FR3071937A1 - DEVICE AND METHOD FOR SAVING DATA IN A COMPUTER NETWORK - Google Patents

Abstract

The invention relates to a device 1 and a method for saving data in a computer network, said data 4 being stored in a machine 2, such as a server or a workstation. The backup device 1 is therefore intended to be installed in a computer network comprising at least the machine 2, on which are stored the data 4 to be saved. The device 1 comprises a backup module 3 and a backup zone 5 that is not shared with the machine 2. The backup module 3 is configured to access all or part of the data 4 of the machine 2 and to copy them locally in the zone 2. backup 5.

Description

Device and method for backing up data in a computer network

The present invention relates to a device and a method for backing up data in a computer network. More specifically, the invention relates to the backup of data stored in a machine, such as a server or a workstation, installed in a computer network.

By backing up data from any physical or virtual machine, we mean just as much backing up files, directories, partitions or the entire machine.

Generally, to back up data stored on a machine, one can use a backup software tool, which runs on the machine. Data backup can be performed on a partition of the machine's hard drive, or on a removable storage medium. When the machine is installed in a network, the data of this machine can also be backed up on a remote backup device also installed in the network.

When administering a network comprising several machines, such as servers, client stations, etc., it is advantageous to use a dedicated device, itself installed on the network, to receive the various backups of the data of these different machines. In this case a local backup tool is installed on each of the machines.

Thus, the reception of backups from each machine is centralized at a dedicated device. For this dedicated device to be able to receive data from other machines on the network, its directories must be configured to be shared on the network, a specific port for accessing this device must be open, and finally that the machines with backup and their respective locally installed backup tools have write access rights on the dedicated device.

One of the problems posed by such data backup systems is the opening of a specific access port to the dedicated device which receives backups from each machine. Another problem is giving write permissions to each machine or to the backup software installed on that machine. This specific opening of the port and / or the fact of giving the write rights, make such a backup system vulnerable to viruses and malware, in particular to ransomware type software. Indeed, such malware can easily discover the presence of the dedicated device, by taking note of the information relating to the write rights on the dedicated device available to one of the machines on the network, or to the sharing of the dedicated device, or even to the existence of the specific port for accessing the data to be saved from the machine in question.

One of the aims of the invention is therefore to solve the aforementioned problems in particular. Thus, the object of the invention is in particular to propose a backup device and method which allow the device to be hidden from the eyes of possible viruses or malware, while ensuring complete backup and restore capacity.

A subject of the invention is thus, according to a first aspect, a data backup device intended to be installed in a computer network comprising at least one machine, such as a server or a workstation, which comprises a set of data. to be saved in whole or in part. The machine can just as easily be a physical machine or a virtual machine.

The device includes a backup module, and a backup area not shared with the machine. The backup module is configured to access all or part of the data on the machine and to copy it locally to the backup area.

Thus, the device can back up the data of the machine without one or more of its directories being shared with this machine, therefore without the backup area being shared with this machine, and without the need to install software or backup agent on the machine to be backed up itself. No program, copy or other, or any machine, therefore has write rights in the device, especially in its backup area.

The backup module of the device is thus installed locally in the device, and accesses the data of the machine to be backed up, that is to say read this data, through the network, without using an agent or installed program. on the machine to be backed up.

The backup module has visibility on the machine to be backed up without any share or network path being indicated in the machine to be backed up, thereby preventing any writing from the machine to the backup device. Conversely, since the device can read data from the remote machine and can write to itself, it can access the data on the machine to copy it locally without requiring any network write rights.

According to certain embodiments, the device further comprises one or more of the following characteristics, taken in isolation or in any technically possible combination:

- data access rights are defined in the machine associated with a given identifier and password, the backup module being configured to send to the machine a request for access to the data of this machine, said request containing a name or address of the machine in the network, and a username and password, so that we can access the machine's data once the username and password transmitted in the request are recognized by the machine as corresponding respectively to the username and password determined;

