Hidden proactive replication of data

• US 20040088580A1
• Filed: 11/06/2002
• Published: 05/06/2004
• Est. Priority Date: 11/06/2002
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Kaler, Christopher G., Theimer, Marvin M., Cabrera, Luis Felipe
• Granted Patent: US 7,631,359 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party

Abstract

Moving replicas in a cryptographically secure manner such that the target location and timing of the movements are completely hidden from any user, or is kept as a secret by a limited number of users who have been given advanced notice of the new location and relocation time for a replica. A catalog of replica locations that describe the current location of the replicas is stored in encrypted form so as to prevent individuals from determining the exact location of the replicas. Since the location of the replicas is hidden at any given moment, attackers may not use the location of the replicas in order to attack all of the replicas at the same time. Accordingly, recovery mechanisms may have an opportunity to recover from any given attack by once again creating replicas from those replicas that had not been attacked.

Claims

1. In an environment that includes at least one computer system that stores a plurality of replicas of given data, a method for hiding the location of the replicas comprising the following:

an act of determining a target location for a replica to be moved to using a relocation algorithm implemented by a relocation module;

an act of securing the relocation module against giving information identifying the target location to any user at least prior to the act of determining;

an act of moving the replica to the target location; and

an act of updating a secure catalog of replica locations to reflect that the target location is associated with the replica.

2. A method in accordance with claim 1, wherein the act of updating a secure catalog of replica locations comprises the following:

an act of updating an at least partially encrypted catalog of replica locations.

3. A method in accordance with claim 1, wherein the act of updating a secure catalog of replica locations comprises the following:

an act of updating a catalog on a secure server that limits access to the catalog to only those applications and users that can identify themselves and that are authorized to access the catalog.

4. A method in accordance with claim 1, further comprising the following:

an act of the relocation module determining a movement time for the replica to be moved to the target location.

5. A method in accordance with claim 4, wherein the relocation algorithm considers whether or not there is a current threat when performing the act of determining a movement time for the replica.

6. A method in accordance with claim 4, wherein the relocation algorithm considers a sensitivity level of the given data when performing the act of determining a movement time for the replica.

7. A method in accordance with claim 4, wherein the relocation algorithm considers a trust level of a computer system associated with the target location when performing the act of determining a movement time for the replica.

8. A method in accordance with claim 4, wherein the relocation algorithm considers a bandwidth level for a connection to the target location when performing the act of determining a movement time for the replica.

9. A method in accordance with claim 4, wherein the relocation algorithm considers a load level for a computer system associated with the target location when performing the act of determining a movement time for the replica.

10. A method in accordance with claim 4, wherein the relocation algorithm considers a memory availability level for a computer system associated with the target location when performing the act of determining a movement time for the replica.

11. A method in accordance with claim 4, wherein the relocation algorithm considers a network traffic load for a computer system associated with the target location when performing the act of determining a movement time for the replica.

12. A method in accordance with claim 4, wherein the relocation algorithm considers how easy it would be to monitor network traffic to a computer system associated with the target location when performing the act of determining a movement time for the replica.

13. A method in accordance with claim 4, further comprising the following:

an act of securing the relocation module against giving information identifying the movement time to any user at least prior to the act of determining.

14. A method in accordance with claim 13, wherein the act of securing the relocation module against giving information identifying the movement time to any user at least prior to the act of determining comprises the following:

an act of securing the relocation module against giving information identifying the movement time to any user at any time.

15. A method in accordance with claim 13, further comprising the following:

after the act of determining, an act of notifying one or more users of an association between the movement time and the replica.

16. A method in accordance with claim 15, wherein the act of notifying one or more users of an association between the movement and the replica comprises the following:

an act of notifying the one or more users of the movement time prior to the movement time.

17. A method in accordance with claim 1, wherein the act of securing the relocation module against giving information identifying the target location to any user at least prior to the act of determining comprises the following:

an act of securing the relocation module against giving information identifying the target location to any user at any time.

18. A method in accordance with claim 1, further comprising the following:

after the act of determining, an act of notifying one or more users of an association between the target location and the replica.

19. A method in accordance with claim 18, wherein the act of notifying one or more users of an association between the target location and the replica comprises the following:

an act of notifying the one or more users of the target location to which the replica will be moved prior to the act of moving the replica to the target location.

20. A method in accordance with claim 18, wherein the act of notifying one or more users of an association between the target location and the replica comprises the following:

an act of notifying the one or more users of the target location to which the replica has been moved after the act of moving the replica to the target location.

