

in response to a request from a second user to restore the file at a particular backup server computer of the plurality of backup server computers;

access said information in order to determine whether the file has associated authentication information;

in response to determining said stored information indicates the first authentication information is required to restore the file;

prompt the second user to provide second authentication information;

receive the second authentication information;

in response to determining that the second authentication information matches the first authentication information, communicate with each of the other backup server computers of the plurality of backup server computers in order to retrieve each respective segment of the file and return the respective segment to the client computer;

in response to determining that the second authentication information does not match the first authentication information, deny restoration of the file by the second user.

2. The computer-readable memory medium of claim 1, wherein the program instructions are executable to:

perform backup of a plurality of files on behalf of the first user; and

store distinct authentication information provided by the first user for each of the plurality of files, wherein restoration of a given file of the plurality of files requires a user requesting restoration of the given file provide authentication information that matches a respective stored distinct authentication information.

3. The computer-readable memory medium of claim 2, wherein the program instructions are executable to store authentication information in an encrypted form.

4. The computer-readable memory medium of claim 1, wherein the file is a first file of a plurality of files backed up to the plurality of backup server computers, wherein the program instructions are further executable to:

store information indicating that the first authentication information is required to restore any file of the plurality of files;

at the particular backup server computer;

receive a second request to restore a second file of the plurality of files;

in response to the received second request, determine said stored information indicates the first authentication information is required to restore any file of the plurality of files;

receive third authentication information; and

determine whether to grant or deny permission to restore the second file by determining whether the third authentication information matches the first authentication information.

5. The computer-readable memory medium of claim 1, wherein the program instructions are further executable to:

at the particular backup server computer, display an administration graphical user interface (GUI) on a display device of the particular backup server computer;

receive a second request to restore the file from an administrator of the particular backup server computer via the GUI;

in response to the second request, communicate with the client computer to request a user of the client computer to provide authentication information for restoring the file;

receive from the client computer third authentication information provided by the user; and

determine whether to grant or deny permission to restore the file by determining whether the third authentication information matches the first authentication information.

6. The computer-readable memory medium of claim 1, wherein the program instructions are further executable to:

at the particular backup server computer, display an administration graphical user interface (GUI) on a display device of the particular backup server computer;

receive a second request to restore the file from an administrator of the particular backup server computer via the GUI;

prompt the administrator to provide authentication information for restoring the file in response to the second request;

receive third authentication information provided by the administrator; and

determine whether to grant or deny permission to restore the file by determining whether the third authentication information matches the first authentication information.

7. The computer-readable memory medium of claim 1, wherein the file is a first file corresponding to a first folder of a plurality of folders backed up to the plurality of backup server computers, wherein each folder comprises a plurality of files, wherein the client computer is a first client computer, wherein the program instructions are further executable to:

create fourth authentication information on a client computer based on input received from the first user during said installation, wherein the fourth authentication information corresponds to a second folder of the plurality of folders;

receive a second request to restore the file through an Internet web interface from a browser application executing on a second client computer;

receive third authentication information through the Internet web interface from the browser application executing on the second client computer; and

determine whether to grant or deny permission to restore the file by determining whether the third authentication information matches the first authentication information.

8. The computer-readable memory medium of claim 1, wherein, in storing the information indicating that the first authentication information is required to restore the file, the program instructions are executable to perform one or more of:

storing the first authentication information;

storing information derived from the first authentication information.

9. The computer-readable memory medium of claim 1, wherein the first authentication information comprises a password.

10. The computer-readable memory medium of claim 1, wherein the first authentication information comprises biometric information.

11. The computer-readable memory medium of claim 10, wherein the biometric information comprises one or more of:

fingerprint information;

voice information; and

/or retinal scan information.

