Single datacenter with client side encryption
This single datacenter with client side encryption example uses the client side encryption to ensure data confidentiality across the wire as well as on tape. The client side encryption mitigates the risk of passive wire tapping within the organization. The risk of data exposure is reduced as tapes are moved off site. This datacenter model assures a medium to large number (greater than 50) of managed hosts. Clients inside the datacenter as well as the DMZ can use centralized naming services for hosts and user identities.
The single datacenter with client side encryption includes the following highlights:
Useful for protecting off-site data
Data from client is encrypted and eliminates passive interception of the data on the wire
Key management is de-centralized on to the clients
The original NetBackup encryption option
Client CPU is used to perform encryption
Must have the key to get data back. A lost key means lost data.
Useful when you need to scan tapes off-site and/or you need confidentiality on the wire
Figure: Single datacenter with client side encryption shows an example single datacenter with client side encryption.
The following table describes the NetBackup parts that are used for a single datacenter with client side encryption.
Table: NetBackup parts for a single datacenter with client side encryption
Part | Description |
|---|---|
Demilitarized Zone (DMZ) |
Provides a "safe" area of operation for Web server client 5 and encrypted client 6. These clients exist between the internal firewall and external firewall. The Web server client 5 and encrypted client 6 in the DMZ can communicate to NetBackup through the internal firewall using designated NetBackup ports. The Web server client 5 and encrypted client 6 can communicate through the external firewall to the Internet using HTTP ports. The encrypted client 6 in the DMZ can communicate to NetBackup through the internal firewall using designated NetBackup ports. |
External firewall |
Allows external users to access the Web server client 5 and encrypted client 6. These clients can be accessed in the DMZ from the Internet over HTTP ports. NetBackup ports are open for Web server client 5 and encrypted client 6 to communicate through the internal firewall. However, NetBackup ports are not allowed to pass through the external firewall to the Internet. Only the HTTP ports of Web server client 5 and encrypted client 6 can pass through the external firewall to the Internet. The external firewall limits client 5 and 6 from bidirectional communication over the Internet. |
Internet |
Specifies a collection of interconnected computer networks that are linked by copper wires, fiber-optic cables, and wireless connections. The Web server client 5 can communicate over the Internet using HTTP ports through the external firewall. |