Systems and methods for obfuscation of data via an aggregation of cloud storage services

• US 10,116,629 B2
• Filed: 05/16/2016
• Issued: 10/30/2018
• Est. Priority Date: 05/16/2016
• Status: Active Grant

• Current Assignee: Carbonite LLC (Open Text Corporation)
• Original Assignee: Carbonite Incorporated (Open Text Corporation)
• Inventors: Crofton, Teo Winton, Raissipour, David
• Primary Examiner(s): Kim, Jung W
• Assistant Examiner(s): De Jesus Lassala, Carlos M
• Application Number:
  US15/156,025
• Publication Number:
  US 20170331796A1
• Time in Patent Office: 897 Days
• CPC Class Codes: G06F 16/10 File systems; File servers
• CPC Class Codes: G06F 16/14 Details of searching files based on file metadata
• CPC Class Codes: G06F 16/1724 Details of de-fragmentation performed by the file system saving storage space on storage systems G06F3/0608; management of blocks in storage devices G06F3/064
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 16/278 Data partitioning, e.g. horizontal or vertical partitioning
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

The present disclosure describes systems and methods for aggregation and management of cloud storage among a plurality of providers via file fragmenting to provide increased reliability and security. In one implementation, fragments or blocks may be distributed among a plurality of cloud storage providers, such that no provider retains a complete copy of a file. Accordingly, even if an individual service is compromised, a malicious actor cannot access the data. In another implementation, file fragmenting may be performed in a non-standard method such that file headers and metadata are divided across separate fragments, obfuscating the original file metadata.

Claims

1. A method for obfuscation of data via an aggregation of cloud storage services, comprising:

identifying, by a synchronization client of a client device, a file for transfer to an aggregation of a plurality of cloud storage services;

extracting, by the synchronization client using a comb filter, a first subset of the file by skipping elements of the file to extract every n^th element;

transmitting, by the synchronization client, the first subset of the file to a first cloud storage service of the plurality of cloud storage services;

extracting, by the synchronization client using the comb filter, a second subset of the file by skipping elements of the file to extract every n^th element, offset by one, wherein in the extracting of the first subset and the extracting of the second subset, n is selected to avoid having a whole number relationship to a width of a memory read bus used by the synchronization client;

transmitting, by the synchronization client, the second subset of the file to a second cloud storage service of the plurality of cloud storage services; and

transmitting, by the synchronization client, metadata of the file and an identification of the first subset, first cloud storage service, second subset, and second cloud storage service, to a third cloud storage service.

2. The method of claim 1, wherein each element comprises a predetermined number of bits.

3. The method of claim 1, further comprising:

subsequently transmitting a request for the file, by the synchronization client to the third cloud storage service, the request comprising the metadata of the file; and

receiving, by the synchronization client from the third cloud storage service, identifications of the first subset, first cloud storage service, second subset, and second cloud storage service.

4. The method of claim 3, further comprising:

retrieving, by the synchronization client, the first subset from the first cloud storage service;

retrieving, by the synchronization client, the second subset to the second cloud storage service;

and generating the file, by the synchronization client, from the first subset and second subset.

5. The method of claim 4, wherein generating the file further comprises multiplexing the first subset and second subset into a single bitstream.

6. The method of claim 4, wherein generating the file further comprises:

loading the first subset and second subset into columns of an array having a predetermined number of columns; and

reading a row of the array.

7. The method of claim 1, wherein the first subset of the file does not include any consecutive bits of the file.

8. The method of claim 1, wherein the first subset of the file does not include any consecutive bytes of the file.

9. A system for obfuscation of data via an aggregation of cloud storage services, comprising:

a client device, in communication with a plurality of cloud storage services, comprising a processor executing a synchronization client, wherein the synchronization client is configured to;

identify a file for transfer to an aggregation of the plurality of a cloud storage services, extract, using a comb filter, a first subset of the file by skipping elements of the file to extract every n^th element, transmit the first subset of the file to a first cloud storage service of the plurality of cloud storage services, extract using the comb filter, a second subset of the file by skipping elements of the file to extract every n^th element, offset by one, wherein in extracting of the first subset and the extracting of the second subset, n is selected to avoid having a whole number relationship to a width of a memory read bus used by the synchronization client, transmit the second subset of the file to a second cloud storage service of the plurality of cloud storage services, and transmit metadata of the file and an identification of the first subset, first cloud storage service, second subset, and second cloud storage service, to a third cloud storage service.

10. The system of claim 9, wherein each element comprises a predetermined number of bits.

11. The system of claim 9, wherein the synchronization client is further configured to:

subsequently transmit a request for the file, to the third cloud storage service, the request comprising the metadata of the file; and

receive, from the third cloud storage service, identifications of the first subset, first cloud storage service, second subset, and second cloud storage service.

12. The system of claim 11, wherein the synchronization client is further configured to:

retrieve the first subset from the first cloud storage service;

retrieve the second subset to the second cloud storage service; and

generate the file from the first subset and second subset.

13. The system of claim 12, wherein the synchronization client is further configured to multiplex the first subset and second subset into a single bitstream.

14. The system of claim 12, wherein the synchronization client is further configured to:

load the first subset and second subset into columns of an array having a predetermined number of columns; and

read a row of the array.

15. The system of claim 9, wherein the first subset of the file does not include any consecutive elements of the file, each element having a predetermined length.

16. The system of claim 9, wherein the synchronization client is further configured to encrypt the first subset of the file, prior to transmission of the first subset of the file to the first cloud storage service;

and encrypt the second subset of the file, prior to transmission of the second subset of the file to the second cloud storage service.