Secure distributed backup for personal device and cloud data

• US 20160196218A1
• Filed: 12/23/2015
• Published: 07/07/2016
• Est. Priority Date: 01/03/2015
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Kumar, Mitesh, Gadde, Kranthikumar, Dhruw, Kaushal Kumar, Venkatasubrahmanyam, Krishnapur, Nayak, Susmital, Nalluri, Srikanth, Kulkarni, Dattatraya, Halder, Kamlesh
• Granted Patent: US 10,198,589 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/1448 Management of the data involved in backup or backup restore
• CPC Class Codes: G06F 11/1456 Hardware arrangements for backup
• CPC Class Codes: G06F 11/1464 for networked environments
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]

Abstract

Securely distributing a backup file includes identifying a file to be stored, generating a plurality of file chunks from the file, transmitting from a first device, each of the plurality of file chunks to one of a plurality of storage locations, and generating, at the first device, a map that identifies the storage location for each chunk. Retrieving a distributed backup file includes receiving a request to retrieve a file, obtaining a map corresponding to the file, wherein the map identifies a storage location for each of a plurality of file chunks of the file, retrieving the plurality of file chunks from the identified locations, and generating the requested file by combining the plurality of file chunks.

Claims

1. A machine readable medium on which instructions are stored, comprising instructions that when executed cause a machine to:

identify a file to be stored;

instruct a hardware module to generate a plurality of file chunks from the file, wherein one or more of the plurality of file chunks are encrypted;

transmit, from a first device, each of the plurality of file chunks to one of a plurality of independent storage systems; and

generate, at the first device, a map that identifies a storage location for each chunk.

2. The machine readable medium of claim 1, wherein the hardware module comprises a secure memory.

3. The machine readable medium of claim 1, wherein the plurality of independent storage systems comprise a local device.

4. The machine readable medium of claim 1, further comprising instructions that when executed cause the machine to:

store encryption data for each encrypted file chunk in the map.

5. The machine readable medium of claim 1, wherein the plurality of file chunks comprises a first encrypted file chunk and a second encrypted file chunk, wherein the first encrypted file chunk is encrypted by a first encryption method, and wherein the second encrypted file chunk is encrypted by a second encryption method.

6. The machine readable medium of claim 1, wherein the plurality of file chunks comprises a first file chunk and a second file chunk, and wherein the first file chunk and the second file chunk are of different sizes.

7. A system for storing data, comprising:

a computer processor; and

a storage device coupled to the computer processor comprising instructions which, when executed by the computer processor cause the system to;

identify a file to be stored;

instruct a hardware module to generate a plurality of file chunks from the file, wherein one or more of the plurality of file chunks are encrypted;

transmit, from a first device, each of the plurality of file chunks to one of a plurality of independent storage systems; and

generate, at the first device, a map that identifies the storage location for each chunk.

8. The system of claim 7, wherein the hardware module comprises a secure memory.

9. The system of claim 7, wherein the plurality of independent storage systems comprise a local device.

10. The system of claim 7, the storage device further comprising instructions that when executed cause a machine to:

store encryption data for each encrypted file chunk in the map.

11. The system of claim 7, wherein the plurality of file chunks comprises a first encrypted file chunk and a second encrypted file chunk, wherein the first encrypted file chunk is encrypted by a first encryption method, and wherein the second encrypted file chunk is encrypted by a second encryption method.

12. The system of claim 7, wherein the plurality of file chunks comprises a first file chunk and a second file chunk, and wherein the first file chunk and the second file chunk are of different sizes.

13. A method for storing data, comprising:

receiving a file to be stored from a remote device;

instructing a hardware module to generate a plurality of file chunks from the file, wherein one or more of the plurality of file chunks are encrypted;

transmitting, from a local device, each of the plurality of file chunks to one of a plurality of independent storage systems; and

generating, at the local device, a map that identifies the storage location for each chunk.

14. The method of claim 13, further comprising:

sending the map to the remote device.

15. The method of claim 13, further comprising:

receiving a request for the file from the remote device;

obtaining the map corresponding to the file;

retrieving the plurality of file chunks from the identified plurality of independent storage systems;

determining that at least one of the plurality of file chunks is an encrypted file chunk;

decrypting the encrypted file chunk;

generating the requested file by combining the plurality of file chunks; and

transmitting the requested file to the remote device.

16. The method of claim 13, wherein the hardware module is a secure storage.

17. The method of claim 13, wherein the plurality of file chunks comprises a first encrypted file chunk and a second encrypted file chunk, wherein the first encrypted file chunk is encrypted by a first encryption method, and wherein the second encrypted file chunk is encrypted by a second encryption method.

18. The method of claim 13, wherein the plurality of file chunks comprises a first file chunk and a second file chunk, and wherein the first file chunk and the second file chunk are of different sizes.

19. A machine readable medium on which instructions are stored, comprising instructions that when executed cause a machine to:

receive a request to retrieve a file;

obtain a map corresponding to the file, wherein the map identifies a plurality of independent storage systems corresponding to each of a plurality of file chunks of the file;

retrieve the plurality of file chunks from the identified plurality of independent storage systems;

determine that at least one of the plurality of file chunks is an encrypted file chunk;

decrypt the encrypted file chunk; and

instruct a hardware module to generate the requested file by combining the plurality of file chunks.

20. The machine readable medium of claim 19, wherein the hardware module is a secure memory.

21. The machine readable medium of claim 19, wherein at least one of the plurality of independent storage systems is a local device.

22. The machine readable medium of claim 19, wherein the instructions to decrypt the encrypted file chunk further comprises instructions that when executed cause the machine to:

retrieve encryption information for the encrypted file chunk from the map; and

decrypt the encrypted file chunk using the encryption information.

23. The machine readable medium of claim 19, wherein the plurality of file chunks comprises at least a first chunk and a second chunk of different sizes.

24. The machine readable medium of claim 19, wherein the plurality of file chunks comprises a first encrypted file chunk and a second encrypted file chunk, wherein the first encrypted file chunk is encrypted by a first encryption method, and wherein the second encrypted file chunk is encrypted by a second encryption method.

25. The machine readable medium of claim 19, wherein the instructions that when executed cause the machine to generate the file comprise instructions that when executed cause the machine to:

identify a chunking mechanism in the map; and

generate the file from the plurality of file chunks based on the chunking mechanism.