Map-Based Rapid Data Encryption Policy Compliance

• US 20170004094A1
• Filed: 09/15/2016
• Published: 01/05/2017
• Est. Priority Date: 08/30/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Basmov, Innokentiy, Nystrm, Magnus Bo Gustaf, Semenko, Alex M., MacIver, Douglas M., Li, Donghui
• Granted Patent: US 9,740,639 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 12/14 Protection against unauthorised use of memory or access to memory
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 16/2237 Vectors, bitmaps or matrices
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 3/0623 in relation to content
• CPC Class Codes: G06F 3/0644 Management of space entities, e.g. partitions, extents, pools
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/0673 Single storage device

Abstract

To comply with a policy for a computing device indicating that data written by the computing device to the storage volume after activation of the policy be encrypted, a sector map is accessed. The sector map identifies one or more sectors of a storage volume and also identifies, for each of the one or more sectors of the storage volume, a signature of the content of the sector. In response to a request to read the content of a sector, the content of the sector is returned without decrypting the content if the sector is one of the one or more sectors and the signature of the content of the sector matches the signature of the sector identified in the sector map. Otherwise, the content of the sector is decrypted and the decrypted content is returned.

Claims

1. A method implemented in a computing device, the method comprising:

accessing an encrypted chunks map of a storage volume to comply with a policy for the computing device, the encrypted chunks map grouping sectors of the storage volume into one or more chunks and indicating for each chunk whether sectors in the chunk are unencrypted or encrypted, the policy indicating that data written by the computing device to the storage volume after activation of the policy be encrypted;

in response to a request to write data to a sector of the storage volume;

identifying a chunk that includes the sector of the storage volume to which the data is requested to be written; and

determining, using the encrypted chunks map, whether the identified chunk is unencrypted;

in response to determining the identified chunk is not unencrypted;

encrypting the data to be written; and

writing the encrypted data to the sector of the storage volume to which the data is requested to be written; and

in response to determining the identified chunk is unencrypted;

encrypting sectors included in the identified chunk;

updating the encrypted chunks map;

encrypting the data to be written; and

writing the encrypted data to the sector of the storage volume to which the data is requested to be written.

2. The method as recited in claim 1, the encrypting the sectors included in the identified chunk comprising encrypting all sectors included in the identified chunk.

3. The method as recited in claim 1, the encrypting the sectors included in the identified chunk comprising encrypting sectors included in the identified chunk other than the sector to which the data is requested to be written.

4. The method as recited in claim 1, wherein the one or more chunks have different numbers of sectors.

5. The method as recited in claim 1, wherein the sectors included in each chunk are grouped by sector number in numeric order.

6. The method as recited in claim 1, wherein the encrypted chunks map comprises a bitmap, each chunk corresponding to a bit of the bitmap, each bit being set to indicate that sectors in the corresponding chunk are encrypted or each bit being not set to indicate that sectors in the corresponding chunk are unencrypted.

7. The method as recited in claim 1, wherein the encrypted chunks map comprises a most recent version of the encrypted chunks map and a next most recent version of the encrypted chunks map.

8. The method as recited in claim 1, wherein the updating the encrypted chunks map comprises replacing a previous version of the encrypted chunks map with a most recent version of the encrypted chunks map and changing the most recent version of the encrypted chunks map.

9. The method as recited in claim 1, further comprising, responsive to receiving a request from a requestor to read content from a sector of the storage volume:

determining, using the encrypted chunks map, whether a chunk including the sector from which the content is requested to be read is unencrypted;

responsive to determining the chunk is unencrypted, returning the content from the sector to the requestor; and

responsive to determining the chunk is not unencrypted;

decrypting the content from the sector; and

returning the decrypted content to the requestor.

10. The method as recited in claim 1, further comprising maintaining a conversion log including identifiers of sectors that have been encrypted and signatures of sectors storing encrypted content.

11. A computing device comprising:

one or more hardware processors; and

one or more computer storage media devices having stored thereon multiple instructions that, when executed by the one or more processors to, cause the one or more processors to;

access an encrypted chunks map of a storage volume to comply with a policy for the computing device, the encrypted chunks map grouping sectors of the storage volume into one or more chunks and indicating for each chunk whether sectors in the chunk are unencrypted or encrypted, the policy indicating that data written by the computing device to the storage volume after activation of the policy be encrypted;

in response to a request to write data to a sector of the storage volume;

identify a chunk that includes the sector of the storage volume to which the data is requested to be written; and

determine, using the encrypted chunks map, whether the identified chunk is unencrypted;

in response to determining the identified chunk is not unencrypted;

encrypt the data to be written; and

write the encrypted data to the sector of the storage volume to which the data is requested to be written; and

in response to determining the identified chunk is unencrypted;

read the sectors included in the identified chunk;

replace, from the read sectors, the content of the sector being written to with the data begin written to the sector;

encrypt the sectors included in the identified chunk, including the replaced sector;

write the encrypted content of the sectors included in the identified chunk to the storage volume.

12. The computing device as recited in claim 11, wherein the encrypted chunks map initially indicates that all chunks are unencrypted.

13. The computing device as recited in claim 11, wherein the multiple instructions further cause the one or more hardware processors to, responsive to receiving a request from a requestor to read content from a sector of the storage volume:

determine, using the encrypted chunks map, whether a chunk including the sector from which the content is requested to be read is unencrypted;

responsive to determining the chunk is unencrypted, return the content from the sector to the requestor; and

responsive to determining the chunk is not unencrypted;

decrypt the content from the sector; and

return the decrypted content to the requestor.

14. The computing device as recited in claim 11, wherein the multiple instructions further cause the one or more hardware processors to:

identify one or more chunks that includes sectors of the storage volume that are not in use; and

update the encrypted chunks map to indicate the identified one or more chunks are encrypted.

15. A method comprising:

receiving, by a computing device, a request to activate a policy for the computing device, the policy indicating that data written by the computing device to a storage volume after activation of the policy be encrypted;

activating, in response to the request, the policy for the computing device, including;

encrypting data written to the storage volume after returning an indication of compliance with the policy,

using a map to identify one or more collections of content on the storage volume that are not encrypted, the map identifying one or more collections of content written to prior to the map being locked to prohibit changes to the map and the map including signatures of collections of content that were written to the storage volume prior to the map being locked, data written to the storage volume after the map is locked being encrypted but at least some data written to the storage volume before the map is locked not being encrypted, and

using the map to determine whether to decrypt a collection of content in response to a request to read the collection of content; and

returning, in response to the request to activate the policy, the indication of compliance with the policy despite at least part of the storage volume being unencrypted.

16. The method as recited in claim 15, the returning comprising returning the response without waiting for the storage volume to be encrypted.

17. The method as recited in claim 15, the map being locked in response to the request to activate the policy for the computing device.

18. The method as recited in claim 15, further comprising:

encrypting unencrypted data from the storage volume;

determining when no unencrypted data remains on the storage volume; and

deleting the map and ceasing using the map in response to no unencrypted data remaining on the storage volume.

19. The method as recited in claim 15, the signature of a collection of content comprising a value generated as a function of the collection of content.

20. The method as recited in claim 15, further comprising maintaining the map on the storage volume, and mapping the map from the storage volume into a map in volatile memory when the computing device starts operation.