Logical access block processing protocol for transparent secure file storage

• US 7,334,124 B2
• Filed: 07/22/2002
• Issued: 02/19/2008
• Est. Priority Date: 07/22/2002
• Status: Expired due to Fees

• Current Assignee: Thales E-Security Incorporated
• Original Assignee: Vormetric, Inc. (Thales SA)
• Inventors: Lo, Mingchen, Zhang, Pu Paul, Pham, Duc, Nguyen, Tien Le
• Primary Examiner(s): ZIA, SYED
• Application Number:
  US10/201,409
• Publication Number:
  US 20040015724A1
• Time in Patent Office: 2,038 Days
• Field of Search: 713/160, 713/165, 713/182, 713200-201, 713/173, 713/175, 713/154, 380/269, 380/37, 707/1, 708/9, 709223-226, 709/229
• US Class Current: 713/162
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Network data files are secure through the operation of an infrastructure gateway-based network file access appliance. Network file data, corresponding to network pocket payload data, are further reduced to a sequence of data blocks that are secured through any combination of block encryption, compression, and digital signatures. File meta-data, including encryption, compression and block-level digital signatures are persistently stored with the file data, either in-band in the file as stored or out-of-band key as a separately stored file or file policy record. File meta-data is recovered with accesses of the file data to support bidirectional encryption and compression and to detect tampering with the file data by comparison against block-level digital signatures.

Claims

1. A method of securing a network data file, said method comprising the steps of:

a) receiving a first network data packet including payload file data corresponding to a predetermined network data file stored on a predetermined network storage resource;

b) segmenting said payload file data into a plurality of data blocks;

c) processing each of said plurality of file data blocks through a block encryption unit, said processing step selectively implementing a first function selected from a group of functions including

i) generating digital signatures for each of said plurality of file data blocks,

ii) encrypting each of said plurality of file data blocks,

iii) encrypting and generating digital signatures for each of said plurality of file data blocks,

iv) compressing and encrypting each of said plurality of file data blocks, and

v) compressing, encrypting, and generating digital signatures for each of said plurality of file data blocks;

d) generating a second file network data packet including said plurality of file data blocks as processed by said processing step; and

e) forwarding said second file network data packet to said predetermined network storage resource for storage as a corresponding portion of said predetermined network data file.

2. The method of claim 1 wherein said payload file data corresponds to an offset and range of said predetermined network data file and wherein said method, following said step of receiving, further comprises the steps of:

a) determining a pre-existing block-aligned portion of said predetermined network data file corresponding to said offset and range;

b) retrieving a terminal file data block of said pre-existing block-aligned portion of said predetermined network data file; and

c) overlaying said terminal file data block with said payload file data.

3. The method of claim 2 wherein said step of retrieving implements a second function selected from said group, wherein said group further includes (i) decrypting said terminal file data block, and (ii) decrypting and decompressing said terminal file data block.

4. The method of claim 3 further comprising the step of referencing file meta-data, stored in correspondence with said predetermined network data file, to obtain an encryption key for use in said steps of processing and retrieving.

5. The method of claim 4 further comprising, conditioned on said first function generating digital signatures for each of said plurality of file data blocks, the steps of:

a) storing digital signatures for each of said plurality of file data blocks as file meta-data in correspondence with said predetermined network data file; and

b) verifying the digital signature of said terminal file data block as obtained from said file meta-data against a digital signature generated in connection with said step of retrieving.

6. A method of encrypting network data files, said method comprising the steps of:

a) receiving a first network data packet including payload file data corresponding to a predetermined network data file stored on a predetermined network storage resource;

b) obtaining an encryption key associated with said predetermined network data file;

c) segmenting said payload file data into a plurality of file data blocks;

d) block encrypting each of said plurality of file data blocks with said encryption key;

e) generating a second file network data packet including said block encrypted plurality of file data blocks; and

f) forwarding said second file network data packet to said predetermined network storage resource.

7. The method of claim 6 further comprising the steps of computing a plurality of encrypted file data block digital signatures corresponding to said block encrypted plurality of file data blocks and storing said plurality of encrypted file data block digital signatures on said predetermined network storage resource.

8. The method of claim 7 wherein said step of forwarding includes forwarding said plurality of encrypted file data block digital signatures to said predetermined network storage resource.

9. The method of claim 8 wherein said step of computing associates each of said plurality of encrypted file data block digital signatures with the corresponding one of said block encrypted plurality of file data blocks for inclusion in said second file network data packet.

10. The method of claim 7 further comprising the step of associating a file header with said predetermined network data file and wherein said file header includes an identification of said encryption key, said step of obtaining said encryption key including retrieving said file header.

11. The method of claim 10 wherein said step of block encrypting utilizes said encryption key and an encryption seed value and wherein said file header includes an identification of said encryption seed value.

12. The method of claim 7 wherein said step of obtaining includes retrieving a meta-data header including an encryption key identifier, said method further including the step of recovering said encryption key based on said encryption key identifier.

13. The method of claim 12 wherein said plurality of encrypted file data block digital signatures are in correspondence with said meta-data header.

