CLOUD FILE SYSTEM

• US 20130305039A1
• Filed: 05/14/2012
• Published: 11/14/2013
• Est. Priority Date: 05/14/2011
• Status: Active Grant

• Current Assignee: Puccini World Limited
• Original Assignee: Bitcasa, Inc
• Inventors: Gauda, Anthony Francois
• Granted Patent: US 9,253,166 B2
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use

Abstract

A cloud storage system supporting user agnostic encryption and deduplication of encrypted files is described. Further the cloud storage system enables users to share a file, a group of files, or an entire file system with other users without a user sending each file to the other users. The cloud storage system further allows a client device to minimize the utilization of bandwidth by determining whether the encrypted data to transfer is already present in the cloud storage system. Further the cloud storage system comprises mechanisms for a client device to inform the cloud storage system of which data is likely to be required in the future so that the cloud storage system can make that data available with less latency one the client device requests the data.

Claims

1. A method performed by a cloud storage client in a client device for saving a plurality of files to a cloud file system, wherein the cloud file system resides, at least partially, in a cloud storage system, the method comprising the steps of:

for each of the plurality of files, performing the following;

splitting that file into a plurality of chunks,

for each of the plurality of chunks, performing the following;

generating an encryption key based on data with that chunk,

encrypting that chunk using the generated encryption key,

generating a chunk identifier based on data within the encrypted chunk,

including the encryption key and the chunk identifier in the file manifest,

determining whether the cloud storage system includes the encrypted chunk, and

transmitting the encrypted chunk and chunk identifier to the cloud storage system only if it is determined that the cloud storage system does not contain the encrypted chunk,

wherein the file manifest includes a list of the encryption keys and corresponding chunk identifiers for the plurality of chunks,

generating a file manifest encryption key based on the data within the file manifest,

encrypting the file manifest using the file manifest encryption key,

generating a file manifest identifier based on data within the encrypted file manifest,

including the file manifest encryption key and the file manifest identifier in a file system manifest,

determining whether the cloud storage system includes the encrypted file manifest, and

transmitting the encrypted file manifest and the file manifest identifier to the cloud storage system only if it is determined that the cloud storage system does not include the encrypted file manifest;

wherein the file system manifest includes a listing of the file manifests for each of the plurality of files and a path of the plurality of files;

encrypting the file system manifest; and

transmitting the encrypted file system manifest to the cloud storage system.

2. The method of claim 1, wherein the encryption key generated for each chunk is based on a result of hashing that chunk.

3. The method of claim 1, wherein the generated chunk identifier for each chunk is based on a result of hashing the encrypted chunk.

4. The method of claim 1, wherein the file system manifest is encrypted using an encryption key unique to the client device or a user of the client device.

5. The method of claim 1, further comprising:

removing the plurality of files from a local storage system of the client device after saving those files to the cloud file system.

6. The method of claim 1, wherein determining whether the cloud storage system includes the encrypted chunk comprises:

transmitting a query to the cloud storage system that requests information indicating whether the chunk identifier corresponding to the encrypted chunk is present in the cloud storage system; and

receiving a response indicating whether the chunk identifier is present in the cloud storage system.

7. At least one non-transitory machine-readable storage medium that provides instructions that, if executed by a processor of a client device, will cause said processor to perform operations for saving a plurality of files to a cloud file system that resides, at least partially, in a cloud storage system, the operations comprising:

for each of the plurality of files, performing the following;

splitting that file into a plurality of chunks,

for each of the plurality of chunks, performing the following;

generating an encryption key based on data with that chunk,

encrypting that chunk using the generated encryption key,

generating a chunk identifier based on data within the encrypted chunk,

including the encryption key and the chunk identifier in the file manifest,

determining whether the cloud storage system includes the encrypted chunk, and

transmitting the encrypted chunk and chunk identifier to the cloud storage system only if it is determined that the cloud storage system does not contain the encrypted chunk,

wherein the file manifest includes a list of the encryption keys and corresponding chunk identifiers for the plurality of chunks,

generating a file manifest encryption key based on the data within the file manifest,

encrypting the file manifest using the file manifest encryption key,

generating a file manifest identifier based on data within the encrypted file manifest,

including the file manifest encryption key and the file manifest identifier in a file system manifest,

determining whether the cloud storage system includes the encrypted file manifest, and

transmitting the encrypted file manifest and the file manifest identifier to the cloud storage system only if it is determined that the cloud storage system does not include the encrypted file manifest;

wherein the file system manifest includes a listing of the file manifests for each of the plurality of files and a path of the plurality of files;

encrypting the file system manifest; and

transmitting the encrypted file system manifest to the cloud storage system.

66. The at least one non-transitory machine-readable storage medium of claim 7, wherein the encryption key generated for each chunk is based on a result of hashing that chunk.

67. The at least one non-transitory machine-readable storage medium of claim 7, wherein the generated chunk identifier for each chunk is based on a result of hashing the encrypted chunk.

68. The at least one non-transitory machine-readable storage medium of claim 7, wherein the file system manifest is encrypted using an encryption key unique to the client device or a user of the client device.

69. The at least one non-transitory machine-readable storage medium of claim 7, wherein the at least one non-transitory machine-readable storage medium further provides instructions that, if executed by the processor of the client device, will cause said processor to perform the following operation:

removing the plurality of files from a local storage system of the client device after saving those files to the cloud file system.

70. The at least one non-transitory machine-readable storage medium of claim 7, wherein determining whether the cloud storage system includes the encrypted chunk comprises:

transmitting a query to the cloud storage system that requests information indicating whether the chunk identifier corresponding to the encrypted chunk is present in the cloud storage system; and

receiving a response indicating whether the chunk identifier is present in the cloud storage system.

8. A client device configured to save a plurality of files to a cloud file system that resides, at least partially, in a cloud storage system, the client device comprising:

a processor to execute instructions, and

at least one non-transitory machine-readable storage medium coupled with the processor, the medium storing one or more instructions that, when executed, cause the processor to perform operations comprising;

for each of the plurality of files, performing the following;

splitting that file into a plurality of chunks,

for each of the plurality of chunks, performing the following;

generating an encryption key based on data with that chunk,

encrypting that chunk using the generated encryption key,

generating a chunk identifier based on data within the encrypted chunk,

including the encryption key and the chunk identifier in the file manifest,

determining whether the cloud storage system includes the encrypted chunk, and

transmitting the encrypted chunk and chunk identifier to the cloud storage system only if it is determined that the cloud storage system does not contain the encrypted chunk,

wherein the file manifest includes a list of the encryption keys and corresponding chunk identifiers for the plurality of chunks,

generating a file manifest encryption key based on the data within the file manifest,

encrypting the file manifest using the file manifest encryption key,

generating a file manifest identifier based on data within the encrypted file manifest,

including the file manifest encryption key and the file manifest identifier in a file system manifest,

determining whether the cloud storage system includes the encrypted file manifest, and

transmitting the encrypted file manifest and the file manifest identifier to the cloud storage system only if it is determined that the cloud storage system does not include the encrypted file manifest;

wherein the file system manifest includes a listing of the file manifests for each of the plurality of files and a path of the plurality of files;

encrypting the file system manifest; and

transmitting the encrypted file system manifest to the cloud storage system.

71. The client device of claim 8, wherein the encryption key generated for each chunk is based on a result of hashing that chunk.

72. The client device of claim 8, wherein the generated chunk identifier for each chunk is based on a result of hashing the encrypted chunk.

73. The client device of claim 8, wherein the file system manifest is encrypted using an encryption key unique to the client device or a user of the client device.

74. The client device of claim 8, wherein the at least one non-transitory machine-readable storage medium further provides instructions that, if executed by the processor, will cause said processor to perform the following operation:

removing the plurality of files from a local storage system of the client device after saving those files to the cloud file system.

75. The client device of claim 8, wherein determining whether the cloud storage system includes the encrypted chunk comprises:

transmitting a query to the cloud storage system that requests information indicating whether the chunk identifier corresponding to the encrypted chunk is present in the cloud storage system; and

receiving a response indicating whether the chunk identifier is present in the cloud storage system.

