Optimizing costs associated with managing encrypted data

• US 7,219,230 B2
• Filed: 05/08/2002
• Issued: 05/15/2007
• Est. Priority Date: 05/08/2002
• Status: Active Grant

• Current Assignee: Valtrus Innovations Limited (f/k/a Dolya Holdco 9 Limited) (Key Patent Innovations Limited)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Riedel, Erik, Swaminathan, Ram, Kallahalla, Mahesh
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): HENEGHAN, MATTHEW E
• Application Number:
  US10/140,058
• Publication Number:
  US 20030210790A1
• Time in Patent Office: 1,833 Days
• Field of Search: 713/165, 707/200
• US Class Current: 713/165
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2107 File encryption

Abstract

A plurality of file encryption groups are created for a plurality of files based on attributes of each file. An event is detected and a selected file encryption group is divided into a plurality of sub-groups in response to the event. The division is based on an access pattern for each file in the selected file encryption group.

Claims

1. A method executable in at least one computing device of optimizing costs associated with managing encrypted data, said method comprising:

creating a plurality of file encryption groups for a plurality of files based on attributes of each file;

detecting an event; and

in response to the event, dividing a selected file encryption group into a plurality of sub-groups of files in the selected file encryption group based on access patterns for the files in said selected file encryption group.

2. The method according to claim 1, wherein said event is a revocation of a user.

3. The method according to claim 1, further comprising:

generating a plurality of encryption keys; and

associating each encryption key with a respective file encryption group of said plurality of file encryption groups, wherein each encryption key encrypts each of multiple files in said respective file encryption group of said plurality of file encryption groups.

4. The method according to claim 1, further comprising:

generating a plurality of encryption keys; and

associating each encryption key with a respective sub-group from said plurality of sub-groups.

5. The method according to claim 4, further comprising:

encrypting each file in each sub-group of said plurality of sub-groups with a respective encryption key.

6. The method according to claim 4, further comprising:

moving a file from a first sub-group to a second sub-group based on a change in an access pattern for said file.

7. The method according to claim 1, further comprising:

moving a file from a first sub-group to a second sub-group based on a change in an access pattern for said file.

8. The method of claim 1, wherein dividing the selected file encryption group into the plurality of sub-groups based on the access patterns for the files in the selected tile encryption group comprises dividing the selected file encryption group into the plurality of sub-groups based on frequencies of access for the files in the selected file encryption group.

9. An apparatus for optimizing costs associated with managing encrypted data, said apparatus comprising:

at least one processor;

means coupled to the at least one processor for creating a plurality of file encryption groups for a plurality of files based on attributes of each file;

means coupled to the at least one processor for detecting an event; and

means coupled to the at least one processor and responsive to the event for dividing a selected file encryption group into a plurality of sub-groups of files in the selected file encryption group based on access patterns for the files in said selected file encryption group.

10. The apparatus according to claim 9, further comprising:

means for generating a plurality of encryption keys; and

means for associating each encryption key with a respective tile encryption group of said plurality of file encryption groups, wherein each encryption key encrypts each of the files in said respective file encryption group of said plurality of file encryption groups.

11. The apparatus according to claim 9, further comprising:

means for generating a plurality of encryption keys; and

means for associating each encryption key with a respective sub-group from said plurality of sub-groups.

12. The apparatus according to claim 9, further comprising:

means for moving a file from a first sub-group to a second sub-group based on a change in access pattern far said file.

13. A system for optimizing costs associated with managing encrypted data, said system comprising:

at least one processor;

a memory configured to interface with said at least one processor; and

a file manager module configured to be stored on said memory and executed by said at least one processor;

wherein said tile manager module is configured to create a plurality of file encryption groups for a plurality of files based on attributes of each file, to detect an event, and to divide a selected file encryption group into a plurality of sub-groups based on an access pattern for each file in said selected tile encryption group in response to said event.

14. The system according to claim 13, further comprising:

a key generation module, wherein said file manager module is further configured to invoke said key generation module to generate a plurality of cryptographic keys and to associate each cryptographic key with a respective file encryption group,

the file manager module to use one of the cryptographic keys to encrypt files of a respective file encryption group.

15. The system according to claim 14, wherein said file manager module is further configured to invoice said key generation module to generate a plurality of cryptographic keys and to associate each cryptographic key with each sub-group of said plurality of sub-groups.

16. The system according to claim 13, wherein said file manager module is further configured to use each of plural cryptographic keys to encrypt each of the files in a respective file encryption group.

17. The system according to claim 13, wherein said file manager module is adapted to execute in an application program.

18. The system according to claim 13, wherein said file manager module is configured to be integrated in an operating system.

