SYSTEMS AND METHODS FOR SECURE DISTRIBUTED STORAGE

• US 20120331088A1
• Filed: 06/01/2012
• Published: 12/27/2012
• Est. Priority Date: 06/01/2011
• Status: Abandoned Application

• Current Assignee: Security First Corp
• Original Assignee: Security First Corp
• Inventors: O'Hare, Mark S., Orsini, Rick L., Martin, Don, Fulford, Russ
• Application Number:
  US13/486,659
• Publication Number:
  US 20120331088A1
• Time in Patent Office: Days
• US Class Current: 709/214
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Systems and methods are provided for directing a client computing device to data portions stored on a plurality of storage locations. A registration/authentication server receives a request from a client computing device to retrieve portions of data stored at multiple storage locations. The registration/authentication server provides pointers to available storage locations to the client computing device based on criteria, whereupon the client computing device may retrieve the data portions and reconstitute a desired data set.

Claims

1. A method for directing a client computing device to data portions stored on a plurality of storage locations, the method steps implemented by a programmed computer system, the method comprising:

receiving, at a server and from a client computing device, a request to identify a plurality of physically separated storage locations, each of which stores a portion of a data set identified by the request, wherein the data set can be restored from a predetermined number of portions of the data set that is least two and fewer than all of the portions of the data set;

selecting, with the server, at least the predetermined number of storage locations from available storage locations of the plurality of storage locations based on one or more criteria, wherein each of the selected locations stores a portion of the data set, and the selected storage locations comprise fewer than all of the plurality of the storage locations; and

transmitting, from the server to the client computing device, data identifying the selected storage locations.

2. The method of claim 1, further comprising:

prior to receiving the request to identify a plurality of physically separated storage locations;

receiving a plurality of portions of the data set from a computing device different from the client computing device, and

storing the plurality of portions of data among the plurality of physically separated storage locations.

3. The method of claim 1, wherein the criteria comprises a geographic location, the method further comprising determining the geographic location of at least one of the plurality of the storage locations.

4. The method of claim 1, wherein the criteria comprises a load, the method further comprising determining a load on at least one of the plurality of the storage locations, the load comprising at least one of a storage load and a processing load.

5. The method of claim 1, wherein the selecting of the storage locations is based on at least one rule associated with an enterprise, a product, a client, a user, or a request.

6. The method of claim 1, wherein each portion of the data set comprises a header and a plurality of data blocks associated with the header.

7. The method of claim 6, wherein the header of each portion of the data set is associated with the plurality of data blocks by a portioning job identifier assigned to the header and each of the data blocks.

8. The method of claim 6, further comprising accessing the header from at least one of the plurality of storage locations.

9. The method of claim 8, the method further comprising:

receiving, from the client computing device, a request to modify a header of a portion of the encrypted data set; and

modifying the header of the portion of the encrypted data set.

10. The method of claim 8, the method further comprising:

receiving, from a user of the storage network, a request to rekey data in a header of a portion of an data set using a new key;

unwrapping the data in the header of the portion of the data set; and

rewrapping the data in the header of the portion of the data set using the new key.

11. The method of claim 8, the method further comprising verifying, based on at least one header, that the data blocks associated with the header can be used to restore the data set.

12. The method of claim 1, the method further comprising:

determining that a portion of the data set is not accessible to the client computing device at a first storage location; and

restoring the portion of the data set to the first storage location from at least the predetermined number of available portions.

13. The method of claim 1, wherein the at least one storage location comprises a cloud computing storage location.

14. A computer system for method for directing a client computing device to data portions stored on a plurality of storage locations, comprising:

at least one processor; and

a non-transitory computer readable medium storing computer executable instructions that, when executed by the at least one processor, cause the computer system to carry out the following steps;

a receiving, from a client computing device, a request to identify a plurality of physically separated storage locations, each of which stores a portion of a data set identified by the request, wherein the data set can be restored from a predetermined number of portions of the data set that is least two and fewer than all of the portions of the data set;

selecting at least the predetermined number of storage locations from available storage locations of the plurality of storage locations based on one or more criteria, wherein each of the selected locations stores a portion of the data set, and the selected storage locations comprise fewer than all of the plurality of the storage locations; and

transmitting, to the client computing device, data identifying the selected storage locations.

15. The system of claim 14, wherein the method carried out by the computer system further comprises:

prior to receiving the request to identify a plurality of physically separated storage locations;

receiving a plurality of portions of the data set from a computing device different from the client computing device, and

storing the plurality of portions of data among the plurality of physically separated storage locations.

16. The system of claim 14, wherein the criteria comprises a geographic location, and wherein the method carried out by the computer system further comprises determining the geographic location of at least one of the plurality of the storage locations.

