SYSTEM AND METHOD FOR ENCRYPTING SECONDARY COPIES OF DATA

• US 20080320319A1
• Filed: 03/31/2008
• Published: 12/25/2008
• Est. Priority Date: 12/29/2006
• Status: Active Grant

• Current Assignee: CommVault Systems Incorporated
• Original Assignee: CommVault Systems Incorporated
• Inventors: Gokhale, Parag, Erofeev, Andrei, Muller, Marcus S.
• Granted Patent: US 8,510,573 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/1073 Conversion
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 12/40176 involving redundancy error detection or correction of the data by redundancy in hardware using active fault-masking in interconnections G06F11/2002; error detection or correction of the data by redundancy in hardware using active fault-masking in storage systems using spares or by reconfiguring G06F11/2053
• CPC Class Codes: H04L 2209/605 Copy protection
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols

Abstract

A system and method for encrypting secondary copies of data is described. In some examples, the system encrypts a secondary copy of data after the secondary copy is created. In some examples, the system looks to information about a data storage system, and determines when and where to encrypt data based on the information.

Claims

1. A method of dynamically choosing a time to encrypt a copy of data created from data included in an original data set, the method comprising:

receiving information related to a completion time of a data storage operation starting before a first time and required to be completed before the first time, wherein the data storage operation creates copies of at least a portion of the original data set;

estimating a modified completion time based on the completion time and based on a time required to encrypt the created copies of the at least portion of the data set; and

when the modified completion time occurs after the first time, encrypting data contained in the created copies after creation of the copies; and

when the modified completion time occurs before the first time, encrypting data contained in the created copies during creation of the copies.

2. The method of claim 1, wherein encrypting data contained in the created copies after creation of the copies includes using resources used by the data storage operation.

3. The method of claim 1, wherein encrypting data contained in the created copies during creation of the copies includes using resources used by the data storage operation.

4. A method of dynamically choosing a resource to encrypt a copy of data created from data included in an original data set, the method comprising:

receiving information related to a completion time of a data storage operation starting before a first time and required to finish before the first time, wherein the data storage operation creates copies of at least a portion of the original data set;

estimating a modified completion time based on the completion time and based on a time required to encrypt the created copies of the at least portion of the data set; and

when the estimated completion time occurs after the first time, encrypting data contained in the created copies using resources not employed by the data storage operation.

5. A method of encrypting data to be stored as a secondary copy of a data set, the method comprising:

determining storage operations to be performed in creating the secondary copy of the data set, wherein determining storage operations includes identifying storage resources to be utilized by the storage operations;

identifying from amongst the determined storage operations one or more storage operations to be used to encrypt the secondary copy;

calculating a time to performing the determined storage operations including the identified storage operations to be used to encrypt the secondary copy;

when the calculated time exceeds a threshold time for creating the secondary copy of the data set;

identifying data within the data set to be stored without encryption, wherein identifying the data includes reviewing characteristics of the data to determine whether the data requires encryption under a pre-determined encryption criteria;

storing the identified data within the data set to be stored without encryption, wherein storing the identified data includes utilizing the identified storage resources; and

encrypting the non-identified data within the data set using storage resources not utilized by the storage operations.

6. The method of claim 5, further comprising:

calculating the time to perform the determined storage operations after storing the identified data within the data set to be stored without encryption; and

when the calculated time to perform the determined storage operations after storing the identified data within the data set to be stored without encryption exceeds the threshold time;

identifying, from amongst the data to be stored with encryption, data to be stored without encryption, wherein identifying the data includes reviewing second characteristics of the data to determine whether the data requires encryption under the pre-determined encryption criteria; and

encrypting the non-identified data within the data set using storage resources not utilized by the storage operations.

7. The method of claim 5, wherein the characteristics of the data include a classification of the data.

8. The method of claim 5, further comprising:

storing the encrypted non-identified data utilizing the identified storage resources.