- the machines installed in the network are grouped by domain, and the backup module is configured to send to the machine the request for access to the machine's data, said request also containing the name of the domain to which the machine belongs;

the device comprises a database in which the name or address of each machine of the network are stored on which data to be saved is stored, the identifiers and passwords determined respectively associated with the access rights to the data of each of these machines, and possibly the respective domain names to which these machines belong, the backup module being configured to obtain in said database the name or address of the machine, the identifier and the determined password associated with the rights of access to the data of the machine, and possibly the domain name to which said machine belongs (2), and to transmit these said name or address, username and password determined, and possibly this domain name, obtained in the database, in the data access request sent to the machine;

- the database includes a default identifier and password, the backup module being configured to determine whether there exists, in the database, a specific identifier and password associated with access rights to machine data, and, if the specified username and password associated with the access rights to the machine data do not exist in the database, obtain in this database the username and password password by default and transmit these so-called default identifier and password obtained in the database, in the data access request sent to the machine.

Traditionally, to be able to access a given machine on the network, the backup module uses, when sending the request, the name or address of this machine on the network.

Thus, when creating a data backup task for a specific machine, the name or address of this machine in the network, possibly the domain name to which this machine belongs, and the username and password Access to the data of this specific machine are entered, via an appropriate interface, then remain stored only in the database associated with the backup module. Only the backup module has read rights, these rights being encapsulated in the request transmitted to the machine to be saved.

The device can therefore back up machine data without belonging to the domain in which the machines to be backed up are located.

The invention also relates, according to a second aspect, to a method for backing up data stored in a machine, such as a server or a workstation, installed in a computer network, by means of a data module. backup of a backup device installed in said computer network.

The method comprises a step of access by the backup module to all or part of the data of the machine, and a step of copying by said backup module of said data locally in a backup area of the device not shared with the machine.

According to certain modes of implementation, the method further comprises one or more of the following characteristics, taken in isolation or in any technically possible combination:

- data access rights are defined in the machine associated with a given username and password, access by the backup module to all or part of the machine data including sending to the machine a request for access to the data of the machine, said request containing an identifier and a password, so as to allow the backup module to access the data of the machine once the identifier and the password are transmitted in the request recognized by the machine as corresponding respectively to the identifier and to the password determined;

the machines installed in the network are grouped by domain, and the access by the backup module to all or part of the data of the machine includes the sending to the machine of the request for access to the data of the machine, said request also containing the name of the domain to which the machine belongs;

the device comprises a database in which the name or address of each machine of the network are stored on which data to be saved is stored, the identifiers and passwords determined respectively associated with the access rights to the data of these respective machines, and possibly the respective domain names to which these machines belong, the method comprising obtaining in said database, by the backup module, the name or address of the machine, the identifier and the determined password associated with the rights of access to the data of the machine, and possibly of the domain name to which the said machine belongs, these so-called name or address, username and password determined, and possibly this domain name, obtained in the database, being transmitted in the data access request sent to the machine;

- The database includes a default identifier and password, the method comprising a step of determining the existence, in the database, of a determined identifier and password associated with the rights of access to the machine data, and, if the username and password determined associated with the access rights to the machine data do not exist in the database, a step of obtaining in this database default identifier and password data, these default identifier and password, obtained in the database, being transmitted in the data access request sent to the machine.

Thanks to access rights which are assigned only to the backup module of the device, the latter can read the data of the machine to be backed up, and then write this data locally on itself, without any sharing of all or part of the backup area or without even being in the same domain. No agent or local program on the machine to be backed up is necessary, and therefore no program installed on the machine has rights to write to the backup device.

Thus, the device and the method of the invention make it possible to keep the backup machine invisible on the network vis-à-vis viruses and malware, in particular in the case where the device is out of domain therefore without any other device has visibility on this device.

The characteristics and advantages of the invention will appear on reading the description which follows, given only by way of example, and not limiting, with reference to the single appended figure, corresponding to a schematic representation of an example of a device. according to the invention for implementing the method according to the invention.

In the figure is shown part of a computer network, in which are installed a backup device 1 according to the invention, and a machine 2, such as a server 2, containing data 4 stored in a storage area of data.

The machine 2 also contains operational programs and modules which make it possible to perform a certain number of functions and / or to process the data 4.

By extension, by data backup is meant both data backup 4 and operational programs and modules mentioned in the previous paragraph, themselves stored in the form of instructions. In the following description, reference 4 is used to designate any data that is to be saved, whether it is data intended to be processed by an operational program or module, or such a program or module operational.

