EP2915046A1

EP2915046A1 - Method for the protected recovery of data, computer programme product and computer system

Info

Publication number: EP2915046A1
Application number: EP13786223.1A
Authority: EP
Inventors: Heinz-Josef CLAES
Original assignee: Fujitsu Technology Solutions Intellectual Property GmbH
Current assignee: Fujitsu Technology Solutions Intellectual Property GmbH
Priority date: 2012-11-02
Filing date: 2013-10-31
Publication date: 2015-09-09
Also published as: JP2015533439A; US20150293818A1; WO2014068049A1; DE102012110507A1

Abstract

Disclosed is a method for the protected recovery of data (D_A, D_B, D_C), which is stored in a back-up computer system (1), into a source computer system (A, B, C). A control of access (2, 2B, 6) is provided, which requests from a user group access information for accessing a recovery process (Recover), but which denies the user group access to the data (D_A, D_B, D_C) in the back-up computer system (1). The execution of the recovery process (Recover) can be commanded by a user of the user group if the requested access information corresponds to deposited access information for the user group and the commanded recovery process (Recover) comprises the restoration of selected data (D_A, D_B, D_C) from the back-up system (1) to the source computer system (A, B, C).

Description

description

Method for the secure restoration of data

Computer program product and computer system

The invention relates to a method for protected

Recover data stored in a backup computer system on a source computer system. Furthermore, the invention relates to a

A computer program product comprising a computer program which when executed on a computer system performs such a method. In addition, the invention relates to a

Computer system, which is designed to perform such a method.

System administrators or administrators have over

Access to the hardware or access to the software of a computer system to maintain and manage the computer system, so that an error-free operation of the computer system or an error-free use of the computer system by end users is guaranteed.

The problem is that the extended access rights of system administrators or administrators in general also allow access to personal or confidential data stored on the operated computer system. For example, administrators have the ability to read sensitive data from end users.

Usual approaches to ensure the confidentiality of information or privacy in general are given by the fact that certain rules (processes that should be respected) and rules (prohibitions) between the different user groups of a computer system for example, by contract. The problem with these approaches, however, is that user groups with

extended access rights, such as employees of a software services company, can be criminal, extorted or bribed. Thus, technical

Actions are required to prevent access to confidential data within a computer system.

In particular, system data or user data stored in a backup computer system may be subject to unauthorized access by system administrators or

Be administrators. Lead system administrator or

Administrators, for example, a recovery process to restore the above data on one

original source computer system, they generally have access to such data. It should be so

Prevent system data from being changed or manipulated by a system administrator or administrator or from reading confidential user data.

Technical measures of encryption of such data allow only limited or bypassable access protection, because the data is decrypted by knowledgeable users or

can be reconstructed or by appropriate means processing (for example, in the processor core of the backup computer system) or in their recovery in the source computer system in unencrypted form. Measures of encryption of the data are therefore not sufficient alone to ensure increased data protection.

The invention is therefore based on the object

Procedures, a computer program product and a

Computer system to show which by technical measures to protect and prevent unauthorized access to data stored in a backup computer system on a source computer system.

This object is achieved in a first aspect by a method of the type mentioned, wherein a

Access control is provided, which

Queries access information of a user group to access a recovery process, but prohibits access of the user group to the data or data content (for example, in the backup and / or source computer system). Of the

Restoration process can be instructed by a user of the user group, if the queried

Access information matches stored user group access information, wherein the instructed recovery process comprises rewriting selected data from the backup computer system to the source computer system.

Such a procedure allows a user of

User group only access to one

Recovery process for restoring data from the backup computer system to a source computer system. Access to the data both in the backup computer system and in the source computer system as well as during their

Processing in a current write-back or

Recovery process (e.g., by means of

Access control) is prohibited to the user of the user group by the access control unit. This means that if a user successfully authorizes over the

Access control stored by query

Access information just the recovery process perform, instruct or trigger. A writeback of selected data from the backup computer system to the source computer system can be automated. The access control is a security hurdle, so that the data can not be accessed, but only their recovery can be triggered on a source computer system.

The advantage of the explained method is that system administrators or administrators can not modify or manipulate relevant data, let alone open and read. Nevertheless, system administrators or administrators can perform their system support tasks by initiating or executing targeted recovery of data on a source computer system (from which that data originates), such as backing up the source computer system again and performing a specific backup Error condition can be solved. The data in the backup computer system may be any data of a system, for example user data,

Configuration data, disk image data, etc.

