Abstract:
The present invention provides systems and methods for performing storage operations through a firewall. Methods are provided that include, in a networked computer system, identifying, based on configuration data, whether each of a set of network elements is within a trusted network or not within the trusted network. Traffic between elements within the trusted network and elements not within the trusted network must pass through a firewall. The methods also include, prior to performing a storage operation through the firewall, allocating a specific set of ports, in accordance with at least one security parameter, for use in performing the storage operation. Methods are also provided which include monitoring traffic through the specific ports, and, if traffic is determined to be inactive through a first port of the specific ports, sending a packet through the first port.

Description:
RELATED APPLICATIONS  
       [0001]     This application claims priority to Provisional Application No. 60/460,183, filed Apr. 3, 2003, the entirety of which is hereby incorporated by reference.  
         [0002]     This application is also related to the following patents and pending applications, each of which is hereby incorporated herein by reference in its entirety: 
        U.S. Pat. No. 6,418,478, titled PIPELINED HIGH SPEED DATA TRANSFER MECHANISM, issued Jul. 9, 2002, attorney docket number 4982/6;     application Ser. No. 09/610,738, titled MODULAR BACKUP AND RETRIEVAL SYSTEM USED IN CONJUNCTION WITH A STORAGE AREA NETWORK, filed Jul. 6, 2000, attorney docket number 4982/8;     application Ser. No. 09/744,268, titled LOGICAL VIEW AND ACCESS TO PHYSICAL STORAGE IN MODULAR DATA AND STORAGE MANAGEMENT SYSTEM, filed Jan. 30, 2001, attorney docket number 4982/10;     Application Ser. No. 60/409,183, titled DYNAMIC STORAGE DEVICE POOLING IN A COMPUTER SYSTEM, filed Sep. 9, 2002, attorney docket number 4982/18PROV; and     Application Ser. No. 60/460,234, titled SYSTEM AND METHOD FOR PERFORMING STORAGE OPERATIONS IN A STORAGE NETWORK, filed Apr. 4, 2003, attorney docket number 4982/35P.       
 
     
    
     COPYRIGHT NOTICE  
       [0008]     A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosures, as it appears in the Patent and Trademark Office patent files or records, but otherwise reserves all copyright rights whatsoever.  
       BACKGROUND OF THE INVENTION  
       [0009]     The invention disclosed herein relates generally to performing storage operations through a firewall. More particularly, the present invention relates to providing a limited number of ports in a firewall for performing secure storage operations between components in a computer network.  
         [0010]     Firewalls reside between components in a computer network and generally function to prevent unauthorized access to the network by evaluating which communications should be allowed to pass between the firewall&#39;s network and other networks or network components. A firewall thus divides a network into two parts: a friendly/secure side and a hostile side, wherein computers inside the firewall on the friendly side are protected from computers outside the firewall on the hostile side.  
         [0011]     A firewall evaluates whether network traffic such as data streams, control messages, application data, communications packets, and other data meets specified security criteria and should be allowed to pass between components of the network. Data that does not meet the security criteria is generally discarded or otherwise blocked from passing between components. A firewall may comprise hardware elements, software components, or any combination thereof. Exemplary firewalls include packet filters, bastion hosts, application or circuit-level gateways, and proxy servers.  
         [0012]     One method used by firewalls to prevent unauthorized communications is to restrict network communications to specified ports. A port is generally used by TCP/IP. UDP, and other communication protocols to represent the logical endpoint of a particular connection. For example, HTTP traffic associated with a particular computer might be routed through port 80. Various programs, services, and other applications on a computer often run listening processes for network traffic directed to a particular port. Limiting network communications to specific ports and closing all unused ports generally reduces the risk of unauthorized access to a computer since these programs, services, and other applications could be compromised or otherwise exploited by a hacker to gain access to the computer.  
         [0013]     Firewalls provide additional security by timing out network sessions beyond a specified time period. Thus, ports do not remain unnecessarily open in the event of network connection failures, slowdowns, or other events which might create vulnerabilities. For example, any network sessions that become idle beyond a preconfigured timeout period are automatically disconnected without warning. Further, after making a new connection, a first packet must be sent within a timeout period or the connection is also disconnected.  