19. The system according to claim 13, wherein said file manager module is configured to be integrated in a shared tile system.

20. The system of claim 13, wherein the access pattern for each file comprises a frequency of access for each file, the files of the selected encryption group divided into the plurality of sub-groups based on the frequencies of access of the files.

21. A method executable by at least one computing device of implementing a file system, comprising:

creating a plurality of file encryption groups from a plurality of files;

associating each file with a respective file encryption group based on an access pattern for each file;

associating each file encryption group of said plurality of file encryption groups with a respective encryption key, wherein each file encryption group has multiple files; and

accessing the files in each file encryption group by utilizing said respective encryption key,

wherein creating the plurality of file encryption groups, associating each file with a respective file encryption group, associating each file encryption group with a respective encryption key, and accessing the files in each file encryption group are performed by a file manager module in a user station.

22. The method according to claim 21, further comprising:

encrypting each file in each file encryption group of said plurality of file encryption groups with said respective encryption key; and

storing said encrypted files of said plurality of file encryption groups.

23. The method according to claim 21, further comprising:

detecting an event; and

dividing files of a selected encryption group into a plurality of sub-groups based on file access patterns for said files of said selected file encryption group.

24. The method according to claim 23, further comprising:

generating a respective encryption sub-key for each sub-group of said plurality of sub-groups; and

encrypting each of the files of each sub-group with the respective encryption sub-key.

25. The method according to claim 24, further comprising:

maintaining said respective encryption key of said selected file encryption group for a sub-group with an access pattern of little activity.

26. The method according to claim 23, further comprising:

moving a file from one sub-group to a second sub-group based on a change in level of activity of said file.

27. The method according to claim 26, wherein said change is an increase in activity.

28. The method according to claim 26, wherein said change is a decrease in activity.

29. The method according to claim 21, further comprising:

disassociating a file from a first file encryption group based on a change in a respective file access pattern; and

associating said file with a second file encryption group based on said change in said respective file access pattern.

30. The method of claim 21, wherein associating each file with a respective file encryption group based on the access pattern for each file comprises associating each file with a respective file encryption group based on frequency of access for each file.

31. The method of claim 21, further comprising:

detecting creation of a new file;

searching a data structure that lists file encryption groups and associated encryption keys to find an encryption key for the new file, wherein the searching is based on attributes of the new file; and

encrypting the new file with the encryption key.

32. A computer readable storage medium on which is embedded one or more computer programs, said one or more computer programs implementing a method of optimizing costs associated with managing encrypted data, said one or more computer programs comprising a set of instructions for:

creating a plurality of file encryption groups from a plurality of files;

associating each file with a respective file encryption group based on an access pattern for each file;

associating each file encryption group of said plurality of file encryption groups with a respective encryption key, wherein each file encryption group has multiple files; and

accessing the files in each file encryption group by utilizing said respective encryption key,

wherein creating the plurality of file encryption groups, associating each file with a respective file encryption group, associating each file encryption group with a respective encryption key, and accessing the files in each file encryption group are performed by a file manager module in a user station.

33. The computer readable storage medium in according to claim 32, said one or more computer programs further comprising a set of instructions for:

encrypting each file in each file encryption group of said plurality of file encryption groups with said respective encryption key; and

storing said encrypted files of said plurality of file encryption groups.

34. The computer readable storage medium in according to claim 32, said one or more computer programs further comprising a set of instructions for:

detecting an event; and

dividing files of a selected encryption group into a plurality of sub-groups based on file access patterns for said files of said selected file encryption group.

35. The computer readable storage medium in according to claim 34, said one or more computer programs further comprising a set of instructions for:

generating a respective encryption sub-key for each sub-group of said plurality of sub-groups; and

encrypting each of the files of each sub-group with the respective encryption sub-key.

36. The computer readable storage medium in according to claim 34, said one or more computer programs further comprising a set of instructions for:

moving a file from one sub-group to a second sub-group based on a change in level of activity of said file.

37. The computer readable storage medium of claim 34, the one or more computer programs further comprising a set of instructions for:

comparing a metric for a particular one of the plurality of flies with one or more specified criteria; and

in response to the metric failing to satisfy the one or more specified criteria, decrypting the particular file with a first cryptographic key associated with a first of the sub-groups, and encrypting the decrypted particular tile with a second cryptographic key associated with a second of the sub-groups.

38. The computer readable storage medium in according to claim 32, said one or more computer programs further comprising a set of instructions for:

disassociating a file from a first file encryption group based on a change in a respective file access pattern; and

associating said file with a second file encryption group based on said change in said respective file access pattern.

39. The computer readable storage medium of claim 32, wherein the access pattern for each file comprises a frequency of access for each file.