Abstract: The present invention backs up a sensitive field in a data object in a storage system using an external backup system without enabling the external backup system to view the data in the sensitive field. The system sets up the sensitive field for backup by adding an encrypted field to a data object that includes the sensitive field, configuring access to the sensitive field and the encrypted field, creating an encrypted copy of the data in the sensitive field with an encryption key controlled by the data owner, and storing the encrypted copy in the encrypted field. The system backs up the sensitive field without enabling the external backup system to view the data in the sensitive field by sending the encrypted copy in the encrypted field to the external backup system, where the external backup system has no access to the encryption key controlled by the data owner.

Abstract: The present disclosure describes a system, method, and computer program for transmitting data between a backup system and an external application using an encryption proxy that is within a customer-controlled data perimeter. The encryption proxy virtually resides within a customer-controlled data perimeter and acts as an intermediary between the external application and backup system. The backup system is outside the customer-controlled data perimeter. Data is transferred between the external application and the backup system to perform backup and recovery operations. The encryption proxy encrypts and decrypts data messages between the external application and the backup application in accordance with configurable data transfer rules. The encryption proxy enables a customer to control which data items are transferred to the backup system in clear text and which data items are encrypted before being forwarded to the backup system.