         [0014]     Existing storage management systems, however, use many thousands of ports to conduct storage operations through a firewall. Typically, these systems keep large sets of known ports open during backups and restores. Each of the streams of data sent as part of a backup, a restore, or other storage operation must have a port open in the firewall to pass the data. For example, data pieces come through multiple streams, control signals come through other streams, status messages come yet other streams, etc. The head end (sender) and tail end (receiver) of existing systems, however, do not know which ports all of the data is coming through, so they generally reserve large blocks of ports in the firewall to accommodate the various streams of data that they anticipate. Furthermore, these systems also must keep many ports open since slow network connections and other factors may cause a connection to timeout and the firewall to close an intended port thus requiring data to be resent to another port. Opening thousands of ports in this manner, however, renders a firewall more like a switch than a firewall and severely compromises network security.  
         [0015]     There is thus a need for systems and methods which reduce the number of open ports required in a firewall to perform storage operations in a computer network.  
       SUMMARY OF THE INVENTION  
       [0016]     In some embodiments, the present invention provides systems and methods for performing storage operations through a firewall.  
         [0017]     In one embodiment, the invention provides a method for performing storage operations through a firewall in a networked computer system, including identifying, based on configuration data, whether each of a set of network elements is within a trusted network or not within the trusted network. Traffic between elements within the trusted network and elements not within the trusted network must pass through the firewall. The method further includes, prior to performing a storage operation through the firewall, allocating a specific set of ports, in accordance with at least one security parameter, for use in performing the storage operation.  
         [0018]     In another embodiment, the invention provides a method for performing storage operations through a firewall in a networked computer system, including identifying, based on configuration data, a first set of network elements which are within a trusted network and a second set of network elements which are not within the trusted network. Traffic between elements within the trusted network and elements not within the trusted network must pass through the firewall. The invention further includes, prior to performing a storage operation through the firewall, allocating a specific set of ports, according to at least one security parameter, for use in performing the storage operation. The method further includes, during the storage operation, monitoring traffic through each of the specific ports. The method further includes, if, through the monitoring, traffic is determined to be inactive through a first port of the specific ports for a specified time period, sending a packet through the first port.  
         [0019]     In another embodiment, the invention provides a system for performing storage operations through a firewall in a networked computer system. The system includes a firewall and a plurality of network elements, including one or more client computers and one or more storage devices. The system further includes a storage manager. The system further includes one or more media agents which conduct data between the one or more client computers and the one or more storage devices under the direction of the storage manager. The storage manager identifies, based on configuration data, a first set of network elements which are within a trusted network and a second set of network elements which are not within the trusted network. Traffic between elements of the trusted network and elements not within the trusted network must pass through the firewall. Further, the storage manager, prior to performing a storage operation through the firewall, allocates a specific set of ports, according to at least one security parameter, for use in performing the storage operation. During a storage operation, the firewall opens ports in accordance with the allocation.  
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0020]     The invention is illustrated in the figures of the accompanying drawings which are meant to be exemplary and not limiting, in which like references are intended to refer to like or corresponding parts, and in which:  
         [0021]      FIG. 1  is a block diagram of a network architecture for a system to perform storage operations through a firewall according to an embodiment of the invention; and  
         [0022]      FIG. 2  is a flow diagram of a method of performing storage operations through a firewall according to an embodiment of the invention. 
     
    
     DETAILED DESCRIPTION  
       [0023]     With reference to  FIG. 1  embodiments of the invention are presented.  FIG. 1  presents a block diagram of a network architecture for a system to perform storage operations on electronic data in a computer network according to an embodiment of the invention. As shown, the system includes a storage manager  115  and one or more of the following: a data agent  100 , a client  105 , an information store  110 , an index cache  120 , a firewall  125 , a media agent  130 , and a storage device  135 . The system and elements thereof are exemplary of a three-tier backup system such as the CommVault Galaxy backup system, available from CommVault Systems, Inc. of Oceanport, N.J., and further described in application Ser. No. 09/610,738 which is incorporated herein by reference in its entirety.  
