# US 12,771,686 B2 · Permissions for backup-related operations > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,771,686 B2 - Document ID: US12771686B2 - Status: Granted - Kind: B2 - Application number: 18/795,555 - Filed: 2024-08-06 - Published: 2024-11-28 - Granted: 2026-10-20 - Earliest claimed: 2020-11-11 - Assignees: Hewlett Packard Enterprise Development LP - Applicants: Hewlett Packard Enterprise Development LP - Inventors: Syama Sundararao Nadiminti; Annmary Justine Koomthanam; Keshetti Mahesh - Web page: https://patentgrep.com/patent/US12771686B2 ## CPC - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - G06F 11/1461: {Backup scheduling policy} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 11/1448: {Management of the data involved in backup or backup restore} - G06F 11/1458: {Management of the backup or restore process} - G06F 11/1464: {for networked environments} - G06F 11/3438: {monitoring of user actions (tracking the activity of the user H04L67/535)} - G06F 21/33: using certificates - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/554: {involving event detection and direct action} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 2201/805: Real-time - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04W 12/65: Environment-dependent, e.g. using captured environmental data - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Example techniques for granting permissions for performing an operation related to a backup copy are described. The backup copy corresponds to first device data and the first device data is stored in a first device. In an example, in response to receiving a request to perform the operation related to the backup copy, telemetry data received from the first device is analyzed. Based on the analysis, it is determined that security of the first device is uncompromised. Based on the determination, a permission to perform the operation related to the backup copy is granted. ## Claims ### Claim 1 A system comprising: a processor; and a non-transitory storage medium comprising instructions executable on the processor to: receive, at the system from a first device over a network, a permission request to permit an operation related to a backup copy, the backup copy corresponding to first device data that is stored in the first device, and the backup copy to be stored in a second device that is separate from the first device; analyze, in response to the permission request, telemetry data received from the first device within a first time period relative to a time of receipt of the permission request, wherein the telemetry data comprises one or more of a number of login attempts, a number of file encryptions, a number of file modifications, a number of file deletions, workload information of hardware components of the first device, a backup policy, a read count of the first device data, or a write count of the first device data; determine whether security of the first device is compromised based on the analysis; based on a determination that the security of the first device is uncompromised, permit the operation related to the backup copy by sending a token from the system to the first device over the network; receive, at the system from the second device, the token that was sent from the first device to the second device as part of a performance request from the first device to perform the operation related to the backup copy, wherein the token from the second device is sent from the second device to the system based on a determination at the second device that the performance request from the first device is consistent with the token; validate, at the system, the token received from the second device; and based on validating the token, send, from the system, a response indicating that the token is authentic to permit performance by the second device of the operation related to the backup copy. ### Claim 2 (depends on 1) The system of claim 1, wherein, to analyze the telemetry data received from the first device, the instructions are executable on the processor to compare an actual parameter value that is part of the telemetry data with an expected parameter value corresponding to an uncompromised security state of the first device. ### Claim 3 (depends on 1) The system of claim 1, wherein the instructions are executable on the processor to: identify the time of receipt of the permission request; determine the first time period that is before or after the time of receipt of the permission request; and as part of the analysis, compare the telemetry data received from the first device within the first time period with a remainder of the telemetry data received from the first device. ### Claim 4 (depends on 1) The system of claim 1, wherein the operation related to the backup copy is a backup creation operation, a backup modification operation, or a backup delete operation. ### Claim 5 (depends on 1) The system of claim 1, wherein the token specifies the operation related to the backup copy that is permitted. ### Claim 6 (depends on 5) The system of claim 5, wherein the token is received from the second device based on a determination at the second device that the operation specified by the performance request is consistent with the operation related to the backup copy specified by the token. ### Claim 7 A method comprising: receiving, by a system comprising a hardware processor, a permission request from a first device over a network for permission to perform an operation related to a backup copy, the backup copy corresponding to first device data that is stored in the first device, and the backup copy to be stored in a second device that is separate from the first device; analyzing, by the system in response to the permission request, telemetry data received from the first device within a first time period relative to a time of receipt of the permission request, wherein the telemetry data comprises one or more of a number of login attempts, a number of file encryptions, a number of file modifications, a number of file deletions, workload information of hardware components of the first device, a backup policy, a read count of the first device data, or a write count of the first device data; determining, by the system, whether security of the first device is compromised based on the analysis; based on a determination that the security of the first device is uncompromised, permitting the operation related to the backup copy by sending a token from the system to the first device over the network; receiving, at the system from the second device, the token that was sent from the first device to the second device as part of a performance request from the first device to perform the operation related to the backup copy, wherein the token from the second device is sent from the second device to the system based on a determination at the second device that the performance request from the first device is consistent with the token; validating, by the system, the token received from the second device; and based on validating the token, sending, from the system, a response to the second device indicating that the token is authentic to permit performance by the second device of the operation related to the backup copy. ### Claim 8 (depends on 7) The method of claim 7, wherein the telemetry data comprises telemetry data received in the first time period before receiving the permission request, and telemetry data received in a second time period after receiving the permission request. ### Claim 9 (depends on 7) The method of claim 7, comprising: based on the determination that the security of the first device is uncompromised, attempting, by the system, to establish a secure handshake with the first device, wherein the permitting of the operation related to the backup copy by the system is further based on an establishment of the secure handshake. ### Claim 10 (depends on 9) The method of claim 9, wherein the attempting to establish the secure handshake comprises transmitting a message encrypted with a secret key that is known to the first device, the method comprising: determining that the secure handshake is established in response to receiving, from the first device, a response for the message. ### Claim 11 (depends on 7) The method of claim 7, wherein the token specifies the operation related to the backup copy that is permitted. ### Claim 12 (depends on 11) The method of claim 11, wherein the token is received from the second device based on a determination at the second device that the operation specified by the performance request is consistent with the operation related to the backup copy specified by the token. ### Claim 13 (depends on 7) The method of claim 7, wherein the first device data pertains to a virtual machine (VM) hosted in the first device, and the backup copy comprises an image from which the VM can be restored. ### Claim 14 A non-transitory computer-readable medium comprising instructions, the instructions being executable by a system to: receive, at the system from a first device over a network, a permission request to permit an operation related to a backup copy, the backup copy corresponding to first device data that is stored in the first device, and the backup copy to be stored in a second device that is separate from the first device; analyze, in response to the permission request, telemetry data received from the first device within a first time period relative to a time of receipt of the permission request, wherein the telemetry data comprises one or more of a number of login attempts, a number of file encryptions, a number of file modifications, a number of file deletions workload information of hardware components of the first device, a backup policy, a read count of the first device data, or a write count of the first device data; determine whether security of the first device is compromised based on the analysis; based on a determination that the security of the first device is uncompromised, permit the operation related to the backup copy by sending a token from the system to the first device; receive, at the system from the second device, the token that was sent from the first device to the second device as part of a performance request from the first device to perform the operation related to the backup copy, wherein the token from the second device is sent from the second device to the system based on a determination at the second device that the operation specified by the performance request is consistent with the token; validate, at the system, the token received from the second device; and based on validating the token, send, from the system, a response indicating that the token is authentic to permit performance by the second device of the operation related to the backup copy. ### Claim 15 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein the response sent from the system comprises a message sent from the system to the second device.