Storage service

• US 20050138404A1
• Filed: 11/19/2004
• Published: 06/23/2005
• Est. Priority Date: 12/22/2003
• Status: Active Grant

• Current Assignee: IDPA Holdings Incorporated (InterDigital, Inc.)
• Original Assignee: Alcatel SA (Nokia Corporation)
• Inventors: Laube, Manfred, Weik, Hartmut, Weiss, Manfred
• Granted Patent: US 7,702,923 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 16/10 File systems; File servers
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks

Abstract

The invention concerns a method of providing a client (21, 22, 23, 24) transparent access to storage space administrated by a storage service, as well as a client (21, 22, 23, 24) and a storage system for performing this method. Data are exchanged between the client (21, 22, 23, 24) and the storage system (5) providing the storage service via a communication network (1). A client (24) invokes the storage service for providing the storage space. The storage space associated with the client (24) is located within the storage system (5). A secure connection is established between the client (24) and a storage device (51) of the storage system (5) dedicated to store data assigned to said storage space. Data assigned to the storage space is stored in encrypted form in said storage device (51).

Claims

1. A method of providing a client transparent access to storage space administrated by a storage service, wherein data are exchanged between the client and a storage system providing the storage service via a communication network,

wherein the method comprises the steps of:

invoking the storage service for providing the storage space to the client;

locating the storage space associated with the client within the storage system;

establishing a secure connection between the client and a storage device of the storage system dedicated to store data assigned to that storage space; and

storing data assigned to the storage space in an encrypted form in said storage device.

2. The method of claim 1, wherein the method comprises the further steps of:

encrypting, by the client, data assigned to the storage space by means of a client specific encryption key; and

decrypting, by the client, data retrieved from the storage space by means of an associated client specific decryption key.

3. The method of claim 1, wherein the method comprises the further step of storing data structure data of said storage space in encrypted form in said storage device.

4. The method of claim 3, wherein the method comprises the further steps of:

encrypting, by the client, data structure data associated with data assigned to the storage space by means of a client specific encryption key; and

submitting a first data set to the storage service including encrypted data and a second data set to the storage service including encrypted data structure data associated with said encrypted data.

5. The method of claim 3, wherein the client submits a query to the storage service, the query including a query request and a client specific decryption key for decrypting encrypted data structure data of the storage space, and wherein the storage system decrypts data structure data of the storage space by means of the submitted decryption key for computing the query request.

6. The method of claim 3, wherein, on a query request from the client, the storage device submits encrypted data and associated encrypted data structure data of the storage space to the client, and wherein the client decrypts the encrypted data structure data for computing the query request.

7. The method of claim 1, wherein the communication network is a public communication network, in particular an IP network.

8. The method of claim 1, wherein the storage system distributes said storage space among two or more storage devices constituting a distributed storage network.

9. A client with a communication unit adapted to provide transparent access to storage space administrated by a storage service and to exchange data with a storage system providing the storage service via a communication network, wherein the communication unit is further adapted to invoke the storage service for providing the storage space to the client, to establish a secure connection with a storage device of the storage system dedicated to store data assigned to said storage space, to encrypt data assigned to the storage space by means of a client specific encryption key, and to transmit the encrypted data assigned to the storage space to the storing service to be stored in encrypted form in said storage device.

10. A storage system for providing a client transparent access to storage space administrated by a storage service, wherein the storage system comprises a service control unit and at least one storage device having a communication unit for exchanging data with the client via a communication network, wherein the service control unit is adapted to locate the storage space associated with the client within the storage system, when the client invokes the storage service for providing the storage space, wherein the service control unit is adapted to support the establishment of a secure connection between the client and the storage device of the storage system dedicated to store data assigned to said storage space, and wherein the at least one storage device is adapted to store data assigned to this storage space in encrypted form.