         [0024]     A data agent  100  is generally a software module that is generally responsible for archiving, migrating, and recovering data of a client computer  105  stored in an information store  110  or other memory location. Each client computer  105  has at least one data agent  100  and the system can support many client computers  107 . The system provides a plurality of data agents  100  each of which is intended to backup, migrate, and recover data associated with a different application. For example, different individual data agents  100  may be designed to handle Microsoft Exchange data, Lotus Notes data, Microsoft Windows 2000 file system data, Microsoft Active Directory Objects data, and other types of data known in the art.  
         [0025]     If a client computer  105  has two or more types of data, one data agent  100  is generally required for each data type to archive, migrate, and restore the client computer  105  data. For example, to backup, migrate, and restore all of the data on a Microsoft Exchange 2000 server, the client computer  105  would use one Microsoft Exchange 2000 Mailbox data agent  100  to backup the Exchange 2000 mailboxes, one Microsoft Exchange 2000 Database data agent  100  to backup the Exchange 2000 databases, one Microsoft Exchange 2000 Public Folder data agent  100  to backup the Exchange 2000 Public Folders, and one Microsoft Windows 2000 File System data agent  100  to backup the client computer&#39;s  105  file system. These data agents  100  would be treated as four separate data agents  100  by the system even though they reside on the same client computer  105 .  
         [0026]     The storage manager  115  is generally a software module or application that coordinates and controls the system. The storage manager  115  communicates with all elements of the system including data agents  100 , client computers  105 , firewalls  125 , media agents  130 , and storage devices  135 , to initiate and manage system backups, migrations, and recoveries, as well as perform other storage-related operations.  
         [0027]     A media agent  130  is generally a media management software module that conducts data, as directed by the storage manager  115 , between the client computer  105  and one or more storage devices  135  such as a tape library, a magnetic media storage device, an optical media storage device, or other storage device. The media agent  130  is communicatively coupled with and controls the storage device  135 . For example, the media agent  130  might instruct the storage device  135  to use a robotic arm or other means to load or eject a media cartridge, and to archive, migrate, or restore application specific data. The media agent  130  generally communicates with the storage device  135  via a local bus such as a SCSI adaptor. In some embodiments, the storage device  135  is communicatively coupled to the data agent  130  via a Storage Area Network (“SAN”).  
         [0028]     Each media agent  130  maintain an index cache  120  which generally stores index data the system generates during backup, migration, and restore storage operations as further described herein. For example, storage operations for Microsoft Exchange data generate index data such as file names, file locations, media identifiers, and other information. Index data provides the system with an efficient mechanism for locating user files for recovery operations. This index data is generally stored with the data backed up to the storage device  135 , and the media agent  130  that controls the storage operation also writes an additional copy of the index data to its index cache  120 . The data in the media agent  130  index cache  120  is thus readily available to the system for use in storage operations and other activities without having to be first retrieved from the storage device  135 .  
         [0029]     The storage manager  115  also maintains an index cache  120 . Index data is also used to indicate logical associations between components of the system, user preferences, management tasks, network pathways, data associations, storage policies, user preferences, and other useful data. For example, the storage manager  115  might use its index cache  120  to track logical associations between media agents  130  and storage devices  135 .  
         [0030]     Index caches  120  typically reside on their corresponding storage component&#39;s hard disk or other fixed storage device. Like any cache, the index cache  120  has finite capacity and the amount of index data that can be maintained directly corresponds to the size of that portion of the disk that is allocated to the index cache  120 . In one embodiment, the system manages the index cache  120  on a least recently used (“LRU”) basis as known in the art. When the capacity of the index cache  120  is reached, the system overwrites those files in the index cache  120  that have been least recently accessed with the new index data. In some embodiments, before data in the index cache  120  is overwritten, the data is copied to an index cache  120  copy in a storage device  135 . If a recovery operation requires data that is no longer stored in the index cache  120 , such as in the case of a cache miss, the system recovers the index data from the index cache  120  copy stored in the storage device  135 .  