9. A method in a cloud storage client of a client device for reading a file stored in a cloud file system, wherein the cloud file system resides, at least partially, in a cloud storage system, the method comprising the steps of:

receiving an instruction from an operating system of the client device to read the file stored in the cloud file system;

determining a file manifest identifier corresponding to the file, wherein the file manifest identifier identifies a file manifest that includes a listing of a plurality of encryption keys and a plurality of chunk identifiers corresponding to a plurality of chunks of the file, wherein determining the file manifest identifier corresponding to the file includes accessing a file system manifest that includes a listing of file manifests for files stored in the cloud file system and paths for those files;

responsive to determining that a decrypted file manifest corresponding to the file manifest identifier and an encrypted file manifest corresponding to the file manifest identifier is not present in a local cache of the client device used for the cloud file system, downloading the encrypted file manifest from the cloud storage system;

retrieving a key used to decrypt the encrypted file manifest;

decrypting the encrypted file manifest using the retrieved key;

determining the plurality of chunk identifiers from the decrypted file manifest;

for each of the plurality of chunk identifiers, determining whether a decrypted chunk or an encrypted chunk corresponding to that chunk identifier is present in the local cache of the client device used for the cloud file system;

for each of the plurality of chunk identifiers where a corresponding decrypted chunk or encrypted chunk is not present in the local cache of the client device used for the cloud file system, performing the following;

downloading that encrypted chunk from the cloud storage system,

retrieving, from the decrypted file manifest, a key to decrypt that encrypted chunk, and

decrypting the encrypted chunk using the retrieved key;

for each of the plurality of chunk identifiers where a corresponding encrypted chunk is present in the local cache of the client device used for the cloud file system, performing the following;

retrieving, from the local cache, the encrypted chunk,

retrieving, from the decrypted file manifest, a key to decrypt that encrypted chunk, and

decrypting the encrypted chunk using the retrieved key;

for each of the plurality of chunk identifiers where a decrypted chunk is present in the local cache of the client device used for the cloud file system, retrieving that decrypted chunk from the local cache; and

returning the requested file to the cloud file system.

10. The method of claim 9, further comprising:

storing each decrypted chunk in the local cache of the client device used for the cloud file system.

11. The method of claim 9, wherein downloading each encrypted chunk from the cloud storage system includes performing the following:

including a chunk identifier corresponding to that encrypted chunk in a download queue;

accessing the decrypted file manifest to determine a set of one or more other chunk identifiers whose corresponding chunks are located near that encrypted chunk in the decrypted file manifest;

including, in the download queue, the set of other chunk identifiers; and

downloading the encrypted chunks from the cloud storage system according to the download queue.

12. The method of claim 9, further comprising:

for each of the encrypted chunks downloaded from the cloud storage system, downloading a set of one or more additional encrypted chunks from the cloud storage system.

13. The method of claim 12, further comprising:

for each of the encrypted chunks downloaded from the cloud storage system, using an analytical model that indicates the set of additional encrypted chunks that will likely be accessed when the encrypted chunk is accessed.

14. The method of claim 9, further comprising:

instructing the cloud storage system to prefetch one or more chunks to a cloud storage pool.

15. At least one non-transitory machine-readable storage medium that provides instructions that, if executed by a processor of a client device, will cause said processor to perform operations for reading a file stored in a cloud file system that resides, at least partially, in a cloud storage system, the operations comprising:

receiving an instruction from an operating system of the client device to read the file stored in the cloud file system;

determining a file manifest identifier corresponding to the file, wherein the file manifest identifier identifies a file manifest that includes a listing of a plurality of encryption keys and a plurality of chunk identifiers corresponding to a plurality of chunks of the file, wherein determining the file manifest identifier corresponding to the file includes accessing a file system manifest that includes a listing of file manifests for files stored in the cloud file system and paths for those files;

responsive to determining that a decrypted file manifest corresponding to the file manifest identifier and an encrypted file manifest corresponding to the file manifest identifier is not present in a local cache of the client device used for the cloud file system, downloading the encrypted file manifest from the cloud storage system;

retrieving a key used to decrypt the encrypted file manifest;

decrypting the encrypted file manifest using the retrieved key;

determining the plurality of chunk identifiers from the decrypted file manifest;

for each of the plurality of chunk identifiers, determining whether a decrypted chunk or an encrypted chunk corresponding to that chunk identifier is present in the local cache of the client device used for the cloud file system;

for each of the plurality of chunk identifiers where a corresponding decrypted chunk or encrypted chunk is not present in the local cache of the client device used for the cloud file system, performing the following;

downloading that encrypted chunk from the cloud storage system,

retrieving, from the decrypted file manifest, a key to decrypt that encrypted chunk, and

decrypting the encrypted chunk using the retrieved key;

for each of the plurality of chunk identifiers where a corresponding encrypted chunk is present in the local cache of the client device used for the cloud file system, performing the following;

retrieving, from the local cache, the encrypted chunk,

retrieving, from the decrypted file manifest, a key to decrypt that encrypted chunk, and

decrypting the encrypted chunk using the retrieved key;

for each of the plurality of chunk identifiers where a decrypted chunk is present in the local cache of the client device used for the cloud file system, retrieving that decrypted chunk from the local cache; and

returning the requested file to the cloud file system.

76. The at least one non-transitory machine-readable storage medium of claim 15, wherein the at least one non-transitory machine-readable storage medium further provides instructions that, if executed by the processor of the client device, will cause said processor to perform the following operation:

storing each decrypted chunk in the local cache of the client device used for the cloud file system.

77. The at least one non-transitory machine-readable storage medium of claim 15, wherein downloading each encrypted chunk from the cloud storage system includes performing the following:

including a chunk identifier corresponding to that encrypted chunk in a download queue;

accessing the decrypted file manifest to determine a set of one or more other chunk identifiers whose corresponding chunks are located near that encrypted chunk in the decrypted file manifest;

including, in the download queue, the set of other chunk identifiers; and

downloading the encrypted chunks from the cloud storage system according to the download queues.

78. The at least one non-transitory machine-readable storage medium of claim 15, wherein the at least one non-transitory machine-readable storage medium further provides instructions that, if executed by the processor of the client device, will cause said processor to perform the following operation:

for each of the encrypted chunks downloaded from the cloud storage system, downloading a set of one or more additional encrypted chunks from the cloud storage system.

79. The at least one non-transitory machine-readable storage medium of claim 78, wherein the at least one non-transitory machine-readable storage medium further provides instructions that, if executed by the processor of the client device, will cause said processor to perform the following operation:

for each of the encrypted chunks downloaded from the cloud storage system, using an analytical model that indicates the set of additional encrypted chunks that will likely be accessed when the encrypted chunk is accessed.

80. The at least one non-transitory machine-readable storage medium of claim 15, wherein the at least one non-transitory machine-readable storage medium further provides instructions that, if executed by the processor of the client device, will cause said processor to perform the following operation:

instructing the cloud storage system to prefetch one or more chunks to a cloud storage pool.

16. A client device configured to read a file stored in a cloud file system that resides, at least partially, in a cloud storage system, the client device comprising:

a processor to execute instructions, and

at least one non-transitory machine-readable storage medium coupled with the processor, the medium storing one or more instructions that, when executed, cause the processor to perform operations comprising;

receiving an instruction from an operating system of the client device to read the file stored in the cloud file system;

determining a file manifest identifier corresponding to the file, wherein the file manifest identifier identifies a file manifest that includes a listing of a plurality of encryption keys and a plurality of chunk identifiers corresponding to a plurality of chunks of the file, wherein determining the file manifest identifier corresponding to the file includes accessing a file system manifest that includes a listing of file manifests for files stored in the cloud file system and paths for those files;

responsive to determining that a decrypted file manifest corresponding to the file manifest identifier and an encrypted file manifest corresponding to the file manifest identifier is not present in a local cache of the client device used for the cloud file system, downloading the encrypted file manifest from the cloud storage system;

retrieving a key used to decrypt the encrypted file manifest;

decrypting the encrypted file manifest using the retrieved key;

determining the plurality of chunk identifiers from the decrypted file manifest;

for each of the plurality of chunk identifiers, determining whether a decrypted chunk or an encrypted chunk corresponding to that chunk identifier is present in the local cache of the client device used for the cloud file system;

for each of the plurality of chunk identifiers where a corresponding decrypted chunk or encrypted chunk is not present in the local cache of the client device used for the cloud file system, performing the following;

downloading that encrypted chunk from the cloud storage system,

retrieving, from the decrypted file manifest, a key to decrypt that encrypted chunk, and

decrypting the encrypted chunk using the retrieved key;

for each of the plurality of chunk identifiers where a corresponding encrypted chunk is present in the local cache of the client device used for the cloud file system, performing the following;

retrieving, from the local cache, the encrypted chunk,

retrieving, from the decrypted file manifest, a key to decrypt that encrypted chunk, and

decrypting the encrypted chunk using the retrieved key;

for each of the plurality of chunk identifiers where a decrypted chunk is present in the local cache of the client device used for the cloud file system, retrieving that decrypted chunk from the local cache; and

returning the requested file to the cloud file system.