The term "source computer system" includes any kind

Computer system, which data of the above kind via a

Backup process in the backup computer system via a computer network can store. Thus, data stored in the backup computer system originates from at least one such computer system as its source. It is also conceivable that the source computer system and the backup computer system are set up as an overall system. In this case, backup data will be within this

Whole system via a backup process in a backup Memory is stored and can be restored from this.

The term "access to data" in this context includes any read and / or write access to data or

Data content. The term "data" can be used as

Information (raw data in unencrypted form) can be understood. As such, write access (write permissions) to the source and / or backup computer system per se may be allowed by the access control to transfer data from the backup computer system to the source computer system

to write back.

Advantageously restricts the recovery process

Write back the data to a predetermined source computer system. This has the advantage that the data can not be written back to any computer system which may not represent the actual source computer system of the data. In this way it can be prevented that a system administrator or

Administrator the data on one for this data

unauthorized computer system dubbed. So will

in particular, the case prevented that a system administrator or administrator dubbing sensitive data of a first user from the backup computer system to a computer system of a second user, which is not authorized to access the confidential data of the first user. Advantageously, a designated recovery process thus only triggers a write-back of the data to the source computer system, from which the data actually

originally come. The data to be written back For example, certain information about the source computer system (eg IP or MAC address or

Path information, etc.) that uniquely identify a predetermined source computer system. However, it is also possible to set up and assign so-called hard links (I-Nodes) to archive (write back) or write back

(Restoring) data or files (including their attributes or metadata). The explained method can be carried out, for example, by means of an access control in a computer system which is implemented as system software or also within a microcontroller module as a logical sequence program or as a combination of both. The access control can be used as an access control unit in a

Integrated system (unified source and backup system). But it is also conceivable that the access control several subprograms or software agents or

Microcontrollers that are set up on multiple computer systems within a computer network infrastructure to allow the restoration of the data from a computer system as a backup computer system to another computer system as a source computer system. The access control can also be set up on a dedicated

Computer system in addition to a backup computer system and a

Be set up source computer system. It is conceivable that access control provides a user with write access to the source computer system to write back the data

but prohibits read and / or write access to the data in both the source computer system and the backup computer system. One application of the described method is advantageous within a secure or protected computer network infrastructure, so-called "sealed

In such an infrastructure, a backup computer system (alternatively or supplementally also source computer systems) may generally be encapsulated such that access to some or all of the data or data content in such a computer system (ie, logical access on the computer system) and / or a mechanical access to the hardware of the computer system (that is, a physical access) not or only

restricted are possible. Such systems may be arranged so that only predetermined data and

Information from the system can be passed unidirectionally outward within a network structure. In particular, the provision of data within the backup computer system, which previously brought the risk of unauthorized access to the data, can be improved in this way by the explained method, because the access to predetermined information in the backup computer system users of the user group only restricted or prohibited.

When writing back from the backup computer system to the source computer system, the data is preferably automatically written to a predetermined memory address or a predetermined memory location (which can also be a specific address space) in the source computer system. This has the advantage for a user of the source computer system that after a successful recovery process

original data at a predetermined location, e.g.

back to the original place, in the data system of the

Source computer system are present. This way you can a user of the source computer system can quickly find the data. It would be theoretically possible, all

Easily reconstruct the links and paths of recovered files so that the user of the source computer system can

Adjustment difficulties can continue.

Advantageously, the access control prohibits access of the user group whose users can instruct the recovery process in the backup computer system on data or

Data content in the source computer system or general access to the source computer system itself (possibly subject to write access to restore data to the source computer system). This generally means that users of the user group who have a

Restore data from the backup computer system to the source computer system, not the

User group to the users who simultaneously have full access to the source computer system. For example, the user group containing the

Restore process in the backup computer system may be formed by system administrators or administrators. However, these will have access to data or

Data content is prohibited in the source computer system. Only a user group of end users of the source computer system has unrestricted access to data or data contents of the source computer system.