14. The method of claim 13 wherein said meta-data header and said plurality of encrypted file data block digital signatures are stored in a meta-data file on said predetermined network storage resource.

15. A method of recovering encrypted file data from a network storage resource, said method comprising the steps of:

a) receiving a network file data read request by a network portal appliance, said network file data read request identifying a defined portion of a network file stored by a network storage resource;

b) determining a block file data portion encompassing said defined portion of said network file;

c) first retrieving an encryption key corresponding to said network file;

d) second retrieving said block file data portion from said network storage resource;

e) decrypting said block file data portion utilizing said encryption key; and

f) returning, in response to said network file data read request, said defined portion of said network file.

16. The method of claim 15 wherein said step of determining includes obtaining encryption meta-data including identifications of said encryption key and an encryption block size of said network file.

17. The method of claim 16 wherein said step of determining includes third retrieving said encryption meta-data from said network storage resource.

18. The method of claim 17 wherein said encryption meta-data is stored by said network storage resource in direct correspondence with said network file.

19. The method of claim 18 wherein said encryption meta-data is stored as part of said network file.

20. A network appliance providing for the secure transport and storage of encrypted file data by network storage resources, said network appliance comprising:

a) a network file access processor defining the storage of a network file by a network storage resource to include predefined encryption meta-data and a plurality of encrypted file data blocks, said network file access processor supporting a first network file access transaction with a client computer system and a second network file access transaction with said network storage resource, said second network file access transaction including retrieval of said predefined encryption meta-data and further corresponding to a modified said first network file access transaction based on said predefined encryption meta-data; and

b) a network protocol processor, responsive to said network file access processor, operative to selectively convert network packet payload data between a sequence of encrypted data blocks and a defined portion of said network file.

21. The network appliance of claim 20 wherein said network protocol processor provides for the decomposition of network packet payload data into a plurality of data blocks of size defined by said predefined encryption meta-data, and encryption of each of said plurality data blocks utilizing an encryption key identified by said predefined encryption meta-data.

22. The network appliance of claim 20 wherein said first network file access transaction defines a read file access request against a defined portion of said network file,

wherein said network file access processor is operative in said second network file access transaction to retrieve said predefined encryption meta-data and a sequence of encrypted data blocks encompassing said defined portion of said network file, and

wherein said network protocol processor is operative to obtain an encryption key based on said predefined encryption meta-data and decrypt said sequence to supply said defined portion in completion of said first network file access transaction.

23. The network appliance of claim 20 wherein said first network file access transaction defines a write file access request against a first defined portion of said network file,

wherein said network file access processor is operative in said second network file access transaction to retrieve said predefined encryption meta-data and a sequence of encrypted data blocks determined to be overwritten in completion of said second network file access transaction, and

wherein said network protocol processor is operative to obtain an encryption key based on said predefined encryption meta-data, decrypt said sequence to provide a second defined portion of said network file, overlay said second defined portion with said first defined portion to provide a third defined portion of said network file, decompose said third defined portion into a plurality of data blocks of size defined by said predefined encryption meta-data, encrypt each of said plurality data blocks utilizing said encryption key, and supply said plurality of encrypted data blocks to said network storage in completion of said second network file access transaction.

24. A network file access appliance provided as a gateway within a network infrastructure and implementing a storage protocol to transparently secure file as data stored by network storage resources, said network file access appliance comprising:

a) a network file transaction processor operative to responsively manage a first network file transaction for returning first network file data to a client computer system and execute a second network file transaction to retrieve second network file data from a network storage resource, wherein said second network file data includes a plurality of encrypted data blocks and file meta-data, including an encryption key identifier, said network file transaction processor being further operative to resolve said encryption key identifier into an encryption key specific to said plurality of encrypted data blocks; and

b) a network file data processor, responsive to said network file transaction processor and including a block decryptor, operative to decrypt said plurality of encrypted data blocks and selectively return said first network file data.

25. The network file access appliance of claim 24 wherein said file meta-data is uniquely associated with said plurality of encrypted data blocks.

26. The network file access appliance of claim 25 wherein said file meta-data and said plurality of encrypted data blocks are stored separately on said network storage resource, said second network file transaction providing for the coordinated retrieval of said file meta-data and said plurality of encrypted data blocks.

27. The network file access appliance of claim 25 wherein said file meta-data and said plurality of encrypted data blocks are stored together in a file on said network storage resource, said second network file transaction mapping between said first and second network file data.

28. The network file access appliance of claim 25 wherein said meta-data includes a digital signature for each said plurality of encrypted data blocks.

29. The network file access appliance of claim 28 wherein said file meta-data includes a compression identifier and wherein said network file data processor includes a data decompressor selectively operative dependent on said compression identifier to decompress said plurality of encrypted data blocks.

30. The network file access appliance of claim 29 wherein said file meta-data includes compression data respectively for said plurality of encrypted data blocks, said second network file transaction providing for the coordinated use of said compression data for decompression of said plurality of encrypted data blocks.

31. The network file access appliance of claim 30 wherein said file meta-data includes error correction information computed for each of said plurality of encrypted data blocks.