81. The client device of claim 16, wherein the at least one non-transitory machine-readable storage medium further provides instructions that, if executed by the processor, will cause said processor to perform the following operation:

storing each decrypted chunk in the local cache of the client device used for the cloud file system.

82. The client device of claim 16, wherein downloading each encrypted chunk from the cloud storage system includes performing the following:

including a chunk identifier corresponding to that encrypted chunk in a download queue;

accessing the decrypted file manifest to determine a set of one or more other chunk identifiers whose corresponding chunks are located near that encrypted chunk in the decrypted file manifest;

including, in the download queue, the set of other chunk identifiers; and

downloading the encrypted chunks from the cloud storage system according to the download queue.

83. The client device of claim 16, wherein the at least one non-transitory machine-readable storage medium further provides instructions that, if executed by the processor, will cause said processor to perform the following operation:

for each of the encrypted chunks downloaded from the cloud storage system, downloading a set of one or more additional encrypted chunks from the cloud storage system.

84. The client device of claim 83, wherein the at least one non-transitory machine-readable storage medium further provides instructions that, if executed by the processor, will cause said processor to perform the following operation:

for each of the encrypted chunks downloaded from the cloud storage system, using an analytical model that indicates the set of additional encrypted chunks that will likely be accessed when the encrypted chunk is accessed.

85. The client device of claim 16, wherein the at least one non-transitory machine-readable storage medium further provides instructions that, if executed by the processor, will cause said processor to perform the following operation:

instructing the cloud storage system to prefetch one or more chunks to a cloud storage pool.

17. A method performed by a cloud storage client in a client device for saving a plurality of files to a cloud file system, wherein the cloud file system resides, at least partially, in a cloud storage system, the method comprising the steps of:

for each of the plurality of files, performing the following;

splitting that file into a plurality of chunks,

for each of the plurality of chunks, performing the following;

generating an encryption key based on data with that chunk,

encrypting that chunk using the generated encryption key,

generating a chunk identifier based on data within the encrypted chunk,

including the encryption key and the chunk identifier in a file manifest,

determining whether the cloud storage system includes the encrypted chunk, and

transmitting the encrypted chunk and chunk identifier to the cloud storage system only if it is determined that the cloud storage system does not contain the encrypted chunk,

wherein the file manifest includes a list of the encryption keys and corresponding chunk identifiers for the plurality of chunks,

generating a file manifest encryption key based on the data within the file manifest,

encrypting the file manifest using the file manifest encryption key,

generating a file manifest identifier based on data within the encrypted file manifest,

including the file manifest encryption key and the file manifest identifier in a file system manifest,

determining whether the cloud storage system includes the encrypted file manifest, and

transmitting the encrypted file manifest and the file manifest identifier to the cloud storage system only if it is determined that the cloud storage system does not include the encrypted file manifest;

wherein the file system manifest includes a listing of the file manifests;

generating a file system manifest encryption key based on data within the file system manifest;

encrypting the file system manifest with the generated file system manifest encryption key;

generating a file system manifest identifier based on data within the encrypted file system manifest;

including the file system manifest key and the file system manifest identifier in a user manifest that is associated with a user of the client device, wherein the user manifest includes information that indicates a mount point at which the user has mounted the cloud file system;

encrypting the user manifest with a key specific to the user; and

storing the encrypted user manifest in the cloud storage system.

18. The method of claim 17, wherein the encryption key generated for each chunk is based on a result of hashing that chunk.

19. The method of claim 17, wherein the generated chunk identifier for each chunk is based on a result of hashing the encrypted chunk.

20. The method of claim 17, wherein the file system manifest is encrypted using an encryption key unique to the client device or a user of the client device.

21. The method of claim 17, further comprising:

removing the plurality of files from a local storage system of the client device after saving those files to the cloud file system.

22. The method of claim 17, wherein determining whether the cloud storage system includes the encrypted chunk comprises:

transmitting a query to the cloud storage system that requests information indicating whether the chunk identifier corresponding to the encrypted chunk is present in the cloud storage system; and

receiving a response indicating whether the chunk identifier is present in the cloud storage system.

23. The method of claim 17, wherein the user manifest further includes information identifying an index.

24. At least one non-transitory machine-readable storage medium that provides instructions that, if executed by a processor of a client device, will cause said processor to perform operations for saving a plurality of files to a cloud file system that resides, at least partially, in a cloud storage system, the operations comprising:

for each of the plurality of files, performing the following;

splitting that file into a plurality of chunks,

for each of the plurality of chunks, performing the following;

generating an encryption key based on data with that chunk,

encrypting that chunk using the generated encryption key,

generating a chunk identifier based on data within the encrypted chunk,

including the encryption key and the chunk identifier in a file manifest,

determining whether the cloud storage system includes the encrypted chunk, and

transmitting the encrypted chunk and chunk identifier to the cloud storage system only if it is determined that the cloud storage system does not contain the encrypted chunk,

wherein the file manifest includes a list of the encryption keys and corresponding chunk identifiers for the plurality of chunks,

generating a file manifest encryption key based on the data within the file manifest,

encrypting the file manifest using the file manifest encryption key,

generating a file manifest identifier based on data within the encrypted file manifest,

including the file manifest encryption key and the file manifest identifier in a file system manifest,

determining whether the cloud storage system includes the encrypted file manifest, and

transmitting the encrypted file manifest and the file manifest identifier to the cloud storage system only if it is determined that the cloud storage system does not include the encrypted file manifest;

wherein the file system manifest includes a listing of the file manifests;

generating a file system manifest encryption key based on data within the file system manifest;

encrypting the file system manifest with the generated file system manifest encryption key;

generating a file system manifest identifier based on data within the encrypted file system manifest;

including the file system manifest key and the file system manifest identifier in a user manifest that is associated with a user of the client device, wherein the user manifest includes information that indicates a mount point at which the user has mounted the cloud file system;

encrypting the user manifest with a key specific to the user; and

storing the encrypted user manifest in the cloud storage system.

86. The at least one non-transitory machine-readable storage medium of claim 24, wherein the encryption key generated for each chunk is based on a result of hashing that chunk.

87. The at least one non-transitory machine-readable storage medium of claim 24, wherein the generated chunk identifier for each chunk is based on a result of hashing the encrypted chunk.

88. The at least one non-transitory machine-readable storage medium of claim 24, wherein the file system manifest is encrypted using an encryption key unique to the client device or a user of the client device.

89. The at least one non-transitory machine-readable storage medium of claim 24, wherein the at least one non-transitory machine-readable storage medium further provides instructions that, if executed by the processor of the client device, will cause said processor to perform the following operation:

removing the plurality of files from a local storage system of the client device after saving those files to the cloud file system.

90. The at least one non-transitory machine-readable storage medium of claim 24, wherein determining whether the cloud storage system includes the encrypted chunk comprises:

transmitting a query to the cloud storage system that requests information indicating whether the chunk identifier corresponding to the encrypted chunk is present in the cloud storage system; and

receiving a response indicating whether the chunk identifier is present in the cloud storage system.

91. The at least one non-transitory machine-readable storage medium of claim 24, wherein the user manifest further includes information identifying an index.

25. A client device configured to save a plurality of files to a cloud file system that resides, at least partially, in a cloud storage system, the client device comprising:

a processor to execute instructions, and

at least one non-transitory machine-readable storage medium coupled with the processor, the medium storing one or more instructions that, when executed, cause the processor to perform operations comprising;

for each of the plurality of files, performing the following;

splitting that file into a plurality of chunks,

for each of the plurality of chunks, performing the following;

generating an encryption key based on data with that chunk,

encrypting that chunk using the generated encryption key,

generating a chunk identifier based on data within the encrypted chunk,

including the encryption key and the chunk identifier in a file manifest,

determining whether the cloud storage system includes the encrypted chunk, and

transmitting the encrypted chunk and chunk identifier to the cloud storage system only if it is determined that the cloud storage system does not contain the encrypted chunk,

wherein the file manifest includes a list of the encryption keys and corresponding chunk identifiers for the plurality of chunks,

generating a file manifest encryption key based on the data within the file manifest,

encrypting the file manifest using the file manifest encryption key,

generating a file manifest identifier based on data within the encrypted file manifest,

including the file manifest encryption key and the file manifest identifier in a file system manifest,

determining whether the cloud storage system includes the encrypted file manifest, and

transmitting the encrypted file manifest and the file manifest identifier to the cloud storage system only if it is determined that the cloud storage system does not include the encrypted file manifest;

wherein the file system manifest includes a listing of the file manifests;

generating a file system manifest encryption key based on data within the file system manifest;

encrypting the file system manifest with the generated file system manifest encryption key;

generating a file system manifest identifier based on data within the encrypted file system manifest;

including the file system manifest key and the file system manifest identifier in a user manifest that is associated with a user of the client device, wherein the user manifest includes information that indicates a mount point at which the user has mounted the cloud file system;

encrypting the user manifest with a key specific to the user; and

storing the encrypted user manifest in the cloud storage system.

