Crypto Proxy for Cloud Storage Services

• US 20140122866A1
• Filed: 10/31/2012
• Published: 05/01/2014
• Est. Priority Date: 10/31/2012
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.), Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: Haeger, Edward Scarlett, Cenname, Michael, Elliott, Steve, Skowronski, Andrew, Schurig, Karl
• Granted Patent: US 9,137,222 B2
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

In one embodiment, a proxy receives, from a client node, a file to be stored by a cloud storage server, where the proxy and the client node are part of a private network that does not include the cloud storage server. The proxy retrieves an encryption key associated with a user of the client node and encrypts the file using the encryption key. The proxy then transmits the encrypted file to the cloud storage server.

Claims

1. A computer implemented method comprising:

receiving, by a proxy from a client node, a file to be stored by a cloud storage server, the proxy and the client node being part of a private network that does not include the cloud storage server;

retrieving, by the proxy, an encryption key associated with a user of the client node;

encrypting, by the proxy, the file using the encryption key; and

transmitting, by the proxy, the encrypted file to the cloud storage server.

2. The method of claim 1 further comprising:

receiving, from the client node, a request to access the file;

in response to the request, retrieving the encrypted file from the cloud storage server;

retrieving a decryption key associated with the user;

decrypting the encrypted file using the decryption key; and

transmitting the decrypted file to the client node.

3. The method of claim 2 wherein the encryption key and the decryption key are maintained by the proxy.

4. The method of claim 2 wherein the encryption key and the decryption key are maintained by a server system that is separate from the proxy.

5. The method of claim 1 further comprising, prior to the encrypting:

determining a type of the file; and

based on the type, processing the file using one of a plurality of file services.

6. The method of claim 5 wherein processing the file comprises generating a thumbnail image of the file.

7. The method of claim 6 further comprising:

receiving, from the client node, a request to preview the file; and

in response to the request, transmitting the thumbnail image to the client node.

8. The method of claim 5 wherein the type of the file is a text document, and wherein processing the file comprises generating indexing information for searching the file.

9. The method of claim 8 further comprising:

receiving, from the client node, a search query;

in response to the search query, accessing the indexing information to determine whether the file satisfies the search query; and

if the file satisfies the search query, transmitting the file to the client node.

10. The method of claim 1 further comprising storing an copy of the file in a proxy cache.

11. The method of claim 10 further comprising:

receiving, from the client node, a request to access the file;

in response to the request, retrieving the copy of the file from the proxy cache; and

transmitting the copy of the file to the client node.

12. The method of claim 10 further comprising:

generating a public link for accessing the file, the public link including a unique file identifier and pointing to an address of the proxy.

13. The method of claim 12 further comprising:

receiving, from another client node, a request initiated via the public link; and

in response to the request, transmitting the copy of the file to said another client node.

14. The method of claim 1 wherein the proxy is a virtual machine executing on one or more physical computer systems.

15. A non-transitory machine readable storage medium embodying computer software, the computer software causing a computer to perform a method, the method comprising

receiving, from a client node, a file to be stored by a cloud storage server, the proxy and the client node being part of a private network that does not include the cloud storage server;

retrieving an encryption key associated with a user of the client node;

encrypting the file using the encryption key; and

transmitting the encrypted file to the cloud storage server.

16. The non-transitory computer readable storage medium of claim 15 wherein the method further comprises:

receiving, from the client node, a request to access the file;

in response to the request, retrieving the encrypted file from the cloud storage server;

retrieving a decryption key associated with the user;

decrypting the encrypted file using the decryption key; and

transmitting the file to the client node.

17. The non-transitory computer readable storage medium of claim 15 wherein the method further comprises:

determining a type of the file; and

processing the file based on the type prior to the encrypting using one of a plurality of file services.

18. An apparatus comprising:

a memory; and

one or more processors configured to;

receive, from a client node, a file to be stored by a cloud storage server, the apparatus and the client node being part of a private network that does not include the cloud storage server;

retrieve an encryption key associated with a user of the client node;

encrypt the file using the encryption key; and

transmit the encrypted file to the cloud storage server.

19. The apparatus of claim 18 wherein the processor is further configured to:

receive, from the client node, a request to access the file;

in response to the request, retrieve the encrypted file from the cloud storage server;

retrieve a decryption key associated with the user;

decrypt the encrypted file using the decryption key; and

transmit the file to the client node.

20. The apparatus of claim 18 wherein the processor is further configured to:

determine a type of the file; and

based on the type, process the file prior to the encrypting using one of a plurality of file services.