Archive data vaulting using Cohesity Alta Recovery Vault for Sheltered Harbor
In this process, the selected data is stored on the cloud using immutable storage and the original files are available on the source. To start the data vaulting operation, the backup policy needs to be configured on the NetBackup primary server. When you start the data vaulting operation, the NetBackup client software on your computer sends the data to be backed up to the NetBackup media server. The media server then deduplicates and writes the data to a supported immutable cloud object storage. After the data backup is successful, the Sheltered Harbor solution sends an attestation message to Sheltered Harbor monitoring log.
The Sheltered Harbor solution on the NetBackup client initiates the backup of encrypted data. The following diagram depicts the process of data backup to Cohesity Alta Recovery Vault:
The process flow is as follows:
- Input storage: The input storage includes manifest, account data files, and corresponding hash files that originated from the institution. At this stage, the input data is extracted using the Sheltered Harbor solution and is processed further for input data validation. Here, it generates an archive volume and encrypts it using the data encryption key. It also generates the secure envelope that stores the cryptographic material of encryption.
- External or cloud provider KMS: The NetBackup Sheltered Harbor solution encrypts the input storage data using data encryption key (DEK) and this DEK is further encrypted with the help of a configured external KMS or cloud-provider based KMS. It ensures that the encryption or decryption keys do not leave the KMS boundaries. If cloud KMS is not configured, you can use on-premises KMS.
- Transfer storage: The input data files are compressed and encrypted to generate encrypted archive volumes and are stored in the transfer storage.
- Immutable cloud storage: NetBackup deduplicates and stores the encrypted volume and secure envelope to a supported immutable cloud object storage such as Cohesity Alta Recovery Vault during the backup process. A unique keyword is generated and is used during backup. This keyword identifies the backup image during restore and it can be seen using --report command option. For example, 'SH-<random number>' keyword is generated during backup that is further used on the BAR UI to see the backup files.
Note:
The Sheltered Harbor solution supports either CohesityAlta Recovery Vault or an Isolated Recovery Environment (IRE) to be configured for the data vaulting operations. Other NetBackup storage unit types are not supported.
- Sheltered Harbor monitoring log: The Sheltered Harbor monitoring log shows the attestation message as a proof of a successful completion of the daily data vaulting process.