Automatic file encryption

• US 10,445,518 B2
• Filed: 08/07/2017
• Issued: 10/15/2019
• Est. Priority Date: 03/12/2013
• Status: Expired due to Fees

• Current Assignee: CommVault Systems Incorporated
• Original Assignee: CommVault Systems Incorporated
• Inventors: Erofeev, Andrei, Pawar, Rahul S.
• Primary Examiner(s): Zaidi, Syed A
• Application Number:
  US15/670,848
• Publication Number:
  US 20180107834A1
• Time in Patent Office: 799 Days
• Field of Search: 713165
• CPC Class Codes: G06F 11/1402 Saving, restoring, recovering or retrying
• CPC Class Codes: G06F 11/1458 Management of the backup or restore process
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/70 Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2201/84 Using snapshots, i.e. a logical point-in-time copy of the data
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

A method for automatically encrypting files is disclosed. In some cases, the method may be performed by computer hardware comprising one or more processors. The method can include detecting access to a first file, which may be stored in a primary storage system. Further, the method can include determining whether the access comprises a write access. In response to determining that the access comprises a write access, the method can include accessing file metadata associated with the first file and accessing a set of encryption rules. In addition, the method can include determining whether the file metadata satisfies the set of encryption rules. In response to determining that the file metadata satisfies the set of encryption rules, the method can include encrypting the first file to obtain a first encrypted file and modifying an extension of the first encrypted file to include an encryption extension.

Claims

1. A method of rotating a client key of a client computing device, the method comprising:

by a client computing device comprising one or more hardware processors and a storage;

detecting a key rotation trigger associated with updating a first asymmetric key pair for the client computing device, wherein a public key of the first asymmetric key pair was used to encrypt a data encryption key that was used to encrypt a file;

decrypting a first encrypted copy of the data encryption key using a private key of the first asymmetric key pair to obtain a decrypted data encryption key;

discarding the private key of the first asymmetric key pair;

obtaining a second asymmetric key pair that differs from the first asymmetric key pair;

associating the second asymmetric key pair with the client computing device;

encrypting the decrypted data encryption key using a public key of the second asymmetric key pair to obtain a second encrypted copy of the data encryption key that differs from the first encrypted copy of the data encryption key;

discarding the decrypted data encryption key; and

storing the second encrypted copy of the data encryption key.

2. The method of claim 1, wherein decrypting the first encrypted copy of the data encryption key comprises:

accessing an encrypted copy of the private key of the first asymmetric key pair;

providing the encrypted copy of the private key of the first asymmetric key pair to a storage manager;

receiving the private key of the first asymmetric key pair from the storage manager;

obtaining the first encrypted copy of the data encryption key; and

decrypting the first encrypted copy of the data encryption key using the private key of the first asymmetric key pair to obtain the decrypted data encryption key.

3. The method of claim 1, wherein discarding the private key of the first asymmetric key pair comprises discarding a client passphrase of the client computing device.

4. The method of claim 3, wherein discarding the client passphrase comprises designating the client passphrase as inactive.

5. The method of claim 1, wherein storing the second encrypted copy of the data encryption key comprises embedding the second encrypted copy of the data encryption key with an encrypted copy of the file.

6. The method of claim 1, wherein the key rotation trigger comprises one or more of an unauthorized access of the client computing device, an attempted unauthorized access of the client computing device, or a scheduled time being reached.

7. The method of claim 1, wherein discarding the private key of the first asymmetric key pair includes discarding an encrypted copy of the private key of the first asymmetric key pair.

8. The method of claim 1, wherein discarding the private key of the first asymmetric key pair includes discarding the public key of the first asymmetric key pair.

9. The method of claim 1, further comprising:

providing a private key of the second asymmetric key pair to a storage manager of an information management system that includes the client computing device;

receiving from the storage manager an encrypted copy of the private key of the second asymmetric key pair;

storing the encrypted copy of the private key of the second asymmetric key pair; and

discarding the private key of the second asymmetric key pair.

10. The method of claim 9, wherein the encrypted copy of the private key of the second asymmetric key pair is encrypted using, at least in part, a client passphrase of the client computing device.

11. The method of claim 10, wherein the client passphrase of the client computing device differs from a client passphrase used, at least in part, to encrypt the private key of the first asymmetric key pair.

12. The method of claim 1, wherein discarding the private key of the first asymmetric key pair and the decrypted data encryption key comprises deleting the private key of the first asymmetric key pair and the decrypted data encryption key from the client computing device.

13. A system for rotating a client key of a computing device, the system comprising:

a primary storage device configured to store a set of files; and

a computing device comprising one or more hardware processors, the one or more hardware processors configured to;

detect a key rotation trigger associated with updating a first asymmetric key pair for the client computing device, wherein a public key of the first asymmetric key pair was used to encrypt a data encryption key that was used to encrypt a file stored on the primary storage device;

decrypt a first encrypted copy of the data encryption key using a private key of the first asymmetric key pair to obtain a decrypted data encryption key;

discard the private key of the first asymmetric key pair;

obtain a second asymmetric key pair that differs from the first asymmetric key pair;

associate the second asymmetric key pair with the client computing device;

encrypt the decrypted data encryption key using a public key of the second asymmetric key pair to obtain a second encrypted copy of the data encryption key that differs from the first encrypted copy of the data encryption key;

discard the decrypted data encryption key; and

store the second encrypted copy of the data encryption key.

14. The system of claim 13, wherein the one or more hardware processors are further configured to decrypt the first encrypted copy of the data encryption key by at least:

accessing an encrypted copy of the private key of the first asymmetric key pair;

providing the encrypted copy of the private key of the first asymmetric key pair to a storage manager;

receiving the private key of the first asymmetric key pair from the storage manager;

obtaining the first encrypted copy of the data encryption key; and

decrypting the first encrypted copy of the data encryption key using the private key of the first asymmetric key pair to obtain the decrypted data encryption key.

15. The system of claim 13, wherein the one or more hardware processors are further configured to store the second encrypted copy of the data encryption key by at least embedding the second encrypted copy of the data encryption key with an encrypted copy of the file.

16. The system of claim 13, wherein the key rotation trigger comprises one or more of an unauthorized access of the client computing device, an attempted unauthorized access of the client computing device, or a scheduled time being reached.

17. The system of claim 13, wherein the one or more hardware processors are further configured to discard one or more of an encrypted copy of the private key of the first asymmetric key pair or the public key of the first asymmetric key pair.

18. The system of claim 13, wherein the one or more hardware processors are further configured to:

provide a private key of the second asymmetric key pair to a storage manager of an information management system;

receive from the storage manager an encrypted copy of the private key of the second asymmetric key pair;

store the encrypted copy of the private key of the second asymmetric key pair; and

discard the private key of the second asymmetric key pair.

19. The system of claim 13, wherein the one or more hardware processors are further configured to discard the private key of the first asymmetric key pair and the decrypted data encryption key by at least deleting the private key of the first asymmetric key pair and the decrypted data encryption key from the client computing device.

20. The system of claim 13, wherein the one or more hardware processors are further configured to generate the second asymmetric key pair.