However, it is conceivable that in addition to the user group that can direct the recovery process in the backup computer system, but has no access to the data in the backup computer system, there is another user group that performs the recovery process in the backup computer system can also instruct, but unlike the first user group also has access to selected data in the backup computer system. In this case, the access control can advantageously additionally access information of the at least one further user group to access the

Query the recovery process and allow the at least one other user group to access selected data in the backup computer system. As already explained, the recovery process can be instructed by a user of the at least one further user group if the requested access information matches stored access information of the at least one further user group. One

Recovery process can thus be instructed by the latter user when he is analogous to the already explained case of the first user group

successfully authenticated or authorized on the backup computer system. For example, it is conceivable that

End users of a source computer system personally have access to data in the backup computer system, so they can read this data and at the same time can be written back from the backup computer system to their source computer system to perform a data recovery. Advantageously, the access control allows a deletion or renaming, but no opening of files in which the data is summarized in the backup computer system or

which represent the data in the backup computer system. This aspect applies in particular to the first user group, which can only instruct a recovery process in the backup computer system, but has no access to the data itself. According to another aspect, this user group may also be allowed to store files in the source Rename or delete the computer system. Both of these aspects have the advantage that data which clearly can not or must be recovered or

deprecated information, for example, by a system administrator or administrator can be deleted. Files can also be renamed in the source computer system to prevent, for example, overwriting files while writing back from the backup computer system to the source computer system. This increases the flexibility in writing back. The ability to delete or rename files is a manipulation of data, but this does not affect an increased privacy negative, because the information to be protected still can not be accessed.

In general, it is also conceivable to display file names, in particular the first user group, only encrypted or, alternatively, converted into a hash value. This is

For example, if you want to recover predetermined file packages whose file names may already contain private or confidential information. However, this only makes sense if one

Restore a file package without having to select specific files based on their filename. For example, it is conceivable that an end user may have his or her personal files

Using a predefined hash algorithm (eg MD5), directories are converted into a hash value and sent in this form to a user who can only instruct a restore process (eg administrator). The latter sees only hash values instead of the actual combination of file path and file name. The access controller can then use the hash values to select and if necessary, restore these files or

Directories are performed without confidential information being visible within the file paths or file names. Alternatively or additionally, the implementation of a four-eye principle would be conceivable, with an editing of file names only by an administrator

can be performed if it has been previously enabled or verified by an appropriate user. In a further aspect, the invention is characterized by a

Computer program product and a computer system solved. The computer program product includes a computer program which when run on a computer system is a method of

explained manner performs.

The computer system has an access control unit for

Controlling access to a restore process for recovering data in the computer system or in another computer system, the access control unit configured to perform a method of the type discussed.

Further advantageous embodiments are in the

Subclaims and in the following

Description of the figures disclosed. The invention will be explained in more detail below with reference to several drawings.

FIG. 1 shows a schematized representation of a computer network infrastructure for implementing a

inventive method and Figure 2 is a schematic representation of a computer network infrastructure for alternative implementation of a method according to the invention. Figure 1 shows a schematic representation of a

Computer network infrastructure comprising multiple computer systems. In particular, FIG. 1 shows a backup computer system 1, an administrator computer system 4 and a plurality of source computer systems A, B and C. This configuration is merely exemplary, wherein the computer network infrastructure may include other computer systems, in particular other source computer systems, or may have a different configuration. The backup computer system 1 forms the central system of the infrastructure. The backup computer system 1 can

For example, a data server of a

Include a service company

Access control unit 2 in the backup computer system 1

whose tasks are explained in more detail below.

In addition, the backup computer system 1 comprises a backup memory 31 in which backup data D_A, D_B, D_C of individual source computer systems A, B, C are stored. The backup data D_A, D_B, D_C were, for example, transferred as part of a backup process of individual source computer systems A, B, C to the backup computer system 1 and stored by means of the access control unit 2 in the backup memory 31. For the sake of simplicity, however, this process is not shown in FIG. In FIG. 1 it is assumed that backup data D_A, D_B, D_C are in some form stored in backup memory 31 to recover this data on at least one of the source computer systems A, B, C.

The backup computer system 1 is a protected or encapsulated system according to the configuration in FIG

(indicated by a lock symbol) executed. For example, the backup computer system 1 may be part of a so-called "sealed infrastructure." This means that access by users within the overall system (for example, through the administrator computer system 4 or one of the source computer systems A, B, C) of external to the protected backup computer system 1, in particular to backup data D_A, D_B, D_C is not possible in the backup memory 31. Thus, for example, access to the backup memory 31 from the outside may generally be prohibited

Access to a functionality of the access control unit 2 of the backup computer system 1 is allowed.

