Secure distributed backup for personal device and cloud data

• US 10,198,589 B2
• Filed: 12/23/2015
• Issued: 02/05/2019
• Est. Priority Date: 01/03/2015
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Kumar, Mitesh, Nalluri, Srikanth, Kulkarni, Dattatraya, Halder, Kamlesh, Gadde, Kranthikumar, Dhruw, Kaushal Kumar, Venkatasubrahmanyam, Krishnapur, Nayak, Susmita
• Primary Examiner(s): Tsang, Henry
• Application Number:
  US14/757,701
• Publication Number:
  US 20160196218A1
• Time in Patent Office: 1,140 Days
• Field of Search: None
• CPC Class Codes: G06F 11/1448 Management of the data involved in backup or backup restore
• CPC Class Codes: G06F 11/1456 Hardware arrangements for backup
• CPC Class Codes: G06F 11/1464 for networked environments
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]

Abstract

Securely distributing a backup file includes identifying a file to be stored, generating a plurality of file chunks from the file, transmitting from a first device, each of the plurality of file chunks to one of a plurality of storage locations, and generating, at the first device, a map that identifies the storage location for each chunk. Retrieving a distributed backup file includes receiving a request to retrieve a file, obtaining a map corresponding to the file, wherein the map identifies a storage location for each of a plurality of file chunks of the file, retrieving the plurality of file chunks from the identified locations, and generating the requested file by combining the plurality of file chunks.

Claims

1. A storage device or storage disk comprising instructions which, when executed, cause a first device to at least:

generate a first file chunk and a second file chunk from a file in response to a request from a client device to store the file remotely from the client device,

encrypt the first file chunk by a first encryption method;

encrypt the second file chunk by a second encryption method different than the first encryption method;

transmit the first file chunk to a first storage system of a first cloud storage service;

transmit the second file chunk to a second storage system of a second cloud storage service; and

generate a map that (A) identifies a first storage location of the first file chunk and a second storage location of the second file chunk, (B) first encryption information corresponding to the first encryption method and second encryption information corresponding to the second encryption method, and (C) includes first login information to access the first cloud storage service and second login information to access the second cloud storage service; and

transmit the map to a remote device different from the first device and the client device.

2. The storage device or storage disk of claim 1, wherein the first device includes a secure memory.

3. The storage device or storage disk of claim 1, wherein at least one of the first storage system and the second storage system further include a local device.

4. The storage device or storage disk of claim 1, wherein the first file chunk and the second file chunk have randomly determined sizes.

5. The storage device of claim 1, wherein the remote device is one of the first storage system or the second storage system.

6. A system comprising:

a processor;

a network interface communicatively coupled to the processor;

hardware circuitry communicatively coupled to the processor;

and

a storage device communicatively coupled to the processor, the hardware circuitry, and the network interface, the storage device including instructions which, when executed, cause the processor to;

in response to a request from a client device to store a file remotely from the client device, cause the hardware circuitry to generate a first file chunk and a second file chunk from the file;

encrypt the first file chunk by a first encryption method;

encrypt the second file chunk by a second encryption method different than the first encryption method;

transmit, via the network interface, the first file chunk to a first storage system of a first cloud storage service;

transmit, via the network interface, the second file chunk to a second storage system of a second cloud storage service;

generate a map that (A) identifies a first storage location of the first file chunk and a second storage location of the second file chunk, (B) includes first encryption information corresponding to the first encryption method and second encryption information corresponding to the second encryption method, and (C) includes first login information to access the first cloud storage service and second login information to access the second cloud storage service; and

transmit, via the network interface, the map to a remote device different from the client device.

7. The system of claim 6, wherein the hardware circuitry includes a secure enclave.

8. The system of claim 6, wherein at least one of the first storage system or the second storage system includes a local device.

9. The system of claim 6, wherein the instructions, when executed, cause the processor to include rebuild information about how to rebuild the file from the encrypted first and second file chunks in the map.

10. The system of claim 6, wherein the first file chunk and the second file chunk have randomly determined sizes.

11. A method comprising:

generating, with hardware circuitry on a local device, a first file chunk and a second file chunk from a file in response to a request from a client device to store the file remotely from the client device;

encrypting, via the hardware circuitry, the first file chunk using a first encryption method;

encrypting via the hardware circuitry, the second file chunk using a second encryption method different than the first encryption method;

transmitting, from the local device, the first file chunk to a first storage system of a first cloud storage service;

transmitting, from the local device, the second file chunk to a second storage system of a second cloud storage service; and

generating, at the local device, a map that (A) identifies a first storage location of the first file chunk and a second storage location of the second file chunk, (B) includes first encryption information corresponding to the first encryption method and second encryption information corresponding to the second encryption method, and (C) includes first login information to access the first cloud storage service and second login information to access the second cloud storage service; and

transmitting the map to a remote device different from the local device and the client device.

12. The method of claim 11, further including:

receiving a request for the file from the client device;

obtaining the map corresponding to the file from the remote device;

retrieving the first file chunk from the first storage system and the second file chunk from the second storage system using information from the map;

determining that at least one of the first file chunk or the second file chunk is an encrypted file chunk;

decrypting the at least one of the first file chunk or the second file chunk;

generating the requested file by combining the first file chunk and the second file chunk; and

transmitting the requested file to the client device.

13. The method of claim 11, wherein the hardware circuitry includes a secure storage.

14. The method of claim 11, wherein the first file chunk and the second file chunk have randomly determined sizes.

15. The method of claim 11 , wherein the map further includes rebuild information for how to recombine the first file chunk and the second file chunk to rebuild the file.