21. A method in accordance with claim 1, wherein the act of securing the relocation module against giving information identifying the target location to any user at least prior to the act of determining, comprises the following:

an act of encrypting at least a portion of computer-executable instructions that when executed by a processor form the relocation module and allow the relocation module to function; and

prior to executing the portion of computer-executable instructions that are encrypted, decrypting the computer-executable instructions using a decryption module that does not allow user access to any resulting decrypted computer-executable instructions.

22. A method in accordance with claim 1, further comprising the following:

an act of determining that the target location is on a computer system that is outside of trusted zone; and

wherein the replica is moved in encrypted form.

23. A method in accordance with claim 1, further comprising the following:

an act of determining that the target location is on a computer system that has memory resources that are lower than a threshold value, wherein the replica is moved in compressed form.

24. A method in accordance with claim 1, wherein the relocation algorithm considers whether or not there is a current threat when performing the act of determining a target location for a replica.

25. A method in accordance with claim 1, wherein the relocation algorithm considers a sensitivity level of the given data when performing the act of determining a target location for a replica.

26. A method in accordance with claim 1, wherein the relocation algorithm considers a trust level of a computer system associated with the target location when performing the act of determining a target location for a replica.

27. A method in accordance with claim 1, wherein the relocation algorithm considers a bandwidth level for a connection to the target location when performing the act of determining a target location for a replica.

28. A method in accordance with claim 1, wherein the relocation algorithm considers a load level for a computer system associated with the target location when performing the act of determining a target location for a replica.

29. A method in accordance with claim 1, wherein the relocation algorithm considers a memory availability level for a computer system associated with the target location when performing the act of determining a target location for a replica.

30. A computer program product for use in an environment that includes at least one computer system that stores a plurality of replicas of given data, the computer program product for implementing a method for hiding the location of the replicas the computer-program product comprising one or more computer-readable-media having stored thereon the following:

computer-executable instructions for determining a target location for a replica to be moved to using a relocation algorithm implemented by a relocation module;

computer-executable instructions for securing the relocation module against giving information identifying the target location to any user at least prior to the act of determining;

computer-executable instructions moving the replica to the target location; and

computer-executable instructions for updating a secure catalog of replica locations to reflect that the target location is associated with the replica.

31. A computer-program product in accordance with claim 30, wherein the one or more computer-readable media are physical storage media.

32. A computer program product for use in an environment that includes at least one computer system that stores a plurality of replicas of given data, the computer program product for implementing a method for hiding the location of the replicas the computer-program product comprising one or more computer-readable media having stored thereon a relocation module adapted to perform the following:

determine a target location for a replica to be moved to using a relocation algorithm implemented by a relocation module;

abstain from giving information identifying the target location to any user at least prior to the act of determining;

move the replica to the target location; and

update a secure catalog of replica locations to reflect that the target location is associated with the replica.

33. A computer program product in accordance with claim 32, wherein the one or more computer-readable media are physical storage media.

34. In an environment that includes at least one computer system that stores a plurality of replicas of given data, a method for hiding the location of the replicas comprising the following:

an act of determining a target location for a replica to be moved to using a relocation algorithm implemented by a relocation module;

an act of securing the relocation module against giving information identifying the target location to any user at least prior to the act of determining;

an act of informing a group of one or more users of an association between the target location and the replica; and

an act of moving the replica to the target location.

35. A method in accordance with claim 34, further comprising the following:

an act of updating a catalog of replica locations to reflect that the target location is associated with the replica.

36. A method in accordance with claim 35, wherein the act of updating a catalog of replica locations to reflect that the target location is associated with the replica comprises the following:

an act of updating an encrypted catalog of locations to reflect that the target location is associated with the replica.

37. A method in accordance with claim 34, wherein the act of informing occurs prior to the act of moving.

38. A method in accordance with claim 34, wherein the act of informing occurs after the act of moving.

39. A method in accordance with claim 34, further comprising the following:

an act of the relocation module determining a movement time for the replica to be moved to the target location.

40. A method in accordance with claim 39, further comprising the following:

an act of informing the group of one or more users of an association between the target location and the replica.

41. A computer program product for use in an environment that includes at least one computer system that stores a plurality of replicas of given data, the computer program product for implementing a method for hiding the location of the replicas, the computer program product comprising one or more computer-readable media having stored thereon the following:

computer-executable instructions for determining a target location for a replica to be moved to using a relocation algorithm implemented by a relocation module;

computer-executable instructions for securing the relocation module against giving information identifying the target location to any user at least prior to the act of determining;

computer-executable instructions for informing a group of one or more users of an association between the target location and the replica; and

computer-executable instructions for moving the replica to the target location.

42. A computer program product in accordance with claim 41, wherein the one or more computer-readable media are physical storage media.