It is alternatively or additionally possible that only the access control unit 2 part of the encapsulated

System is (then only the access control unit 2 would be provided with a lock symbol). The backup memory 31 may be configured outside of the encapsulated system, in particular outside of the backup computer system 1. In this case, all backup data D_A, D_B, D_C are advantageously present in encrypted form in the backup memory 31, so that access to the backup data D_A, D_B, D_C as such (ie to information to be protected) despite access to the backup memory 31 (eg for a restore, replication, etc.) is not possible. An encryption can take place by means of the access control unit 2. A recovery process of backup data D_A, D_B, D_C from the backup memory 31 to one of the source computer systems A, B, C can be carried out in accordance with FIG. 1 as follows. An administrator tool 6 in the administrator computer system 4 can first of all authenticate an authorized user of the administrator computer system 4 at the

Access control unit 2 in the backup computer system 1 done. For this purpose, a user for example gives a user name and / or a user password, generally predetermined

Access information, via the administrator tool 6 in the

Administrator computer system 4 a. The administrator tool 6 may be any form of man-machine interface.

The access information is about

Communication interfaces 5 are transmitted to the access control unit 2 and compared within the access control unit 2 with pre-stored access information, so that a positive authentication of a user of

Administrator computer system 6 is allowed when the

entered access information in the

Access control unit 2 stored access information match. Otherwise, the denied

Access Control Unit 2 any access to components of the backup computer system 1 by the administrator computer system. 4

Optionally, the access control unit 2 may also

Send information or commands to the administrator tool 6 in the administrator computer system 4 (see bidirectional connection between the backup computer system 1 and the

Administrator computer system 4). For example, in the case of an unsuccessful authentication of a user, a Error message or warning to the administrator computer system 4 are issued.

For communication with the administrator computer system 4, the access control unit 2 and / or the administrator tool 6 can, for example, provide a graphical user interface, via which a user of the administrator computer system 4 can make inputs or queries. After successful authentication of the administrator computer system 4 to the access control unit 2 can by a user of the administrator computer system 4 (ie by a system administrator or administrator) a command to

Instruct a recovery process to be given Recover. In FIG. 1, a command for instructing a recovery process Recover_ABC is used by way of example

Restore backup data D_A, D_B, D_C from the

Backup memory 31 given to the individual source computer systems A, B, C. To do this, the Recover_ABC command is sent to the

Access control unit 2 in the backup computer system 1

in case of positive authentication in the access control unit 2, a recovery process

is triggered. This recovery process causes the access control unit 2 to access the backup storage 31 in the backup computer system 1, with backup data D_A, D_B, D_C being transferred from the backup storage 31 to the access control unit 2. The backup data D_A, D_B, D_C may for example be present in encrypted form in the backup memory 31 and within the access control unit 2 for further

Processing be decrypted. An access to the decrypted backup data D_A, D_B, D_C is prohibited by the access control unit 2.

Subsequently, the backup data D_A, D_B, D_C over

Transmit interfaces 5 to the individual source computer systems A, B, C in the computer network infrastructure. This is done advantageously after re-encryption within the

Access Controller 2. Specifically, the data D_A is transmitted to the source computer system A, the data D_B to the source computer system B, and the data D_C to the source computer system C. That is, each source computer system receives the backup data predetermined for that system. The individual source computer systems A, B, C are advantageously also encapsulated systems (see each lock icon). It is conceivable that the systems A, B, C next to the system 1 or alternatively only in addition to the

Access control unit 2 subsystems of a protected

Form overall system or form self-contained encapsulated systems. Thus, unauthorized users are prohibited from accessing data D_A, D_B, D_C (especially in unencrypted

Form) in the respective systems A, B, C. Only write access to the systems A, B, C may be allowed to enable recovery of backup data D_A, D_B, D_C on the systems A, B, C.

The backup data D_A, D_B, D_C can be stored

Information (eg IP or MAC address, path information, I-Nodes, etc.) about which destination the data should be sent to. This information can be interpreted in the access memory unit 2, the backup data D_A, D_B, D_C then being distributed accordingly. As an alternative to the configuration shown in FIG. 1, it is also conceivable to provide an additional control component in the backup computer system 1 in order to write back the data from the backup memory 31 to the individual source computer systems A, B, C. Such an additional component has the advantage that the backup data D_A, D_B, D_C are not transferred to the access control unit 2 itself but to the additional component. As a result, it is possible to prevent a user of the administrator computer system 4 from gaining direct access to the backup data D_A, D_B, D_C through manipulations on the access control unit 2.

In the respective source computer systems A, B, C, the respectively restored data D_A, D_B, D_C in

corresponding memory 3A, 3B, 3C are stored. In this way it is possible, for example, system, configuration ^¬ or user data from the backup computer system 1 in the original source computer systems A, B, C

write back. It is conceivable that the memories 3A, 3B, 3C are arranged outside of the systems A, B, C as an alternative to the configuration shown in FIG. In this case, data D_A, D_B, D_C are present in the memories 3A, 3B, 3C only in encrypted form (i.e., protected from unauthorized access to confidential information). An appropriate encryption can by the

Access control unit 2 or by components within the systems A, B, C done.