A backup task can concern one or more specific data files, one or more specific file storage directories, one or more disks, one or more disk partitions, a whole physical or virtual machine, etc.

The device 1 comprises processing means and instruction storage means, not shown in the figure. The storage means make it possible to store instructions, which, when executed by the processing means, allow the implementation of a certain number of functions, including the backup functions of a backup module 3.

The device 1 also comprises a backup zone 5 intended to store the data 4 of the machine 2.

The instruction storage means mentioned above and the backup area 5 can either be separate physical storage areas or be part of the same physical storage area.

Backup area 5 is not shared with machine 2. Typically, backup area 5 does not contain any directory shared with machine 2. In other words, machine 2 has no access rights to the backup area 5, in particular no writing rights.

Preferably, the device 1 is not located in the field to which the machine 2 belongs.

The backup module 3 is configured to be able to access at least part, preferably all, of the data 4, and to copy this data 4 locally to the backup zone 5. These access and local copy operations, are thus carried out without using a specific port for access by the machine 2 to the device 1.

Conventionally, to access a machine 2

No copy agent or program is installed on machine 2. Thus, no copy module has write rights;

The backup module 3 implements the backup functions, by means of instructions which are processed by the processing means of the device 1, and writes the data saved locally in the backup area 5, thanks to administrative data sharing.

For access to data 4 of machine 2, access rights are defined in this machine 2, for example in the form of an administrator profile or backup administrator. These access rights are associated with a specific username and password.

To access this data 4, the backup module 3 is configured to send to the machine 2 an access request containing an identifier and a password. If this identifier and this password transmitted by the backup module to the machine 2 in the data access request 4, correspond well to the identifier and the password determined for this machine 2, that is to say say if the machine 2 recognizes these identifier and password as being its determined identifier and passwords, then the backup module can access these data 4 from the machine 2.

A database 6 is provided in the device 1, associated with the backup module, in which the respective names or addresses of the machines of the network on which data to be backed up are stored, and the identifiers and determined passwords associated respectively are stored. the access rights to the data of each of these machines.

In the case where the device 1 is not installed in the same domain as one or the other of the machines 2 to be backed up, the database 6 also stores the domain to which each machine of the network belonging to which are stored data to be backed up. The request then sent to the machine 2 by the backup module 3 then also contains the name of the domain to which the machine 2 belongs.

This database 6 can take the form of a simple table such as the following table 1:

Machine Field Access ID Access password SERVER1 Domainel IDServeurl MDPServeurl SERVER2 domain2 / / ADRESSESERVEUR3 domain2 IDServeur3 MDPServeur3 server4 / IDServeur4 MDPServeur4 Item1 Domainel IDPostel MDPPostel workstation2 domain2 IDPoste2 MDPPoste2 POSTE3 domain2 IDPoste3 MDPPoste3

Table 1

The backup module is therefore configured to fetch and obtain in the database 6 the name or address of the machine 2 in the network, the determined identifier and password associated with the access rights to the data of this machine 2, and possibly the domain name to which machine 2 belongs.

It then transmits these determined name or address, username and password, and possibly the domain name, obtained in the database 6, in the data access request 4 sent to the machine 2.

Thus, in the example of table 1 above, when a backup task of the SERVER1 machine is to be executed, the backup module 3 interrogates the database 6 and obtains the determined identifier IDServeurl and the word determined pass MDPServeurl associated with access to the data of the SERVER1 machine, as well as the domainel domain name to which the SERVER1 machine belongs, which it transmits in the access request.

Typically, the machine name or network address is also used by the request to gain access to this machine. For example, in the previous case, the name SERVER1 is used in the request, and a classic address resolution process allows access to the machine. Optionally, the name of the machine can be replaced by its address on the network, as is the case for the SERVER3 machine whose name in table 1 above is replaced by the address ADDRESSERVER3. In the latter case, the request therefore directly uses the address of the machine on the network to access this machine.

It can also happen that the machine to be backed up does not belong to any domain, as is the case with the SERVER4 machine in table 1 above. In this case, no domain name is used in the request.