92. The client device of claim 25, wherein the encryption key generated for each chunk is based on a result of hashing that chunk.

93. The client device of claim 25, wherein the generated chunk identifier for each chunk is based on a result of hashing the encrypted chunk.

94. The client device of claim 25, wherein the file system manifest is encrypted using an encryption key unique to the client device or a user of the client device.

95. The client device of claim 25, wherein the at least one non-transitory machine-readable storage medium further stores one or more instructions that, when executed, cause the processor to perform the following operation:

removing the plurality of files from a local storage system of the client device after saving those files to the cloud file system.

96. The client device of claim 25, wherein determining whether the cloud storage system includes the encrypted chunk comprises:

transmitting a query to the cloud storage system that requests information indicating whether the chunk identifier corresponding to the encrypted chunk is present in the cloud storage system; and

receiving a response indicating whether the chunk identifier is present in the cloud storage system.

97. The client device of claim 25, wherein the user manifest further includes information identifying an index.

26. A method in a cloud storage client of a client device for providing a user with access to a cloud file system, wherein the cloud file system resides, at least partially, in a cloud storage system, the method comprising:

retrieving an encrypted file system manifest and file system manifest encryption key, wherein the encrypted file system manifest corresponds with a file system manifest that has been shared by another user;

decrypting the file system manifest using the file system manifest encryption key, wherein the decrypted file system manifest includes a listing of a set of one or more encrypted file manifests and a set of one or more file manifest keys;

decrypting the set of encrypted file manifests using the set of file manifest keys, wherein each decrypted file manifest includes a set of encryption keys and a corresponding set of chunk identifiers of a file, wherein the file was encrypted in a user agnostic manner to allow encrypted file chunks to be deduplicated across multiple users at the cloud storage system; and

adding the decrypted file system manifest to a user manifest of the user.

27. The method of claim 26, further comprising:

encrypting the user manifest with a key specific to the user; and

transmitting the encrypted user manifest to the cloud storage system.

28. The method of claim 26, wherein the decrypted file system manifest is associated with metadata that indicates a mount point for that file system manifest.

29. The method of claim 28, wherein adding the decrypted file system manifest to the user manifest of the user comprises:

responsive to determining that data currently resides at the location of the indicated mount point, mounting the decrypted file system manifest to a different location.

30. The method of claim 29, wherein the different location is automatically selected by the cloud storage client.

31. The method of claim 29, wherein the different location is chosen by the user of the client device.

32. The method of claim 26, wherein the file system manifest key is a universally unique identifier to the cloud storage system.

33. The method of claim 26, wherein the file system manifest key is provided by the another user, and wherein the file system manifest key is received from the another user.

34. At least one non-transitory machine-readable storage medium that provides instructions that, if executed by a processor of a client device, will cause said processor to perform operations for providing a user with access to a cloud file system that resides, at least partially, in a cloud storage system, the operations comprising:

retrieving an encrypted file system manifest and file system manifest encryption key, wherein the encrypted file system manifest corresponds with a file system manifest that has been shared by another user;

decrypting the file system manifest using the file system manifest encryption key, wherein the decrypted file system manifest includes a listing of a set of one or more encrypted file manifests and a set of one or more file manifest keys;

decrypting the set of encrypted file manifests using the set of file manifest keys, wherein each decrypted file manifest includes a set of encryption keys and a corresponding set of chunk identifiers of a file, wherein the file was encrypted in a user agnostic manner to allow encrypted file chunks to be deduplicated across multiple users at the cloud storage system; and

adding the decrypted file system manifest to a user manifest of the user.

98. The at least one non-transitory machine-readable storage medium of claim 34, wherein the at least one non-transitory machine-readable storage medium further provides instructions that, if executed by the processor of the client device, will cause said processor to perform the following operations:

encrypting the user manifest with a key specific to the user; and

transmitting the encrypted user manifest to the cloud storage system.

99. The at least one non-transitory machine-readable storage medium of claim 34, wherein the decrypted file system manifest is associated with metadata that indicates a mount point for that file system manifest.

103. The at least one non-transitory machine-readable storage medium of claim 34, wherein the file system manifest key is a universally unique identifier to the cloud storage system.

104. The at least one non-transitory machine-readable storage medium of claim 34, wherein the file system manifest key is provided by the another user, and wherein the file system manifest key is received from the another user.

35. A client device configured to provide a user with access to a cloud file system that resides, at least partially, in a cloud storage system, the client device comprising:

a processor to execute instructions, and

at least one non-transitory machine-readable storage medium coupled with the processor, the medium storing one or more instructions that, when executed, cause the processor to perform operations comprising;

retrieving an encrypted file system manifest and file system manifest encryption key, wherein the encrypted file system manifest corresponds with a file system manifest that has been shared by another user;

decrypting the file system manifest using the file system manifest encryption key, wherein the decrypted file system manifest includes a listing of a set of one or more encrypted file manifests and a set of one or more file manifest keys;

decrypting the set of encrypted file manifests using the set of file manifest keys, wherein each decrypted file manifest includes a set of encryption keys and a corresponding set of chunk identifiers of a file, wherein the file was encrypted in a user agnostic manner to allow encrypted file chunks to be deduplicated across multiple users at the cloud storage system; and

adding the decrypted file system manifest to a user manifest of the user.

105. The client device of claim 35, wherein the at least one non-transitory machine-readable storage medium further stores instructions that, when executed by the processor, cause the processor to perform the following operations:

encrypting the user manifest with a key specific to the user; and

transmitting the encrypted user manifest to the cloud storage system.

106. The client device of claim 35, wherein the decrypted file system manifest is associated with metadata that indicates a mount point for that file system manifest.

107. The client device of claim 106, wherein adding the decrypted file system manifest to the user manifest of the user comprises:

responsive to determining that data currently resides at the location of the indicated mount point, mounting the decrypted file system manifest to a different location.

108. The client device of claim 107, wherein the different location is automatically selected by the cloud storage client.

109. The client device of claim 107, wherein the different location is chosen by the user of the client device.

110. The client device of claim 35, wherein the file system manifest key is a universally unique identifier to the cloud storage system.

111. The client device of claim 35, wherein the file system manifest key is provided by the another user, and wherein the file system manifest key is received from the another user.

36. A method for use of a cloud file system (CFS) on a client device, wherein the CFS resides, at least partially, in a cloud storage system remote from the client device, the method comprising:

allocating space, in a local storage system of the client device, for storing data to act as a local cache of the CFS,

receiving, in a file browser interface executing in the client device, a designation of a folder stored in the local file system to convert it and a plurality of files beneath it to the CFS, wherein the folder and the plurality of files are stored in the local storage system, and wherein the folder is identified at a location in the local file system,

converting the folder, including the plurality of files, from storage in the local storage system to storage in the cloud storage system of the CFS, wherein the plurality of files are stored in the cloud storage system using a plurality of encrypted file chunks encrypted in a user agnostic manner to allow the encrypted file chunks to be deduplicated across multiple users at the cloud storage system,

transmitting one or more of the plurality of encrypted file chunks to the cloud storage system, wherein the one or more of the plurality of encrypted file chunks are those of the plurality of encrypted file chunks that are not present in the cloud storage system,

storing a file system manifest in the local cache of the CFS, wherein the file system manifest identifies the folder and the plurality of files,

maintaining a representation of the folder at the location of the local file system such that each of the plurality of files may be accessed by a logical path at which that file was previously accessible,

removing the plurality of files from the location of the local file system, and

directing accesses to the folder to a CFS client module executing on the client device to provide access to each of the plurality of files now located in the cloud storage system via the logical path at which that file was previously accessible.

