SECURE ENTERPRISE CDN FRAMEWORK

• US 20160335447A1
• Filed: 05/15/2015
• Published: 11/17/2016
• Est. Priority Date: 05/15/2015
• Status: Active Application

• Current Assignee: Alcatel-Lucent USA, Inc. (Nokia Corporation)
• Original Assignee: Alcatel-Lucent USA, Inc. (Nokia Corporation)
• Inventors: GUO, Katherine H., SABNANI, Krishan K
• Application Number:
  US14/713,525
• Publication Number:
  US 20160335447A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838

Abstract

Various embodiments relate to a method, network node, and non-transitory machine-readable storage medium including the following: providing access to an enterprise file system to end user devices via a virtual private network (VPN); encrypting at least a portion of an enterprise file system to produce an encrypted file system, wherein an encrypted file from the encrypted file system is capable of being decrypted using a decryption key; transmitting the encrypted file system to a content distribution network (CDN) server for storage and access, wherein the CDN server is located outside the VPN; and transmitting the decryption key to an end user device via the VPN.

Claims

1. A non-transitory machine-readable storage medium encoded with instructions for execution by an enterprise server, the non-transitory machine-readable storage medium comprising:

instructions for providing access to an enterprise file system to end user devices via a virtual private network (VPN);

instructions for encrypting at least a portion of an enterprise file system to produce an encrypted file system, wherein an encrypted file from the encrypted file system is capable of being decrypted using a decryption key;

instructions for transmitting the encrypted file system to a content distribution network (CDN) server for storage and access, wherein the CDN server is located outside the VPN; and

instructions for transmitting the decryption key to an end user device via the VPN.

2. The non-transitory machine-readable storage medium of claim 1, further comprising:

instructions for periodically executing the instructions for encrypting and the instructions for transmitting the encrypted file system, whereby the decryption key changes periodically.

3. The non-transitory machine-readable storage medium of claim 1, further comprising:

instructions for applying a filename transformation to at least one of the enterprise file system and the encrypted file system, wherein at least one file in the encrypted file system has a file name that is different from a file name of a corresponding file in the enterprise file system.

4. The non-transitory machine-readable storage medium of claim 3, further comprising instructions for transmitting an identification of the filename transformation to the end user device via the VPN.

5. The non-transitory machine-readable storage medium of claim 1, further comprising:

instructions for segmenting at least one of a file of the enterprise file system and an encrypted file of the encrypted file system into a plurality of data blocks.

6. The non-transitory machine-readable storage medium of claim 1, wherein the instructions for transmitting the encrypted file system comprise instructions for transmitting a plurality of encrypted data blocks to the CDN server, the non-transitory machine-readable storage medium further comprising:

instructions for generating at least one file map for a file of the encrypted file system, wherein the file map identifies a sequence of blocks from the plurality of encrypted data blocks; and

instructions for transmitting the at least one file map to the end user device via the VPN.

7. The non-transitory machine-readable storage medium of claim 6, wherein the file map identifies a sequence of blocks by specifying a list of block identifiers;

and the instructions for encrypting at least a portion of an enterprise file system comprise;

instructions for generating the plurality of encrypted blocks, comprising;

instructions for segmenting at least one file of the enterprise file system into multiple data blocks; and

instructions for generating multiple block identifiers by applying a hash function to the multiple data blocks respectively, whereby the multiple block identifiers are used by a file map to identify the multiple blocks as being associated with the at least one file.

8. An enterprise server comprising:

a network interface capable of communication over an open network and over a virtual private network (VPN);

a memory; and

a processor in communication with the network interface and the memory, the processor configured to;

encrypt at least a portion of an enterprise file system accessible to the enterprise server to produce an encrypted file system, wherein an encrypted file from the encrypted file system is capable of being decrypted using a decryption key;

transmit the encrypted file system to a content distribution network (CDN) server for storage and access, wherein the CDN server is located outside the VPN; and

transmit the decryption key to an end user device via the VPN.

9. The enterprise server of claim 8, wherein the processor is further configured to:

periodically perform the steps of encrypting and transmitting the encrypted file system, whereby the decryption key changes periodically.

10. The enterprise server of claim 8, wherein the processor is further configured to:

apply a filename transformation to at least one of the enterprise file system and the encrypted file system, wherein at least one file in the encrypted file system has a file name that is different from a file name of a corresponding file in the enterprise file system.

11. The enterprise server of claim 10, wherein the processor is further configured to transmit an identification of the filename transformation to the end user device via the VPN.

12. The non-enterprise server of claim 8, wherein the processor is further configured to:

segment at least one of a file of the enterprise file system and an encrypted file of the encrypted file system into a plurality of data blocks.

13. The enterprise server of claim 8, wherein, in transmitting the encrypted file system comprise instructions for transmitting a plurality of encrypted data blocks to the CDN server, the processor is configured to:

generate at least one file map for a file of the encrypted file system, wherein the file map identifies a sequence of blocks from the plurality of encrypted data blocks; and

transmit the at least one file map to the end user device via the VPN.

14. The enterprise server of claim 13, wherein the file map identifies a sequence of blocks by specifying a list of block identifiers;

and in encrypting at least a portion of an enterprise file system the processor is configured to;

generate the plurality of encrypted blocks, comprising;

segmenting at least one file of the enterprise file system into multiple data blocks; and

generating multiple block identifiers by applying a hash function to the multiple data blocks respectively, whereby the multiple block identifiers are used by a file map to identify the multiple blocks as being associated with the at least one file.

15. A method performed by an enterprise server, the method comprising:

providing access to an enterprise file system to end user devices via a virtual private network (VPN);

encrypting at least a portion of an enterprise file system to produce an encrypted file system, wherein an encrypted file from the encrypted file system is capable of being decrypted using a decryption key;

transmitting the encrypted file system to a content distribution network (CDN) server for storage and access, wherein the CDN server is located outside the VPN; and

transmitting the decryption key to an end user device via the VPN.

16. The method of claim 15, further comprising:

periodically executing the instructions for encrypting and the instructions for transmitting the encrypted file system, whereby the decryption key changes periodically.

17. The method of claim 15, further comprising:

instructions for applying a filename transformation to at least one of the enterprise file system and the encrypted file system, wherein at least one file in the encrypted file system has a file name that is different from a file name of a corresponding file in the enterprise file system.

18. The method of claim 15, further comprising:

segmenting at least one of a file of the enterprise file system and an encrypted file of the encrypted file system into a plurality of data blocks.

19. The method of claim 15, wherein the step of transmitting the encrypted file system comprises transmitting a plurality of encrypted data blocks to the CDN server, the method further comprising:

generating at least one file map for a file of the encrypted file system, wherein the file map identifies a sequence of blocks from the plurality of encrypted data blocks; and

transmitting the at least one file map to the end user device via the VPN.

20. The method of claim 19, wherein the file map identifies a sequence of blocks by specifying a list of block identifiers;

and the step encrypting at least a portion of an enterprise file system comprise;

generating the plurality of encrypted blocks, comprising;

segmenting at least one file of the enterprise file system into multiple data blocks; and

generating multiple block identifiers by applying a hash function to the multiple data blocks respectively, whereby the multiple block identifiers are used by a file map to identify the multiple blocks as being associated with the at least one file.