12. A computer-implemented method for backing up and restoring a file split into a plurality of segments, the method comprising:

creating first authentication information on a client computer based on input received from a first user during an installation of backup client software on the client computer;

storing the first authentication information on one or more backup server computers of a plurality of backup server computers;

in response to an automatic request from the backup client software on the client computer to backup said file;

at each respective backup server computer of the plurality of backup server computers;

receiving a respective subset of the plurality of segments of the file; and

storing each segment of the respective subset for backup storage;

at one or more backup server computers of the plurality of backup server computers, automatically storing information that associates the file with the first authentication information and indicates that the first authentication information is required to restore the file;

in response to a request from a second user to restore the file at a particular backup server computer of the plurality of backup server computers;

accessing said information in order to determine whether the file has associated authentication information;

in response to determining said stored information indicates the first authentication information is required to restore the file;

prompting the second user to provide second authentication information;

receiving the second authentication information;

in response to determining that the second authentication information matches the first authentication information, communicating with each of the other backup server computers of the plurality of backup server computers in order to retrieve each respective segment of the file and return the respective segment to the client computer;

in response to determining that the second authentication information does not match the first authentication information, deny restoration of the file by the second user.

13. The computer-implemented method of claim 12, further comprising:

performing backup of a plurality of files on behalf of the first user; and

storing distinct authentication information provided by the first user for each of the plurality of files, wherein restoration of a given file of the plurality of files requires a user requesting restoration of the given file provide authentication information that matches a respective stored distinct authentication information.

14. The computer-implemented method of claim 13, further comprising storing authentication information in an encrypted form.

15. The computer-implemented method of claim 12, wherein the file is a first file of a plurality of files backed up to the plurality of backup server computers, wherein the method further comprises:

storing information indicating that the first authentication information is required to restore any file of the plurality of files;

at the particular backup server computer;

receiving a request to restore a second file of the plurality of files;

in response to the received second request, determine said stored information indicates the first authentication information is required to restore any file of the plurality of files;

receiving third authentication information; and

determining whether to grant or deny permission to restore the second file by determining whether the third authentication information matches the first authentication information.

16. The computer-implemented method of claim 12, further comprising:

displaying an administration graphical user interface (GUI) on a display device of the particular backup server computer;

receiving a second request to restore the file from an administrator of the particular backup server computer via the GUI;

in response to the second request, communicating with the client computer to request a user of the client computer to provide authentication information for restoring the file;

receiving from the client computer third authentication information provided by the user; and

determining whether to grant or deny permission to restore the file by determining whether the third authentication information matches the first authentication information.

17. The computer-implemented method of claim 12, further comprising:

displaying an administration graphical user interface (GUI) on a display device of the particular backup server computer;

receiving a second request to restore the file from an administrator of the particular backup server computer via the GUI;

prompting the administrator to provide authentication information for restoring the file in response to the second request;

receiving third authentication information provided by the administrator; and

determining whether to grant or deny permission to restore the file by determining whether the third authentication information matches the first authentication information.

18. The computer-implemented method of claim 12, wherein said storing the information indicating that the first authentication information is required to restore the file comprises one or more of:

storing the first authentication information;

storing information derived from the first authentication information.

19. A system for backing up and restoring a file split into a plurality of segments, the system comprising:

a plurality of backup server computers, wherein each backup server computer includes one or more processors and memory storing program instructions;

a client computer system coupled to the plurality of backup server computers configured to;

create first authentication information on the client computer based on input received from a first user during an installation of backup client software on the client computer; and

store the first authentication information on one or more backup server computers of a plurality of backup server computers;

wherein in response to an automatic request from the backup client software on the client computer to backup said file;

each respective backup server computer of the plurality of backup server computers is configured to receive a respective subset of the plurality of segments of the file and store each segment of the respective subset for backup storage;

one or more backup server computers of the plurality of backup server computers are configured to automatically store information that associates the file with the first authentication information and indicates that the first authentication information is required to restore the file;

wherein in response to a request from a second user of to restore the file at a particular backup server computer of the plurality of backup server computers, the particular backup server is configured to;

access said information in order to determine whether the file has associated authentication information;

in response to determining said stored information indicates the first authentication information is required to restore the file;

prompt the second user to provide second authentication information;

receive second authentication information;

in response to determining that the second authentication information matches the first authentication information, communicate with each of the other backup server computers of the plurality of backup server computers in order to retrieve each respective segment of the file and return the respective segment to the client computer;

in response to determining that the second authentication information does not match the first authentication information, deny restoration of the file by the second user.