37. The method of claim 36, further comprising:

caching one or more of the plurality file chunks in the local cache of the CFS;

in response to receiving a request for access of one of the plurality of file chunks, performing the following;

retrieving that file chunk from the cloud storage system if that file chunk is not cached in the local cache of the CFS, and

predictively retrieving others of the plurality of file chunks from the cloud storage system that are not in the local cache of the CFS.

38. The method of claim 37, wherein the step of predictively retrieving others of the plurality of file chunks from the cloud storage system includes accessing the file system manifest to determine which chunks are located near the requested chunk and requesting from the cloud storage system at least some of those chunks.

39. The method of claim 37, wherein the step of predictively retrieving others of the plurality of file chunks from the cloud storage system includes using an analytical model that indicates a set of one or more chunks that will likely be accessed when the requested chunk is accessed, and requesting from the cloud storage system at least some of those set of chunks.

40. The method of claim 37, further comprising:

communicating prefetch commands to the cloud storage system identifying the others of the plurality of chunks.

41. The method of claim 37, further comprising:

receiving a request for an amount of space available in the folder stored in the cloud storage system; and

generating a value to present to the user as the amount of space available in the folder stored in the cloud storage system, the value being greater than an amount available on the local storage system.

42. The method of claim 41, wherein the value is a maximum value supported by that operating system for storage.

43. The method of claim 37, further comprising:

providing an interface to a user of the client device for setting the amount of space to act as the local cache in the CFS; and

receiving, via the interface for setting the amount of space to act as the local cache in the CFS, an indication of the amount of space to act as the local cache in the CFS.

44. The method of claim 37, further comprising:

providing an interface for converting the folder to the CFS that allows the user to drag and drop the folder to designate it as to be converted to the CFS.

45. The method of claim 37, wherein the designation of the folder is received via a selection in a context menu associated with the folder.

46. At least one non-transitory machine-readable storage medium that provides instructions that, if executed by a processor of a client device, will cause said processor to perform operations for use of a cloud file system (CFS) that resides, at least partially, in a cloud storage system remote from the client device, the operations comprising:

allocating space, in a local storage system of the client device, for storing data to act as a local cache of the CFS,

receiving, in a file browser interface executing in the client device, a designation of a folder stored in the local file system to convert it and a plurality of files beneath it to the CFS, wherein the folder and the plurality of files are stored in the local storage system, and wherein the folder is identified at a location in the local file system,

converting the folder, including the plurality of files, from storage in the local storage system to storage in the cloud storage system of the CFS, wherein the plurality of files are stored in the cloud storage system using a plurality of encrypted file chunks encrypted in a user agnostic manner to allow the encrypted file chunks to be deduplicated across multiple users at the cloud storage system,

transmitting one or more of the plurality of encrypted file chunks to the cloud storage system, wherein the one or more of the plurality of encrypted file chunks are those of the plurality of encrypted file chunks that are not present in the cloud storage system,

storing a file system manifest in the local cache of the CFS, wherein the file system manifest identifies the folder and the plurality of files,

maintaining a representation of the folder at the location of the local file system such that each of the plurality of files may be accessed by a logical path at which that file was previously accessible,

removing the plurality of files from the location of the local file system, and

directing accesses to the folder to a CFS client module executing on the client device to provide access to each of the plurality of files now located in the cloud storage system via the logical path at which that file was previously accessible.

112. The at least one non-transitory machine-readable storage medium of claim 46, wherein the at least one non-transitory machine-readable storage medium further provides instructions that, if executed by the processor of the client device, will cause said processor to perform the following operations:

caching one or more of the plurality file chunks in the local cache of the CFS;

in response to receiving a request for access of one of the plurality of file chunks, performing the following;

retrieving that file chunk from the cloud storage system if that file chunk is not cached in the local cache of the CFS, and

predictively retrieving others of the plurality of file chunks from the cloud storage system that are not in the local cache of the CFS.

113. The at least one non-transitory machine-readable storage medium of claim 112, wherein the step of predictively retrieving others of the plurality of file chunks from the cloud storage system includes accessing the file system manifest to determine which chunks are located near the requested chunk and requesting from the cloud storage system at least some of those chunks.

114. The at least one non-transitory machine-readable storage medium of claim 112, wherein the step of predictively retrieving others of the plurality of file chunks from the cloud storage system includes using an analytical model that indicates a set of one or more chunks that will likely be accessed when the requested chunk is accessed, and requesting from the cloud storage system at least some of those set of chunks.

115. The at least one non-transitory machine-readable storage medium of claim 112, wherein the at least one non-transitory machine-readable storage medium further provides instructions that, if executed by the processor of the client device, will cause said processor to perform the following operation:

communicating prefetch commands to the cloud storage system identifying the others of the plurality of chunks.

116. The at least one non-transitory machine-readable storage medium of claim 112, wherein the at least one non-transitory machine-readable storage medium further provides instructions that, if executed by the processor of the client device, will cause said processor to perform the following operations:

receiving a request for an amount of space available in the folder stored in the cloud storage system; and

generating a value to present to the user as the amount of space available in the folder stored in the cloud storage system, the value being greater than an amount available on the local storage system.

117. The at least one non-transitory machine-readable storage medium of claim 116, wherein the value is a maximum value supported by that operating system for storage.

118. The at least one non-transitory machine-readable storage medium of claim 112, wherein the at least one non-transitory machine-readable storage medium further provides instructions that, if executed by the processor of the client device, will cause said processor to perform the following operations:

providing an interface to a user of the client device for setting the amount of space to act as the local cache in the CFS; and

receiving, via the interface for setting the amount of space to act as the local cache in the CFS, an indication of the amount of space to act as the local cache in the CFS.

119. The at least one non-transitory machine-readable storage medium of claim 112, wherein the at least one non-transitory machine-readable storage medium further provides instructions that, if executed by the processor of the client device, will cause said processor to perform the following operation:

providing an interface for converting the folder to the CFS that allows the user to drag and drop the folder to designate it as to be converted to the CFS.

120. The at least one non-transitory machine-readable storage medium of claim 112, wherein the designation of the folder is received via a selection in a context menu associated with the folder.

47. A client device configured to use a cloud file system (CFS) that resides, at least partially, in a cloud storage system remote from the client device, the client device comprising:

a processor to execute instructions, and

at least one non-transitory machine-readable storage medium coupled with the processor, the medium storing one or more instructions that, when executed, cause the processor to perform operations comprising;

allocating space, in a local storage system of the client device, for storing data to act as a local cache of the CFS,

receiving, in a file browser interface executing in the client device, a designation of a folder stored in the local file system to convert it and a plurality of files beneath it to the CFS, wherein the folder and the plurality of files are stored in the local storage system, and wherein the folder is identified at a location in the local file system,

converting the folder, including the plurality of files, from storage in the local storage system to storage in the cloud storage system of the CFS, wherein the plurality of files are stored in the cloud storage system using a plurality of encrypted file chunks encrypted in a user agnostic manner to allow the encrypted file chunks to be deduplicated across multiple users at the cloud storage system,

transmitting one or more of the plurality of encrypted file chunks to the cloud storage system, wherein the one or more of the plurality of encrypted file chunks are those of the plurality of encrypted file chunks that are not present in the cloud storage system,

storing a file system manifest in the local cache of the CFS, wherein the file system manifest identifies the folder and the plurality of files,

maintaining a representation of the folder at the location of the local file system such that each of the plurality of files may be accessed by a logical path at which that file was previously accessible,

removing the plurality of files from the location of the local file system, and

directing accesses to the folder to a CFS client module executing on the client device to provide access to each of the plurality of files now located in the cloud storage system via the logical path at which that file was previously accessible.

121. The client device of claim 47, wherein the at least one non-transitory machine-readable storage medium further stores one or more instructions that, when executed, cause the processor to perform operations comprising:

caching one or more of the plurality file chunks in the local cache of the CFS;

in response to receiving a request for access of one of the plurality of file chunks, performing the following;

retrieving that file chunk from the cloud storage system if that file chunk is not cached in the local cache of the CFS, and

predictively retrieving others of the plurality of file chunks from the cloud storage system that are not in the local cache of the CFS.

122. The client device of claim 121, wherein the step of predictively retrieving others of the plurality of file chunks from the cloud storage system includes accessing the file system manifest to determine which chunks are located near the requested chunk and requesting from the cloud storage system at least some of those chunks.