         [0031]     As previously discussed, firewalls  125  reside between components of the system and generally function to prevent unauthorized access to the system. Thus, for example, a firewall  125  may reside between a client  105  and the storage manager  125 , between the storage manager  125  and a media agent  130 , or between other system components. For example, a remote client  105  across the Internet or other wide area network may pass traffic associated with storage operations and other operations to the system via a firewall  125 . As another example, the system may perform remote storage operations, such as remote disaster recovery operations or other operations, and pass traffic associated with storage operations from the storage manager  125  across the Internet or other wide area network to a remote media agent  130 . These examples are not intended to be limiting and other useful configurations will be readily apparent to those skilled in the art.  
         [0032]     In some embodiments, components of the system may reside and execute on the same computer. In some embodiments, a client computer  105  component such as a data agent  100 , a media agent  130 , or a storage manager  115  coordinates and directs local archiving, migration, and retrieval application functions as further described in Application Number 09/610,738. This client computer  105  component can function independently or together with other similar client computer  105  components.  
         [0033]     The system increases security of storage operations through a firewall  125  by, among other things, drastically reducing the number of ports required as compared to existing storage management systems. The system negotiates a limited number of ports in advance, so that only certain pre-established ports need be open to storage operation traffic. The system also provides a built-in timeout value which is less than the firewall  125  timeout value to eliminate firewall  125  timeouts requiring further renegotiation to open another port.  
         [0034]     A port configuration file specifying the ports to open for each system computer is stored in the index cache  120  or other memory of each machine. In some embodiments, the storage manager  115  index cache  120  also contains a master list of all open ports for all computers in the system which can be accessed by and distributed to other machines in the system as necessary. For example, a port configuration file may specify that only ports 8600 to ports 8620 should be opened for use by the system. System hardware and software modules will thus only listen to those ports and all other available ports will remain closed unless requested by some other application, service, process, etc.  
         [0035]     The system reserves and also limits the number of ports used by each system component such as the storage manager  115 , data agents  100 , and media agents  130 . In one embodiment, port limitations are based on the minimal number of ports required to conduct storage operations.  
         [0036]     For example, the storage manager  115  is allocated seven ports. Three ports carry control data such as start and stop messages, control checksums, parity blocks, and other control data. Three additional ports serve as reserve ports and may be used to support traffic overflow or additional control signals. The final port is used to conduct traffic associated with a graphical user interface (“GUI”). For example, in some embodiments, users at client computers  105  can remotely access the storage manager  115  control GUI and other GUI interfaces. The final port is used to carry signals associated with remote access to the GUI. As another example, the final port also carries signals associated with a user at the storage manager  115  remotely accessing GUIs at clients  115  and media agents  130 . Media agents  115  and data agents  100  are allocated two ports each: one port sends data upstream from the component to the storage manager  115  and one port receives data sent downstream from the storage manager  115  to the component. In some embodiments, media agents  115  and data agents  100  are allocated two additional ports to communicate upstream and downstream with other media agents  115  or data agents  100 . Additional pairs of ports can be allocated to media agents  115  and data agents  100  to provide increased bandwidth, such as for additional backup streams or restore streams.  
         [0037]     A “hostile computer” configuration file specifying a list of “hostile” computers is also stored in the index cache  120  or other memory of each machine. In some embodiments, the storage manager  115  index cache  120  also contains a master list of all “hostile” computers in the system which can be accessed by and distributed to other machines in the system as necessary. In some embodiments, a “friendly computer” configuration file specifying a list of “friendly computers is used instead of or concurrently with a “hostile computer” configuration file.  
         [0038]     This second configuration file enables, among other thing, the system to determine which computers should pass traffic through the listed firewall  125  ports in the port configuration file and which computers are exempt from passing traffic through the firewall  125 . For example, computers behind the firewall  125  can pass traffic through any ports since they are within the “trusted” network and thus their network traffic does not need to be evaluated by the firewall  125 . Conversely, when one computer is behind the firewall  125  and one computer is not, then traffic between those computers must pass through the firewall  125  via the ports specified in the ports configuration file.  