17. The system of claim 14, wherein the criteria comprises a load, wherein the method carried out by the computer system further comprises determining a load on at least one of the plurality of the storage locations, the load comprising at least one of a storage load and a processing load.

18. The system of claim 14, wherein the selecting of the storage locations is based on at least one rule associated with an enterprise, a product, a client, a user, or a request.

19. The system of claim 14, wherein each portion of the data set comprises a header and a plurality of data blocks associated with the header.

20. The system of claim 19, wherein the header of each portion of the data set is associated with the plurality of data blocks by a portioning job identifier assigned to the header and each of the data blocks.

21. The system of claim 19, wherein the method carried out by the computer system further comprises accessing the header from at least one of the plurality of storage locations.

22. The system of claim 21, wherein the method carried out by the computer system further comprises:

receiving, from the client computing device, a request to modify a header of a portion of the encrypted data set; and

modifying the header of the portion of the encrypted data set.

23. The system of claim 21, wherein the method carried out by the computer system further comprises:

receiving, from a user of the storage network, a request to rekey data in a header of a portion of an data set using a new key;

unwrapping the data in the header of the portion of the data set; and

rewrapping the data in the header of the portion of the data set using the new key.

24. The system of claim 21, wherein the method carried out by the computer system further comprises verifying, based on at least one header, that the data blocks associated with the header can be used to restore the data set.

25. The system of claim 14, wherein the method carried out by the computer system further comprises:

determining that a portion of the data set is not accessible to the client computing device at a first storage location; and

restoring the portion of the data set to the first storage location from at least the predetermined number of available portions.

26. The system of claim 14, wherein the at least one storage location comprises a cloud computing storage location.

27. A non-transitory computer-readable medium storing computer-executable instructions which, when executed by at least one processor, cause a computer system to carry out a method for directing a client computing device to data portions stored on a plurality of storage locations, the method comprising the steps of:

receiving, from a client computing device, a request to identify a plurality of physically separated storage locations, each of which stores a portion of a data set identified by the request, wherein the data set can be restored from a predetermined number of portions of the data set that is least two and fewer than all of the portions of the data set;

selecting at least the predetermined number of storage locations from available storage locations of the plurality of storage locations based on one or more criteria, wherein each of the selected locations stores a portion of the data set, and the selected storage locations comprise fewer than all of the plurality of the storage locations; and

transmitting, to the client computing device, data identifying the selected storage locations.

28. The non-transitory computer-readable medium of claim 27, wherein the method further comprises:

prior to receiving the request to identify a plurality of physically separated storage locations;

receiving a plurality of portions of the data set from a computing device different from the client computing device, and

storing the plurality of portions of data among the plurality of physically separated storage locations.

29. The non-transitory computer-readable medium of claim 27, wherein the criteria comprises a geographic location, and wherein the method further comprises determining the geographic location of at least one of the plurality of the storage locations.

30. The non-transitory computer-readable medium of claim 27, wherein the criteria comprises a load, wherein the method further comprises determining a load on at least one of the plurality of the storage locations, the load comprising at least one of a storage load and a processing load.

31. The non-transitory computer-readable medium of claim 27, wherein the selecting of the storage locations is based on at least one rule associated with an enterprise, a product, a client, a user, or a request.

32. The non-transitory computer-readable medium of claim 27, wherein each portion of the data set comprises a header and a plurality of data blocks associated with the header.

33. The non-transitory computer-readable medium of claim 32, wherein the header of each portion of the data set is associated with the plurality of data blocks by a portioning job identifier assigned to the header and each of the data blocks.

34. The non-transitory computer-readable medium of claim 32, wherein the method further comprises accessing the header from at least one of the plurality of storage locations.

35. The non-transitory computer-readable medium of claim 34, wherein the method further comprises:

receiving, from the client computing device, a request to modify a header of a portion of the encrypted data set; and

modifying the header of the portion of the encrypted data set.

36. The non-transitory computer-readable medium of claim 34, wherein the method further comprises:

receiving, from a user of the storage network, a request to rekey data in a header of a portion of an data set using a new key;

unwrapping the data in the header of the portion of the data set; and

rewrapping the data in the header of the portion of the data set using the new key.

37. The non-transitory computer-readable medium of claim 34, wherein the method further comprises verifying, based on at least one header, that the data blocks associated with the header can be used to restore the data set.

38. The non-transitory computer-readable medium of claim 27, wherein the method further comprises:

determining that a portion of the data set is not accessible to the client computing device at a first storage location; and

restoring the portion of the data set to the first storage location from at least the predetermined number of available portions.

39. The non-transitory computer-readable medium of claim 27, wherein the at least one storage location comprises a cloud computing storage location.