System and method for secure storage, transfer and retrieval of content addressable information

• US 6,976,165 B1
• Filed: 09/07/1999
• Issued: 12/13/2005
• Est. Priority Date: 09/07/1999
• Status: Expired due to Term

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.), Wave Research NV
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Van Riel, Jan F., Teugels, Tom, Carpentier, Paul R.
• Primary Examiner(s): Vu, Kim
• Assistant Examiner(s): TRUVAN, LEYNNA THANH
• Application Number:
  US09/391,360
• Time in Patent Office: 2,289 Days
• Field of Search: 713200-201, 713/165, 713/171, 709/247, 709/245, 709/246, 380/200, 380201-202, 380/217, 380/229, 380/232, 380/241, 380277-278, 380/285, 380/45, 380/44, 705 57- 58, 707 1- 2, 707/9, 707100-101, 707/200, 707202-203
• US Class Current: 713/165
• CPC Class Codes: G06F 16/30 of unstructured textual data document management systems G06F16/93
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 69/00 Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass networks security protocols H04L9/40; wireless communication networks H04W
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99953 Recoverability

Abstract

An algorithm (such as the MD5 hash function) is applied to a file to produce an intrinsic unique identifier (IUI) for the file (or message digest). The file is encrypted using its IUI as the key for the encryption algorithm. An algorithm is then applied to the encrypted file to produce an IUI for the encrypted file. The encrypted file is safely stored or transferred within a network and is uniquely identifiable by its IUI. The encrypted file is decrypted using the IUI of the plaintext file as the key. The IUI serves as both a key to decrypt the file and also as verification that the integrity of the plaintext file has not been compromised. IUIs for any number of such encrypted files may be assembled into a descriptor file that includes meta data for each file, the IUI of the plaintext file and the IUI of the encrypted file. An algorithm is applied to the descriptor file to produce an IUI for the descriptor file. The plaintext descriptor file is then encrypted using the descriptor file IUI as a key for the encryption algorithm. An algorithm is applied to the encrypted descriptor file to produce an IUI for the encrypted descriptor file. The IUI of the encrypted descriptor file is a location-independent identifier to locate the encrypted descriptor file. A flattened descriptor file includes the IUIs of encrypted data files and the IUI of the encrypted descriptor file. An algorithm is applied to the flattened descriptor file to produce its own IUI.

Claims

1. A method comprising:

generating a first unique identifier for said a binary asset, said first unique identifier being computed from at least a portion of the contents of said binary asset and uniquely identifying said binary asset;

encrypting said binary asset using said first unique identifier as a key, said encrypting resulting in an encrypted version of said binary asset;

generating a second unique identifier for said encrypted version of said binary asset, said second unique identifier being computed from at least a portion of said encrypted version of said binary asset and uniquely identifying said encrypted version of said binary asset;

providing said second unique identifier for the retrieval of said encrypted version of said binary asset, whereby said second unique identifier may be used to locate said encrypted version;

creating a descriptor file that includes said unique identifier and said second unique identifier;

generating a first file identifier, said first file identifier being computed from at least a portion of said descriptor file and uniquely identifying said descriptor file;

encrypting said descriptor file using said first file identifier as a key, said encrypting producing an encrypted descriptor file; and

generating a second file identifier for said encrypted descriptor file, said second file identifier being computed from at least a portion of said encrypted descriptor file and uniquely identifying said encrypted descriptor file, whereby said first file identifier and said second file identifier may be used to access the contents of said binary asset.

2. The method of claim 1, further comprising an act of:

decrypting said encrypted version of said binary asset using said first unique identifier to generate a decrypted version of said binary asset.

3. The method of claim 2, further comprising an act of:

verifying the integrity of said decrypted version of said binary asset using said first unique identifier.

4. A method comprising:

generating a first identifier for a file, said first identifier being computed from at least a portion said file and uniquely identifying said file;

encrypting said file using said first identifier as a key, said encrypting producing an encrypted file;

generating a second file identifier for said encrypted file, said second file identifier being computed from at least a portion of said encrypted file and uniquely identifying said encrypted file;

providing said first file identifier and second file identifier for the retrieval of said file, whereby said second unique identifier may be used to locate said encrypted file, and said first file identifier may be used to decrypt said encrypted file to produce said file;

creating a descriptor file that includes said first file identifier and said second file identifier;

generating a third file identifier, said third file identifier being computed from at least a portion of said descriptor file and uniquely identifying said descriptor file;

encrypting said descriptor file using said third file identifier as a key, said encrypting producing an encrypted descriptor file; and

generating a fourth file identifier for said encrypted descriptor file, said fourth file identifier being computed from at least a portion of said encrypted descriptor file and uniquely identifying said encrypted descriptor file, whereby said third file identifier and said fourth file identifier may be used to access the contents of said file.

5. A method as recited in claim 4 wherein the act of generating the first file identifier further comprises generating the first file identifier using a first hash function and the act of generating the second file identifier further comprises generating the first file identifier using a second hash function.

6. The method of claim 5, wherein the first hash function and the second hash function are a same hash function.

7. A method as recited in claim 4 further comprising:

compressing said file in conjunction with said encrypting.