It is advantageous if the recovery process restricts writeback of the respective data exclusively to the original source computer system. This means that, for example, the backup data D_A can only be written back to the source computer system A. A correspondingly different instruction can

for example, be aborted by the access control unit 2 or prohibited altogether. This way will

Prevents confidential data, which should only be accessible to users of a particular source computer system, from being transferred to another source computer system.

Decisive in the configuration according to FIG. 1 is that a user of the administrator computer system 4

can only instruct a Recover_ABC recovery process if it succeeds in the

Access controller 2 has authenticated. However, access to the backup data D_A, D_B, D_C is prohibited for the administrator computer system 4. In addition, there is none

Possibility to access the source computer systems A, B, C via the administrator computer system 4.

In this way, there is a system administrator or

Administrator only the ability to send a command to the backup computer system 1, if necessary, then runs an automated routine to backup data D_A, D_B, D_C from the backup computer system 1 to the original source computer systems A, B, C

write back.

Access to backup data D_A, D_B, D_C in the backup memory 31 of the backup computer system 1 is, according to the configuration in FIG. 1, not permitted to any of the computer systems A, B, C and 4. However, the individual source computer systems A, B, C receive corresponding backup data D_A, D_B, D_C when the

Recovery process Recover_ABC was triggered. A changed situation is shown in FIG. Here, the individual components of the computer network infrastructure are essentially the same as in FIG. 1 (of course, the alternative configurations mentioned in connection with FIG. 1 are also possible), but with the

Difference that now also exemplifies the source computer system B has a possibility to the

Access control unit 2 of the backup computer system 1

to access.

For this purpose, the source computer system B comprises a

Access control unit 2B, which with the

Access control unit 2 in the backup computer system 1

communicate and interact. In this way, it is possible for a user of the source computer system B to authenticate himself via the access control unit 2B of the source computer system B to the access control unit 2 of the backup computer system 1. A corresponding process can proceed as already explained in connection with FIG. at

successful authentication of a user of the source computer system B on the backup computer system 1

For example, a command Recover_B for targeted

Restore backup data D_B be instructed.

This is transmitted to the access control unit 2, analogous to the procedure of Figure 1 a

Recovery process in the access control unit 2 is triggered. The recovery process causes a backup data D_B to be loaded from the backup memory 31. The backup data D_B may then be transferred from the access control unit 2 to the source computer system B via the communication interfaces 5, and therein

For example, stored in the memory 3B, as shown in Figure 2. A user of system B may be an end user with full access to system B and also to data D_B in system B. However, it is also conceivable that the user is an administrator, for example, who indeed has access to the system B, in particular to

limited functionality of the access control unit B for a recovery process Recover_B, but the access to data D_B is prohibited.

It is also conceivable that an end user of the source computer system B at the same time has direct access to the backup data D_B in the backup memory 31 of the backup computer system 1. This can be done, for example, by setting up access rights to the backup data D_B in accordance with the access rights in the source computer system B. This alternative may have the advantage for a user of the source computer system B, his backup data D_B directly in the backup computer system 1 to

edit, view, select, etc.

However, access to the backup memory 31 in the backup computer system 1 depends on the security level and configuration of the encapsulated backup computer system 1. Of course, the highest security level is given if such access to the backup memory 31 is prohibited or simply not possible. Then, a user of the source computer system B can use only one

Recovery process Recover_B in the

Access control unit 2 so that the corresponding backup data D_B to the source computer system B

be written back. Analogous to the procedure according to FIG. 1, parallel to

explained an administrator of the administrator computer system 4 another command Recover_A for

Restore backup data D_A instruct from the backup memory 31 of the backup computer system 1 to the source computer system A. This procedure is analogous to the procedure already described according to FIG. An appropriate one

Recovery Process Recover_A causes a loading of the backup data D_A and a transfer of this data to the source computer system A, wherein the data D_A can be stored in the memory 3A, for example. Also with this

Configuration according to Figure 2 is crucial that the

User group of the administrator computer system 4 has no access to the backup data D_A, D_B, D_C in the backup memory 31 of the backup computer system 1 has.