123. The client device of claim 121, wherein the step of predictively retrieving others of the plurality of file chunks from the cloud storage system includes using an analytical model that indicates a set of one or more chunks that will likely be accessed when the requested chunk is accessed, and requesting from the cloud storage system at least some of those set of chunks.

124. The client device of claim 121, wherein the at least one non-transitory machine-readable storage medium further stores one or more instructions that, when executed, cause the processor to perform the following operation:

communicating prefetch commands to the cloud storage system identifying the others of the plurality of chunks.

125. The client device of claim 121, wherein the at least one non-transitory machine-readable storage medium further stores one or more instructions that, when executed, cause the processor to perform operations comprising:

receiving a request for an amount of space available in the folder stored in the cloud storage system; and

generating a value to present to the user as the amount of space available in the folder stored in the cloud storage system, the value being greater than an amount available on the local storage system.

126. The client device of claim 125, wherein the value is a maximum value supported by that operating system for storage.

127. The client device of claim 121, wherein the at least one non-transitory machine-readable storage medium further stores one or more instructions that, when executed, cause the processor to perform operations comprising:

providing an interface to a user of the client device for setting the amount of space to act as the local cache in the CFS; and

receiving, via the interface for setting the amount of space to act as the local cache in the CFS, an indication of the amount of space to act as the local cache in the CFS.

128. The client device of claim 121, wherein the at least one non-transitory machine-readable storage medium further stores one or more instructions that, when executed, cause the processor to perform the following operation:

providing an interface for converting the folder to the CFS that allows the user to drag and drop the folder to designate it as to be converted to the CFS.

129. The client device of claim 121, wherein the designation of the folder is received via a selection in a context menu associated with the folder.

48. A method in a cloud storage system that includes a cloud storage gateway and a set of one or more cloud storage pools, the cloud storage system providing at least part of a cloud file system for a plurality of client devices, the method comprising:

storing in a user agnostic deduplicated manner, a plurality of encrypted file chunks and a plurality of file chunk identifiers, wherein each of the encrypted file chunks is deduplicated in a user agnostic manner such that the presence of identical unencrypted file chunks is recognized through identical file chunk identifiers;

responding to retrieval requests from one of the plurality of client devices by transmitting one or more of the plurality of encrypted file chunks identified in the retrieval requests; and

responding to prefetch commands from the one of the plurality of client devices by, at least temporarily, storing encrypted file chunks in a remote cache of the cloud file system at the cloud storage gateway, wherein the cloud storage gateway is closer to the one of the plurality of client devices than the set of cloud storage pools.

49. The method of claim 48, wherein the set of cloud storage pools include a plurality of cloud storage pools that are geographically distributed, and wherein the cloud storage gateway responds to retrieval requests that include an indication of region by directing those requests to the one of the cloud storage pool corresponding to that geographic region.

50. The method of claim 48, further comprising:

providing a web file access portal for allowing a user to access one or more of the plurality of files stored in the cloud storage system;

receiving, via the web file access portal, the user'"'"'s encryption information;

accessing the user'"'"'s cloud file systems utilizing the user'"'"'s encryption information;

presenting, via the web file access portal, a listing of files available in the user'"'"'s cloud file systems;

receiving, via the web file access portal, a request from the user to access a file in the listing of files;

generating a decrypted copy of the file; and

transmitting the decrypted copy of the file to the user.

51. The method of claim 50, wherein the web file access portal generates the decrypted copy of the file by performing the following:

retrieving a set of one or encrypted file chunk identifiers corresponding to a set of one or more encrypted file chunks that make up the file;

retrieving a set of one or more encryption keys corresponding to the set of one or more encrypted file chunks;

retrieving the set of one or more encrypted file chunks; and

decrypting each of the set of one or more encrypted file chunks with a corresponding one of the one or more encryption keys.

52. At least one non-transitory machine-readable storage medium that provides instructions that, if executed by a processor of a cloud storage system that includes a cloud storage gateway and a set of one or more cloud storage pools, will cause said processor to perform operations comprising:

storing in a user agnostic deduplicated manner, a plurality of encrypted file chunks and a plurality of file chunk identifiers, wherein each of the encrypted file chunks is deduplicated in a user agnostic manner such that the presence of identical unencrypted file chunks is recognized through identical file chunk identifiers;

responding to retrieval requests from one of a plurality of client devices by transmitting one or more of the plurality of encrypted file chunks identified in the retrieval requests; and

responding to prefetch commands from the one of the plurality of client devices by, at least temporarily, storing encrypted file chunks in a remote cache of a cloud file system at the cloud storage gateway, wherein the cloud storage gateway is closer to the one of the plurality of client devices than the set of cloud storage pools.

130. The at least one non-transitory machine-readable storage medium of claim 52, wherein the set of cloud storage pools include a plurality of cloud storage pools that are geographically distributed, and wherein the cloud storage gateway responds to retrieval requests that include an indication of region by directing those requests to the one of the cloud storage pool corresponding to that geographic region.

131. The at least one non-transitory machine-readable storage medium of claim 52, wherein the at least one non-transitory machine-readable storage medium further stores one or more instructions that, when executed, cause the processor to perform operations comprising:

providing a web file access portal for allowing a user to access one or more of the plurality of files stored in the cloud storage system;

receiving, via the web file access portal, the user'"'"'s encryption information;

accessing the user'"'"'s cloud file systems utilizing the user'"'"'s encryption information;

presenting, via the web file access portal, a listing of files available in the user'"'"'s cloud file systems;

receiving, via the web file access portal, a request from the user to access a file in the listing of files;

generating a decrypted copy of the file; and

transmitting the decrypted copy of the file to the user.

132. The at least one non-transitory machine-readable storage medium of claim 131, wherein the at least one non-transitory machine-readable storage medium further stores one or more instructions that, when executed, cause the processor to perform operations comprising:

retrieving a set of one or encrypted file chunk identifiers corresponding to a set of one or more encrypted file chunks that make up the file;

retrieving a set of one or more encryption keys corresponding to the set of one or more encrypted file chunks;

retrieving the set of one or more encrypted file chunks; and

decrypting each of the set of one or more encrypted file chunks with a corresponding one of the one or more encryption keys.

53. A cloud storage system that provides access to a plurality of files stored in the cloud storage system as part of a plurality of cloud file systems (CFSs), wherein the cloud storage system comprises:

a cloud storage gateway configured to perform the following;

receive data corresponding to CFS to store in the cloud storage system,

respond to prefetch commands from a client device by, at least, temporarily storing one or more encrypted file chunks in a cache of the cloud storage gateway to reduce latency in responding to retrieval requests for those encrypted file chunks identified in the prefetch commands, and

respond to retrieval requests from a client device by transmitting one or more encrypted files chunks identified in each retrieval requests; and

a cloud storage pool configured to store the plurality of encrypted file chunks and a corresponding plurality of chunk identifiers, wherein each encrypted file chunk includes at least a portion of one or more of the plurality of files stored in the cloud storage system, wherein each of the plurality of encrypted file chunks is deduplicated in a user agnostic manner such the presence of identical unencrypted file chunks is recognized through identical file chunk identifiers, and wherein the cloud storage pool is further configured to retrieve each of the plurality of encrypted file chunks and transmit each of the plurality of encrypted file chunks to the cloud storage gateway.

54. The cloud storage system of claim 53, further comprising:

wherein the cloud storage gateway is further configured to receive the data corresponding to the CFS to store in the cloud storage system by receiving one or more file system manifests each corresponding to a CFS, wherein the file system manifest is to comprise a listing of a plurality of files in the CFS along with information to identify a file manifest for each of the plurality of files;

wherein the cloud storage gateway is further configured to receive one or more file manifests each to correspond to a file in the plurality of files and each to include information to identify a set of one or more encrypted file chunks that make up the corresponding file along with encryption information to be used to decrypted the corresponding file, wherein the cloud storage gateway is further configured to receive a plurality of encrypted file chunks corresponding to one or more of the plurality of files.

55. The cloud storage system of claim 53, further comprising:

a web file access portal configured to provide an interface to a user for accessing one or more of the plurality of files stored in the cloud storage system by retrieving the user'"'"'s encryption information, accessing the user'"'"'s cloud file systems utilizing the user'"'"'s encryption information, presenting a listing of files available in the user'"'"'s cloud file systems, receiving a request from the user to access a file in the listing of files, generating a decrypted copy of the file, and presenting the decrypted copy of the file to the user.

