System and method for performing storage operations through a firewall

• US 20050039051A1
• Filed: 04/05/2004
• Published: 02/17/2005
• Est. Priority Date: 04/03/2003
• Status: Active Grant

• Current Assignee: CommVault Systems Incorporated
• Original Assignee: CommVault Systems Incorporated
• Inventors: Erofeev, Andrei
• Granted Patent: US 7,631,351 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes

Abstract

The present invention provides systems and methods for performing storage operations through a firewall. Methods are provided that include, in a networked computer system, identifying, based on configuration data, whether each of a set of network elements is within a trusted network or not within the trusted network. Traffic between elements within the trusted network and elements not within the trusted network must pass through a firewall. The methods also include, prior to performing a storage operation through the firewall, allocating a specific set of ports, in accordance with at least one security parameter, for use in performing the storage operation. Methods are also provided which include monitoring traffic through the specific ports, and, if traffic is determined to be inactive through a first port of the specific ports, sending a packet through the first port.

Claims

1. A method for performing storage operations through a firewall in a networked computer system, the method comprising:

identifying, based on configuration data, whether each of a set of network elements is within a trusted network or not within the trusted network, wherein traffic between elements within the trusted network and elements not within the trusted network must pass through the firewall; and

prior to performing a storage operation through the firewall, allocating a specific set of ports, in accordance with at least one security parameter, for use in performing the storage operation.

2. The method of claim 1, wherein ports to be utilized during the storage operation are limited to the specific set of ports.

3. The method of claim 1, wherein the set of ports allocated according to the at least one security parameter is a minimal number of ports needed to conduct the storage operation.

4. The method of claim 1, wherein traffic between network elements within the trusted network does not pass through the firewall.

5. The method of claim 1, wherein the configuration data resides in a port configuration file.

6. The method of claim 5, wherein allocating the specific set of ports comprises reading the port configuration file.

7. The method of claim 1, comprising a storage manager allocating the specific set of ports.

8. The method of claim 1, comprising a storage manager allocating one or more of the specific ports for each of one or more media agents, and the storage manager allocating one or more of the specific ports for each of one or more data agents.

9. The method of claim 1, comprising reducing chunk size to be utilized during the storage operation as necessary to cause chunk creation time to be less than a firewall time-out interval.

10. A method for performing storage operations through a firewall in a networked computer system, the method comprising:

identifying, based on configuration data, a first set of network elements which are within a trusted network and a second set of network elements which are not within the trusted network, wherein traffic between elements within the trusted network and elements not within the trusted network must pass through the firewall;

prior to performing a storage operation through the firewall, allocating a specific set of ports, according to at least one security parameter, for use in performing the storage operation;

during the storage operation, monitoring traffic through each of the specific ports; and

if, through the monitoring, traffic is determined to be inactive through a first port of the specific ports for a specified time period, sending a packet through the first port.

11. The method of claim 10, wherein ports to be utilized during the storage operation are limited to the specific set of ports.

12. The method of claim 10, wherein the set of ports allocated according to the at least one security parameter is a minimal number of ports needed to conduct the storage operation.

13. The method of claim 10, wherein sending the packet comprises sending a dummy packet.

14. The method of claim 10, wherein the packet is sent to prevent closing of the first port due to a firewall time-out.

15. The method of claim 10, wherein the specified time period is less than a firewall time-out period.

16. A system for performing storage operations through a firewall in a networked computer system, the system comprising:

a firewall;

a plurality of network elements, comprising;

one or more client computers; and

one or more storage devices;

a storage manager; and

one or more media agents which conduct data between the one or more client computers and the one or more storage devices under the direction of the storage manager;

wherein the storage manager;

identifies, based on configuration data, a first set of network elements which are within a trusted network and a second set of network elements which are not within the trusted network, wherein traffic between elements of the trusted network and elements not within the trusted network must pass through the firewall; and

prior to performing a storage operation through the firewall,

allocates a specific set of ports, according to at least one security parameter, for use in performing the storage operation; and

wherein, during a storage operation, the firewall opens ports in accordance with the allocation.

17. The system of claim 16, wherein ports to be utilized during the storage operation are limited to the specific set of ports.

18. The system of claim 16, wherein the set of ports allocated according to the at least one security parameter is a minimal number of ports needed to conduct the storage operation.

19. The system of claim 16, wherein the configuration data resides in a port configuration file.

20. The system of claim 19, wherein allocating the specified ports comprises reading the port configuration file.

21. The system of claim 16, wherein the storage manager:

during the storage operation, causes monitoring of traffic through each of the specific ports; and

if, through the monitoring, traffic is determined to be inactive through a first port of the specific ports for a specified time period, causing a packet to be sent through the first port.

22. The system of claim 21, wherein the packet is sent to prevent closing of the first port due to a firewall time-out.

23. The system of claim 21, wherein the specified time period is less than a firewall time-out period.