The source computer system C has no direct involvement in the situation according to FIG. Also in the embodiment according to FIG. 2, it is possible to provide a further component in addition to the access control unit 2, via the backup data D_A, D_B, D_C from the backup memory 31 for a

Recovery will be loaded.

A communication with the access control unit 2 in all the illustrated embodiments, for example via a graphical user interface, for example

browser based, done. This has the advantage that a user who wants to instruct a recovery process to Recover, for example, certain folders (not their content) can be displayed to data for the

Restore process without being able to view this data. Also the authentication and

if necessary, additional setting options on the Access control unit 2 can be conveniently carried out via a graphical user interface.

The access control unit 2 can be used, for example, as

Computer program running in one

Computing component of the backup computer system 1 expires.

The same can arise for the access control unit 2B of the source computer system B and for the administrator tool 6 of the administrator computer system 4.

Furthermore, any transmission of backup data D_A, D_B, D_C in all embodiments can be carried out encrypted in order to provide access protection against unauthorized access to the backup data D_A, D_B, D_C also outside of the backup computer system 1 or outside of the systems A, B, C increase. The expert can use all conceivable crypto techniques or encryption algorithms.

The illustrated embodiments are merely

chosen by example, with various alternative

Embodiments are conceivable, which are also covered by the method according to the invention, computer program product and computer system.

Reference sign list

1 backup computer system

2 access control unit

2B access control unit in the source computer system

31 backup storage

3A, 3B, 3C memory in the source computer system

4 administrator computer system

5 communication interfaces

6 administrator tool

A, B, C source computer system

D_A, D_B, D_C Backup data of the source computer systems

Recover command to instruct a

Recovery process

Claims

claims

A method for the secure recovery of data (D_A, D_B, D_C) stored in a backup computer system (1) on a source computer system (A, B, C), wherein an access control (2, 2B, 6 ) which requests access information of a user group to access a recovery process (Recover) but prohibits access of the user group to the data (D_A, D_B, D_C),

wherein the recovery process (Recover) can be instructed by a user of the user group, when the requested access information deposited with

Access information of the user group match, and the instructed recovery process (Recover)

Writing back selected data (D_A, D_B, D_C) from the backup computer system (1) to the source computer system (A, B, C).

2. The method of claim 1, wherein the

Recovery process (Recover) restricts write-back of the data (D_A, D_B, D_C) to a predetermined source computer system (A, B, C).

3. The method of claim 1 or 2, wherein the data (D_A, D_B, D_C) when writing back from the backup computer system (1) in the source computer system (A, B, C) automatically to a predetermined memory address in the source computer system ( A, B, C) are written.

4. The method according to any one of claims 1 to 3, wherein the access control (2, 2B, 6) an access of the user group to data (D_A, D_B, D_C) in the source computer system (A, B, C).

5. Method according to one of claims 1 to 4, wherein the access controller (2, 2B, 6) additionally requests access information of at least one further user group for accessing the recovery process (Recover) and accesses the at least one further user group to selected data (D_A, D_B, D_C) in the backup computer system (1), wherein the recovery process (recovering) by a user of the at least one further user group

can be instructed if the queried

Access information with stored access information of the at least one other user group match.

6. The method according to claim 5, wherein the access controller (2, 2B, 6) allows access of the further user group to data (D_A, D_B, D_C) in the source computer system (A, B, C).

7. The method according to any one of claims 1 to 6, wherein the data (D_A, D_B, D_C) by the access control (2, 2B, 6) are encrypted.

8. The method according to any one of claims 1 to 7, wherein the access control (2, 2B, 6) allows a deletion or renaming, but not opening files in which the data (D_A, D_B, D_C) in the backup computer system (1 ) are summarized.

9. The method according to any one of claims 1 to 8, wherein the requested access information at least one

Include username and password.

10. The method of claim 1, wherein the access controller comprises at least one software agent.

11. The method of claim 10, wherein the access controller (2, 2B, 6) for retrieving the access information and / or instructing the recovery process (Recover) and / or to select the data (D_A, D_B, D_C) for the

Recovery process (Recover) a graphical

User interface.

12. Computer program product containing a

Computer program which, when running on a computer system (1, 4, A, B, C) performs a method according to one of claims 1 to 11.

13. Computer system (1, 4, A, B, C), which a

Access control unit (2, 2B, 6) for controlling access to a recovery process (Recover) for

Restoring data (D_A, D_B, D_C) in the computer system (1, 4, A, B, C) or in another computer system (1, 4, A, B, C), wherein the access control unit (2, 2B, 6 ) is adapted to perform a method according to any one of claims 1 to 11.