A user interface is provided to allow a user to enter the name or address of each machine on the network, the identifiers and passwords determined corresponding to each of these machines, and possibly the respective domain names to which the machines belong. 2 , for which a backup task should be scheduled. These identifier / password pairs correspond respectively to identifier / password pairs associated with user profiles, on the respective machines having the access rights to the data of these respective machines.

Optionally, provision is made for the database 6 to include a default identifier and password (not shown in table 1 above).

In this case, the backup module 3 determines whether a certain identifier and password associated with the data access rights 4 of the machine 2 exist in the database 6. If the backup module 3 cannot be found in the determined identifier and password database 6 associated with the access rights to the data 4 of the machine 2, then it retrieves the identifier and password by default, and transmits these identifier and password by default obtained in the database 6, in the data access request 4 sent to the machine 2.

In the example in table 1 above, when the backup module performs a backup task for all or part of the SERVER2 machine, it interrogates the database 6 and finds that no identifier or password is associated with this SERVER2 machine. It then retrieves the default username and password and sends the request to the SERVER2 machine containing the name SERVER2, the default username and password (as well as the domain name Domain2 in this example).

Thus, in the case where the machine 2 and the device 1 are installed on the network so as to belong to the same determined domain of this network, the device 1 automatically has in this domain specific access rights to the data 4 of the machine 2. These rights are informed in the database 6, in the form of the identifier and the corresponding password. The use of the domain name in the request is therefore not essential

This configuration is however not recommended, because the access rights allowing the device 1 to access the data 4 of the machine 2 are then stored in the machine 2 on an administrator account, that is to say an account which itself has access to device 1. This configuration therefore offers a certain visibility, and a potential write right, to an advanced version of malicious software which would scan the administrator rights and the related administrative shares.

It is therefore preferable to place the device 1 outside the domain to which the machine 2 belongs in the network, or in this same domain but without the machine 2 having sufficient rights to access the device 1. In the first case, it is essential to use the domain name in the request.

It is noted that the domain name is presented in table 1 above in a specific "Domain" field, distinct from the other fields, in particular the "Machine" field which identifies each machine. However, this domain name can also be concatenated in one way or another with the identifier of the machine, for example separated by a point, in which case a single field is necessary in the database 6 to store the two data for each machine to be backed up.

A specific backup profile can then be created on the device 1 for the machine 2 to be backed up, and the corresponding identifier and password can be entered in the database 6, to then allow the backup module to execute a backup task on machine 2 as explained above.

Thus, each backup profile or task can have a specific identifier and password associated with a machine name or address in the network, which are parameters entered when setting up backup tasks in the backup module 3 .

By sending the request to machine 2, as explained above, the backup module 3 obtains the rights necessary to access the data 4, the time of the backup only. Once the data 4 is recovered by the backup module 3 with a view to copying it locally, the original rights are restored, that is to say that the access rights used are only valid for the time of the execution of access to data 4 (therefore reading of data 4).

Only the backup module 3 has the rights to read the data 4 from the machine 2, these rights being encapsulated in the request transmitted by the backup module 3 to the machine 2 during the execution of the corresponding backup task.

The device 1 therefore remains invisible to any virus or malicious software which enters the network even if it has administrator rights for this network. Theoretically, during the execution of the data access request 4, the device 1 becomes potentially visible to sufficiently advanced malware. However, the waterproofing of device 1 continues even in this phase, because no write rights on device 1 (backup area 5) are granted to any machine 2 on the network.

It will be noted that the access rights to the data 4 of a machine 2 are generally not only read rights but also write rights. Indeed, the write right is also necessary to read certain data contained in open files, in use by other processes of machine 2, and which continue to receive data during the backup (this is the for example, mail or database files).

This description is given by way of example, and is not limitative of the invention.

In particular, the backup module 3 is not necessarily physically located in a single device. It can be distributed in several devices, the plurality of these devices then constituting the device 1 according to the invention.

Likewise, the backup device 1 can itself take the form of a virtual machine comprising an operating system and a backup module.