56. The cloud storage system of claim 55, wherein the web file access portal is further configured to generate the decrypted copy of the file by retrieving a set of one or encrypted file chunk identifiers corresponding to a set of one or more encrypted file chunks that make up the file, retrieving a set of one or more encryption keys corresponding to the set of one or more encrypted file chunks, retrieving the set of one or more encrypted file chunks, and decrypting each of the set of one or more encrypted file chunks with a corresponding one of the one or more encryption keys.

57. A method for a content provider to distribute content to subscribers that are users of a cloud storage system, wherein the cloud storage system is coupled via a wide area network to a plurality of computing devices acting as client devices of the cloud storage system, the method comprising:

generating for each of the subscribers, by a computing device of the content provider, a cloud file system (CFS) containing their content, wherein the cloud storage system acts as a primary storage of data for the cloud file systems (CFSs), wherein each of the plurality of computing devices is configured to run a cloud file system (CFS) module that manages a local cache of the CFSs utilized by that client device, wherein files of the CFSs are encrypted using user agnostic encryption such that two files with the same data encrypted by different users will produce files with identical encrypted data, wherein the user agnostic file encryption requires for a CFS;

for each file to the CFS performing the following;

splitting the file into chunks,

generating an encryption key for each chunk from the data within that chunk,

encrypting each chunk with its the respective encryption key,

generating a chunk identifier for each chunk, and

generating a file manifest for each file, wherein the file manifest for each file includes the chunk identifiers and decryption keys for each of the encrypted chunks of the file,

generating an encryption key for each the file manifest from the data within that file manifest,

generating a file manifest identifier for each the file manifest,

encrypting the file manifest with the encryption key generated for the file manifest;

uploading any of the encrypted chunks and the encrypted file manifest not already stored in the cloud storage system;

generating a file system manifest with the file manifest identifiers and the encryption keys generated for the file manifest; and

encrypting the file system manifest with an encryption key; and

sharing the CFSs with the respective users.

58. The method of claim 57, wherein each of the CFSs generated by the content provider all contain the same content and the content provide only uploads the content one time to the cloud storage system.

59. The method of claim 57, wherein the sharing includes transmitting to each user their respective one of the encrypted file system manifests and the encryption key used to encrypt that file system manifest.

60. The method of claim 57, wherein the sharing includes:

uploading the encrypted file system manifests to the cloud storage system; and

sharing with each user their respective one of the identifiers for their encrypted file system manifest and the encryption key used to encrypt that file system manifest.

61. At least one non-transitory machine-readable storage medium that provides instructions that, if executed by a processor of a cloud storage system, will cause said processor to perform operations for distributing content to subscribers that are users of the cloud storage system, wherein the cloud storage system is coupled via a wide area network to a plurality of computing devices acting as client devices of the cloud storage system, the operations comprising:

generating for each of the subscribers, by a computing device of the content provider, a cloud file system (CFS) containing their content, wherein the cloud storage system acts as a primary storage of data for the cloud file systems (CFSs), wherein each of the plurality of computing devices is configured to run a cloud file system (CFS) module that manages a local cache of the CFSs utilized by that client device, wherein files of the CFSs are encrypted using user agnostic encryption such that two files with the same data encrypted by different users will produce files with identical encrypted data, wherein the user agnostic file encryption requires for a CFS;

for each file to the CFS performing the following;

splitting the file into chunks,

generating an encryption key for each chunk from the data within that chunk,

encrypting each chunk with its the respective encryption key,

generating a chunk identifier for each chunk, and

generating a file manifest for each file, wherein the file manifest for each file includes the chunk identifiers and decryption keys for each of the encrypted chunks of the file,

generating an encryption key for each the file manifest from the data within that file manifest,

generating a file manifest identifier for each the file manifest,

encrypting the file manifest with the encryption key generated for the file manifest;

uploading any of the encrypted chunks and the encrypted file manifest not already stored in the cloud storage system;

generating a file system manifest with the file manifest identifiers and the encryption keys generated for the file manifest; and

encrypting the file system manifest with an encryption key; and

sharing the CFSs with the respective users.

133. The at least one non-transitory machine-readable storage medium of claim 61, wherein each of the CFSs generated by the content provider all contain the same content and the content provide only uploads the content one time to the cloud storage system.

134. The at least one non-transitory machine-readable storage medium of claim 61, wherein the sharing includes transmitting to each user their respective one of the encrypted file system manifests and the encryption key used to encrypt that file system manifest.

135. The at least one non-transitory machine-readable storage medium of claim 61, wherein the sharing includes:

uploading the encrypted file system manifests to the cloud storage system; and

sharing with each user their respective one of the identifiers for their encrypted file system manifest and the encryption key used to encrypt that file system manifest.

62. A cloud storage system comprising:

a processor to execute instructions, and

at least one non-transitory machine-readable storage medium coupled with the processor, the medium storing one or more instructions that, when executed, cause the processor to perform operations for distributing content to subscribers that are users of the cloud storage system, wherein the cloud storage system is coupled via a wide area network to a plurality of computing devices acting as client devices of the cloud storage system, the operations comprising;

generating for each of the subscribers, by a computing device of the content provider, a cloud file system (CFS) containing their content, wherein the cloud storage system acts as a primary storage of data for the cloud file systems (CFSs), wherein each of the plurality of computing devices is configured to run a cloud file system (CFS) module that manages a local cache of the CFSs utilized by that client device, wherein files of the CFSs are encrypted using user agnostic encryption such that two files with the same data encrypted by different users will produce files with identical encrypted data, wherein the user agnostic file encryption requires for a CFS;

for each file to the CFS performing the following;

splitting the file into chunks,

generating an encryption key for each chunk from the data within that chunk,

encrypting each chunk with its the respective encryption key,

generating a chunk identifier for each chunk, and

generating a file manifest for each file, wherein the file manifest for each file includes the chunk identifiers and decryption keys for each of the encrypted chunks of the file,

generating an encryption key for each the file manifest from the data within that file manifest,

generating a file manifest identifier for each the file manifest,

encrypting the file manifest with the encryption key generated for the file manifest;

uploading any of the encrypted chunks and the encrypted file manifest not already stored in the cloud storage system;

generating a file system manifest with the file manifest identifiers and the encryption keys generated for the file manifest; and

encrypting the file system manifest with an encryption key; and

sharing the CFSs with the respective users.

136. The cloud storage system of claim 62, wherein each of the CFSs generated by the content provider all contain the same content and the content provide only uploads the content one time to the cloud storage system.

137. The cloud storage system of claim 62, wherein the sharing includes transmitting to each user their respective one of the encrypted file system manifests and the encryption key used to encrypt that file system manifest.

138. The cloud storage system of claim 62, wherein the sharing includes:

uploading the encrypted file system manifests to the cloud storage system; and

sharing with each user their respective one of the identifiers for their encrypted file system manifest and the encryption key used to encrypt that file system manifest.

63. A cloud storage system coupled via a wide area network to a plurality of computing devices acting as client devices of the cloud storage system, each of the plurality of computing devices is configured to run a cloud file system (CFS) module that manages a local cache of the CFSs utilized by that client device, wherein the cloud storage system acts as a primary storage of data for the cloud file systems (CFSs), wherein the cloud storage system includes:

a cloud storage pool that stores CFSs generated by a content provider to distribute content to subscribers by generating the CFS containing their content and sharing the CFSs with the respective subscribers, for each of the CFSs;

an encrypted file system manifest;

a plurality of encrypted file manifests; and

a plurality of encrypted file chunks, wherein the encrypted file system manifest identifies each of the plurality of file manifest, and each of the file manifest represents one file of the CFS and identifiers those of the encrypted file chunks FSM that comprise that file, wherein the plurality of encrypted file manifests and encrypted file chunks were encrypted by the CFS modules using user agnostic encryption, wherein use agnostic encryption requires, an encryption key be generated from the data to be encrypted, that date to be encrypted by the generated key, and an identifier be generated for that data; and

a cloud storage gateway coupled to wide area network and the cloud storage pool to translate requests from the client devices to cloud storage system application programming interface (“

API”

) calls for the cloud storage pool.

64. The cloud storage system of claim 63, wherein the cloud storage gateway is configured to respond to prefetch commands from the CFS modules that instruct the cloud storage gateway to move from the cloud storage pool into a remote cache in the cloud storage gateway the encrypted file chunk chunks identified by the prefetch commands.