         [0039]     According to one embodiment of the invention, the “hostile computer” configuration file specifying the list of “hostile” computers lists all computers which are on the other side or “hostile” side of the firewall  125  from the computer on which the second configuration file is stored. Traffic with computers not on the list (e.g.—“friendly” computers) is routed directly, however, traffic with computers on the list (e.g.—“hostile” computers) is routed through the firewall  125 . Thus if the storage manager  115  and a media agent  130  are on the “friendly” side of the firewall  125  and a data agent  100  is on the “hostile” side, the storage manager  125  and the media agent  130  configuration files would each list the data agent  100 , and the data agent  100  configuration file would list both the storage manager  125  and the media agent  130 . Computers identified on the second configuration file list are identified according to a network address, an IP address, a DNS entry, a UNC pathway, or other network identifier known in the art.  
         [0040]     At startup, system components, such as data agents  100 , data agents  130 , and the storage manager  115  access their ports configuration files and the “hostile computer” configuration files. Data is thus routed through ports in the firewall  125  as appropriate and according to security parameters set forth in the configuration files.  
         [0041]     The system also stores a “keep alive” value or key in the index cache  120  or other memory of each machine. The “keep alive” value is generally a value that is less than the connection timeout value specified in the firewall  125  configuration files. The system uses the “keep alive” value, among other things, to prevent the firewall  125  from timing out connections or otherwise closing ports due to network connection failures, slowdowns, or other events which might create vulnerabilities. The system tracks the time period that a connection between a system component, as a data agent  100 , and a firewall  125  has remained idle. If the connection remains idle for a period of time equal or greater than the “keep alive” value, then the system sends a “dummy” packet or other similar packet to the firewall  125  to refresh the connection and restart the timer on the firewall connection timeout value.  
         [0042]     In some embodiments, it may be necessary or desirable that chunk creation time be less than a firewall time-out interval, to prevent firewall time-out from occurring. Therefore, if chunk creation time is greater than the firewall time-out interval, then chunk size may be reduced, such as by the storage manager, as necessary to reduce chunk creation time to less than that of the firewall time-out interval.  
         [0043]      FIG. 2  presents a flow diagram of a method of performing storage operations through a firewall according to an embodiment of the invention. The system accesses configuration data, step  200 . For example, in some embodiments, the system loads a configuration file specifying system components as hostile or trusted. The system checks the status of a component, step  205 . If a system component is trusted, then traffic is permitted without having to pass through the firewall, step  210 . For example, trusted components inside the firewall may not be required to pass traffic through the firewall. If a component is not trusted, the system allocates one or more specified ports to that component according to security preferences, step  215 . The system monitors ports allocated to components, step  220 , and determines whether a time period, for example a firewall timeout setting, has been exceeded, step  225 . In some embodiments, the system monitors to determine whether traffic has passed through an allocated port within the time period. If the time period has not been exceeded, control returns to step  220  and the system continues to monitor traffic. Otherwise, if the time period has been exceeded, the system sends a packet, such as a dummy packet to prevent a port closing, through the port, step  230 , and control returns to step  220 .  
         [0044]     Systems and modules described herein may comprise software, firmware, hardware, or any combination(s) of software, firmware, or hardware suitable for the purposes described herein. Software and other modules may reside on servers, workstations, personal computers, computerized tablets, PDAs, and other devices suitable for the purposes described herein. Software and other modules may be accessible via local memory, via a network, via a browser or other application in an ASP context, or via other means suitable for the purposes described herein. Data structures described herein may comprise computer files, variables, programming arrays, programming structures, or any electronic information storage schemes or methods, or any combinations thereof, suitable for the purposes described herein. User interface elements described herein may comprise elements from graphical user interfaces, command line interfaces, and other interfaces suitable for the purposes described herein. Screenshots presented and described herein can be displayed differently as known in the art to input, access, change, manipulate, modify, alter, and work with information.  
         [0045]     While the invention has been described and illustrated in connection with preferred embodiments, many variations and modifications as will be evident to those skilled in this art may be made without departing from the spirit and scope of the invention, and the invention is thus not to be limited to the precise details of methodology or construction set forth above as such variations and modification are intended to be included within the scope of the invention.