Furthermore, the backup module 3 and the database 6 are presented separately in the functional representation of the figure. However, the database and the backup module can just as easily be physically integrated into a single software package executable on the device 1. By extension, in the latter case, the expression backup module is also used to designate this unique software package

Claims (10)

1. - Device (1) for backing up data intended to be installed in a computer network comprising at least one machine (2), such as a server or a workstation, on which data (4) is stored, characterized in that it comprises a backup module (3), and a backup area (5) not shared with the machine (2), said backup module (3) being configured to access all or part of the data (4 ) of the machine (2) and to copy them locally to said backup area (5). 2. Device (1) according to claim 1, data access rights (4) being defined in the machine (2) associated with a given identifier and password, characterized in that the backup module (3 ) is configured to send to the machine (2) a request for access to the data (4) of the machine (2), said request containing a name or an address of the machine (2) in the network, an identifier and a password, so as to be able to access the data (4) of this machine (2) once the identifier and the password transmitted in the request recognized by the machine (2) as corresponding respectively to the identifier and to the password determined. 3. Device (1) according to claim 2, the machines installed in the network being grouped by domain, characterized in that the backup module (3) is configured to send to the machine (2) the data access request (4) of the machine (2), said request also containing the name of the domain to which the machine (2) belongs. 4. Device (1) according to any one of claims 2 and 3, characterized in that it comprises a database (6) in which the names or addresses of each machine of the network are stored on which data are stored to save, the identifiers and passwords determined respectively associated with the access rights to the data of each machine, and possibly the respective domain names to which these said machines belong, the backup module (3) being configured to: - obtain in said database (6) the name or address of the machine (2) in the network, the determined identifier and password associated with the access rights to the data of this machine (2), and possibly the domain name to which this machine belongs (2), - transmit these so-called name or address, username and password determined, and possibly this domain name, obtained in the database (6), in the data access request (4) sent to the machine (2) . 5. Device (1) according to claim 4, characterized in that the database (6) comprises an identifier and a password by default, and in that the backup module (3) is configured for: - determine if there is, in the database (6), a specific identifier and password associated with the data access rights (4) of the machine (2), - if the specified identifier and password associated with the data access rights (4) of the machine (2) do not exist in the database (6), obtain in this database (6) the default identifier and password, and transmit these so-called default identifier and password obtained in the database (6), in the data access request (4) sent to the machine (2). 6. - Method for backing up data stored in a machine (2), such as a server or a workstation, installed in a computer network, by means of a backup module (3) of a device (1) backup installed in said computer network, characterized in that it comprises a step of access by the backup module (3) to all or part of the data (4) of the machine (2), and a step copy by said backup module (3) of said data (4) locally in a backup area (5) of the device (1) not shared with the machine (2). 7. Method according to claim 6, data access rights (4) being defined in the machine (2) associated with a given identifier and password, characterized in that access by the backup module ( 3) all or part of the data (4) of the machine (2) comprises sending to the machine (2) a request for access to the data (4) of the machine (2), said request containing a name or address of the machine (2) on the network, an identifier and a password, so as to allow the backup module (4) to access the data (4) of the machine (2) once the identifier and password transmitted in the request recognized by the machine (2) as corresponding respectively to the identifier and to the password determined. 8. Method according to claim 7, the machines installed in the network being grouped by domain, characterized in that access by the backup module (3) to all or part of the data (4) of the machine (2) comprises sending to the machine (2) the request for access to the data (4) of the machine (2), said request also containing the name of the domain to which the machine (2) belongs. 9. Method according to any one of claims 7 and 8, the device (1) comprising a database (6) in which are stored the names or address of each machine of the network on which are stored data to be saved, the identifiers and specific passwords associated respectively with the rights of access to the data of each of these machines, and possibly the respective domain names to which these said machines belong, characterized in that the method comprises obtaining in said database ( 6), by the backup module (3), of the name or address of the machine (2), of the determined identifier and password associated with the access rights to the data of this machine (2) , and possibly the domain name to which this machine belongs (2), and in that these said name or address, username and password determined, and possibly this domain name, obtained in the database (6), are transmitted in the data access request (4) sent to the machine (2). 10. Method according to claim 9, the database (6) comprising an identifier and a default password, characterized in that it comprises: - a step of determining the existence, in the database (6), of a determined identifier and password associated with the data access rights (4) of the machine (2), - if the determined identifier and password associated with the data access rights (4) of the machine (2) do not exist in the database (6), a step of obtaining in this database data (6) of the default username and password, these so-called default username and password, obtained in the database (6), being transmitted in the data access request (4) sent machine (2).