65. The cloud storage system of claim 63, wherein the CFSs generated by the content provider each contain the same content and that content was only uploaded one time.

100. The at least one non-transitory machine-readable storage medium of claim 100, wherein adding the decrypted file system manifest to the user manifest of the user comprises:

responsive to determining that data currently resides at the location of the indicated mount point, mounting the decrypted file system manifest to a different location.

101. The at least one non-transitory machine-readable storage medium of claim 101, wherein the different location is automatically selected by the cloud storage client.

102. The at least one non-transitory machine-readable storage medium of claim 101, wherein the different location is chosen by the user of the client device.

139. A method for providing cloud storage, the method comprising:

storing, in a cloud storage system, user-agnostic encrypted user data of a plurality of files of a plurality of cloud file systems of a plurality of client devices of a plurality of users that has been deduplicated across the users, wherein the user-agnostic encrypted data was generated using the same user agnostic encryption function such that the same data encrypted for different ones of the users will produce identical encrypted data, wherein the user-agnostic encrypted data of each of the files of the cloud file systems of the client devices of the users includes one or more encrypted keys to decrypt that user-agnostic encrypted data, those one or more encrypted keys being encrypted with an encryption key unique to that user;

wherein each of the cloud file systems stored by the cloud storage system includes a path at which each file should be displayed by the corresponding client device, wherein each client device includes a root file system that comprises a file system hierarchy for accessing files and folders on the client device, wherein each cloud file system is mounted as one of a drive and a folder at a mount point in the folder hierarchy of the client device'"'"'s storage system, wherein the cloud storage system acts as a primary storage of data for the cloud file systems,

wherein the cloud storage system has substantially larger capacity than the client devices,

wherein the amount of storage space available to the users is based on the amount of storage in the cloud storage system, and

wherein folders in the cloud file systems of the respective client device are represented to the operating system of each to the respective client devices as having as an amount of free space the largest value available to the operating system to display.

140. The method of claim 139, wherein the user agnostic encryption function includes performing the following on data that is being encrypted:

generating a user agnostic encryption key from the data such that the user agnostic encryption key for that data will be the same regardless of the user that data belongs,

encrypting the data with the generated user agnostic encryption key, and

generating an identifier (ID) for the encrypted data such that the ID will be the same regardless of the user that encrypted data belongs.

141. The method of claim 139, wherein the cloud storage system stores as part of the cloud file systems file manifests and file system manifests, wherein each of the file manifests is based on the content of a file that file manifest represents and not the name or location of the file such that two users could have the same files with different names and/or locations in their corresponding file system manifest but resolve to the same file manifest.

142. The method of claim 139, wherein among the file system entries of each of the root file systems is an entry for the mounted cloud file system, wherein the cloud storage system stores a file system manifest for each such mounted cloud file system, wherein each file system manifest identifies files and folders in the mounted cloud file system along with information used to access those files, such as the file manifests corresponding with each file stored in that mounted cloud file system.

143. The method of claim 139, wherein the cloud storage system stores for each cloud file system a manifest encrypted with one of a user'"'"'s user specific key and a user'"'"'s user specific password, wherein these different manifests identify directly or indirectly the user-agnostic encrypted files of the different cloud file systems.

144. The method of claim 143, further comprising:

performing server based data decryption and access responsive to one of the users entering their user specific password into a secure web form provided by a web file access portal, wherein the server decrypts the required data from the cloud storage system on the fly to display during a web session, wherein the web file access portal acts as a pass through buffer, and does not maintain an unencrypted local cache of the cloud storage system.

145. The method of claim 139, wherein cloud storage system includes a cloud storage gateway and a cloud storage pool, the method further comprising:

receiving from one of the client devices an instruction to prefetch encrypted data from the cloud storage pool to a remote cache in the cloud storage gateway.

146. The method of claim 139, wherein each of the client devices presents the contents of its cloud file system to the respective user as if the cloud file system is a local device.

147. An apparatus, comprising:

a cloud storage system that provides a plurality of users online storage and retrieval of their data, wherein the amount of storage space available to the users is based on the amount of storage of the cloud storage system, and wherein the cloud storage system is configured to perform the following;

store encrypted user data of the plurality of users in a user agnostic deduplicated manner, wherein the user data is encrypted using a same user agnostic encryption function such that the same data of different users produces identical encrypted data,

store, for each of the users, one or more encrypted keys to decrypt the encrypted user data of at least that user, wherein the one or more encrypted keys to decrypt the encrypted user data of that user have been encrypted with an encryption key that is unique to that user, and wherein each piece of encrypted user data and the one or more encrypted keys to decrypt that piece of user data are stored in association with an identifier that has been generated such that the identifier would be the same regardless of which user that piece of encrypted user data belongs;

receive requests for different pieces of the stored encrypted user data from client devices of the users, wherein each request indicates an identifier for a piece of the stored encrypted user data; and

in response to receipt of each of the requests, access the stored encrypted user data that corresponds to the identifier indicated in that request, and transmit the accessed stored encrypted user data to that client device.

148. The apparatus of claim 147, wherein the store encrypted user data of at least one of the plurality of users is not permanently stored in a location other than the cloud storage system.

149. The apparatus of claim 147, wherein the user agnostic encryption function is further configured to perform, for each piece of user data that is to be stored in the cloud storage system, the following:

generate an encryption key from that piece of user data such that the encryption key for that piece of user data will be the same regardless of the user that data belongs; and

encrypt that piece of user data with the generated encryption key.

150. The apparatus of claim 147, wherein the encrypted user data to be stored by the cloud storage system includes, for each of the plurality of users, one or more file manifests that each include a list of one or more identifiers for one or more pieces of the stored encrypted user data.

151. The apparatus of claim 150, wherein encrypted user data to be stored by the cloud storage system further includes for each of the plurality of users, one or more file system manifests that each include a list of one or more files that are encrypted and stored on the cloud storage system.

152. The apparatus of claim 151, wherein the encrypted user data to be stored by the cloud storage system further includes for each of the plurality of users, a user manifest that includes a list of the one or more file system manifests of that user.

153. The apparatus of claim 147, further comprising:

a web file access portal that is configured to provide the users access to their encrypted user data stored on the cloud storage system responsive to entering their user specific password into a secure web form provided by the web file access portal, wherein the web file access portal is configured to, upon receipt of a user specific password from a user, perform the following;

request and receive from the cloud storage system an encrypted user manifest belonging to the user;

decrypt the encrypted user manifest using the received user specific password, wherein a list of one or more files belonging to the user that are stored in the cloud storage system is derived from the user manifest; and

present a user interface that allows the user to explore the one or more files that are stored in the cloud storage system.

154. The apparatus of claim 153, wherein the web file access portal does not maintain an unencrypted local cache of the cloud storage system.

155. A method in a client device, comprising:

encrypting data of a file of a user of the client device with a user agnostic file encryption function, wherein the user agnostic file encryption function performs the following;

generating a user agnostic encryption key from the data;

encrypting the data with the encryption key; and

generating an identifier (ID) for the encrypted data based on the encrypted data;

encrypting the generated user agnostic encryption key with an encryption key that is unique to the user of the client device;

transmitting the encrypted data, the encrypted user agnostic encryption key, and the identifier to a cloud storage system that is to store the encrypted data in a user-agnostic deduplicated manner such that the encrypted data is deduplicated across a plurality of users;

receiving an instruction from an operating system of the client device to read the file that corresponds with the encrypted data;

transmitting a request for the encrypted data to the cloud storage system, wherein the request indicates the identifier for the encrypted data;

receiving the encrypted data and the encrypted user agnostic encryption key from the cloud storage system;

decrypting the encrypted user agnostic encryption key using the encryption key that is unique to the user of the client device; and

decrypting the received encrypted data using the decrypted user agnostic encryption key.

156. The method of claim 155, wherein the data for the file is one of a plurality of chunks of the file, and wherein the user agnostic file encryption function is performed on each of the plurality of chunks.

157. The method of claim 156, further comprising:

including the user agnostic encryption key for each chunk of the file and the identifier for that chunk of the file in a file manifest;

generating a file manifest encryption key based on the data within the file manifest;

encrypting the file manifest using the file manifest encryption key; and

generating a file manifest identifier based on data within the encrypted file manifest.

158. The method of claim 157, further comprising:

including the file manifest encryption key and the file manifest identifier in a file system manifest that includes a listing of the file manifest and one or more other file manifests belonging to different files of the user; and

encrypting the file system manifest with the encryption key that is unique to the user of the client device.