Secure cloud storage distribution and aggregation

• US 10,083,309 B2
• Filed: 11/13/2017
• Issued: 09/25/2018
• Est. Priority Date: 12/02/2013
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Redberg, David A.
• Primary Examiner(s): Lewis, Lisa C
• Application Number:
  US15/810,871
• Publication Number:
  US 20180068125A1
• Time in Patent Office: 316 Days
• CPC Class Codes: G06F 16/148 File search processing
• CPC Class Codes: G06F 16/164 File meta data generation
• CPC Class Codes: G06F 16/182 Distributed file systems
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/0631 Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
• CPC Class Codes: H05K 999/99 dummy group

Abstract

Methods and systems for secure cloud storage are provided. According to one embodiment, file storage policies are maintained for users of an enterprise network by a trusted gateway device interposed between the network and multiple third-party cloud storage services. Responsive to receiving a request to store a local file from a user: (i) searchable encrypted data is created by the gateway corresponding to one or more of (a) content of the local file and (b) metadata associated with the local file and (ii) the searchable encrypted data is distributed by the gateway among the cloud storage services based on a storage diversity requirement defined by the user'"'"'s file storage policy by uploading a subset of the searchable encrypted data to each of the cloud storage services.

Claims

1. A method comprising:

maintaining, by a trusted gateway device logically interposed between an enterprise network and a plurality of third-party cloud storage services, a file storage policy for each user of a plurality of users of the enterprise network, wherein the plurality of file storage policies define access rights, storage diversity requirements and types of encryption to be applied to files stored to the plurality of third-party cloud storage services on behalf of respective users of the plurality of users; and

responsive to receiving, by the trusted gateway device, a request to store a local file from a user of the plurality of users;

creating, by the trusted gateway device, searchable encrypted data corresponding to one or more of (i) content of the local file and (ii) metadata associated with the local file, wherein the searchable encrypted data is based on a type of encryption defined by a file storage policy of the plurality of file storage policies assigned to the user; and

distributing, by the trusted gateway device, the searchable encrypted data among the plurality of third-party cloud storage services based on a storage diversity requirement defined by the file storage policy by uploading a subset of the searchable encrypted data to each of the plurality of third-party cloud storage services.

2. The method of claim 1, further comprising:

partitioning, by the trusted gateway device, the local file into a plurality of chunks of a predefined or configurable size;

causing to be created, by the trusted gateway device, a directory within each of the plurality of third-party cloud storage services, wherein a name attribute of the directory is set based on an encrypted version of a name of the local file;

selecting, by the trusted gateway device, a cryptographic key of a plurality of cryptographic keys maintained by the trusted gateway device based on the file storage policy; and

for each chunk of the plurality of chunks;

identifying, by the trusted gateway device, existence of data within the chunk associated with one or more predefined search indices of a plurality of predefined searchable indices;

generating, by the trusted gateway device, searchable encrypted metadata based on the identified data and the selected cryptographic key;

generating, by the trusted gateway device, an encrypted version of the chunk based on the selected cryptographic key; and

causing to be created, by the trusted gateway device, a remote file within the directory, wherein a name attribute of the remote file includes the searchable encrypted metadata and wherein a contents of the remote file includes the encrypted version of the chunk.

3. The method of claim 2, wherein said creating, by the trusted gateway device, searchable encrypted data is carried out independent of the plurality of third-party cloud storage services.

4. The method of claim 2, further comprising:

receiving, by the trusted gateway device, a query from the user, wherein the query includes a value of a predefined search index of the plurality of predefined searchable indices;

creating, by the trusted gateway device, a corresponding token for the value by encrypting the value based on an appropriate cryptographic key of the plurality of cryptographic keys;

causing, by the trusted gateway device, each of the plurality of third-party cloud storage services to identify one or more remote files containing those of the plurality of chunks satisfying the query by invoking respective filename search functions of the plurality of third-party cloud storage services with the corresponding token; and

retrieving, by the trusted gateway device, the identified one or more remote files from the plurality of third-party cloud storage services on behalf of the user.

5. The method of claim 2, wherein the local file includes one or more records of a database and wherein the predefined or configurable size is based on sizes of the one or more records.

6. The method of claim 2, wherein the file storage policy contains therein information defining the predefined or configurable size and permissible values of each of the plurality of predefined search indices.

7. The method of claim 2, wherein the encrypted version of the name of the local file is created with an Advanced Encryption Standard (AES) encryption algorithm and wherein the plurality of cryptographic keys have key lengths of 512 bits.

8. A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processors of a trusted gateway device logically interposed between a plurality of third-party cloud storage services and an enterprise network, cause the one or more processors to perform a method comprising:

maintaining a file storage policy for each user of a plurality of users of the enterprise network, wherein the plurality of file storage policies define access rights, storage diversity requirements and types of encryption to be applied to files stored to the plurality of third-party cloud storage services on behalf of respective users of the plurality of users; and

responsive to receiving a request to store a local file from a user of the plurality of users;

creating searchable encrypted data corresponding to one or more of (i) content of the local file and (ii) metadata associated with the local file, wherein the searchable encrypted data is based on a type of encryption defined by a file storage policy of the plurality of file storage policies assigned to the user; and

distributing the searchable encrypted data among the plurality of third-party cloud storage services based on a storage diversity requirement defined by the file storage policy by uploading a subset of the searchable encrypted data to each of the plurality of third-party cloud storage services.

9. The non-transitory computer-readable storage medium of claim 8, wherein the method further comprises:

Partitioning the local file into a plurality of chunks of a predefined or configurable size;

causing to be created a directory within each of the plurality of third-party cloud storage services, wherein a name attribute of the directory is set based on an encrypted version of a name of the local file;

selecting a cryptographic key of a plurality of cryptographic keys maintained by the trusted gateway device based on the file storage policy; and

for each chunk of the plurality of chunks;

identifying existence of data within the chunk associated with one or more predefined search indices of a plurality of predefined searchable indices;

generating searchable encrypted metadata based on the identified data and the selected cryptographic key;

generating an encrypted version of the chunk based on the selected cryptographic key; and

causing to be created a remote file within the directory, wherein a name attribute of the remote file includes the searchable encrypted metadata and wherein a contents of the remote file includes the encrypted version of the chunk.

10. The non-transitory computer-readable storage medium of claim 9, wherein said creating searchable encrypted data is carried out independent of the plurality of third-party cloud storage services.

11. The non-transitory computer-readable storage medium of claim 9, wherein the method further comprises:

receiving a query from the user, wherein the query includes a value of a predefined search index of the plurality of predefined searchable indices;

creating a corresponding token for the value by encrypting the value based on an appropriate cryptographic key of the plurality of cryptographic keys;

causing each of the plurality of third-party cloud storage services to identify one or more remote files containing those of the plurality of chunks satisfying the query by invoking respective filename search functions of the plurality of third-party cloud storage services with the corresponding token; and

receiving the identified one or more remote files from the plurality of third-party cloud storage services on behalf of the user.

12. The non-transitory computer-readable storage medium of claim 9, wherein the local file includes one or more records of a database and wherein the predefined or configurable size is based on sizes of the one or more records.

13. The non-transitory computer-readable storage medium of claim 9, wherein the file storage policy contains therein information defining the predefined or configurable size and permissible values of each of the plurality of predefined search indices.

14. The non-transitory computer-readable storage medium of claim 9, wherein the encrypted version of the name of the local file is created with an Advanced Encryption Standard (AES) encryption algorithm and wherein the plurality of cryptographic keys have key lengths of 512 bits.