Backup restore in a corporate infrastructure

• US 7,673,134 B2
• Filed: 04/07/2005
• Issued: 03/02/2010
• Est. Priority Date: 04/07/2005
• Status: Expired due to Fees

• Current Assignee: Lenovo PC International Limited (Lenovo Group Ltd.)
• Original Assignee: Lenovo Singapore Pte Limited (Lenovo Group Ltd.)
• Inventors: Elliott, Scott Thomas, Challener, David Carroll, Catherman, Ryan Charles, Hoff, James Patrick
• Primary Examiner(s): Moazzami; Nasser G
• Assistant Examiner(s): Reza; Mohammad W
• Application Number:
  US11/101,290
• Publication Number:
  US 20060230264A1
• Time in Patent Office: 1,790 Days
• Field of Search: 713/155, 713/193, 713/156, 726/10, 726/12
• US Class Current: 713/155
• CPC Class Codes: G06F 11/1446 Point-in-time backing up or restoration of persistent data
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0822 using key encryption key

Abstract

A method and system for remotely storing a user'"'"'s admin key to gain access to an intranet is presented. The user'"'"'s admin key and intranet user identification (ID) are encrypted using an enterprise'"'"'s public key, and together they are concatenated into a single backup admin file, which is stored in the user'"'"'s client computer. If the user needs his admin file and is unable to access it in a backup client computer, he sends the encrypted backup admin file to a backup server and his unencrypted intranet user ID to an intranet authentication server. The backup server decrypts the user'"'"'s single backup admin file to obtain the user'"'"'s admin key and intranet user ID. If the unencrypted intranet user ID in the authentication server matches the decrypted intranet user ID in the backup server, then the backup server sends the backup client computer the decrypted admin key.

Claims

1. A method comprising:

receiving at an authentication server a user'"'"'s Clear Intranet UserID (CIUID) from a backup client computer via an intranet;

receiving at said authentication server an Intranet UserID (IUID) from a backup server, wherein said IUID is extracted from a backup file previously sent by said backup client computer to said backup server, wherein said backup file includes a backup admin file (BAF) and an encrypted AES key, and wherein said BAF includes an encrypted Admin Private Key (APK) concatenated with an encrypted IUID; and

instructing said backup server to send an unencrypted Admin Private Key (APK) to said backup client computer when said IUID from said backup server matches said CIUID from said backup client computer, such that said backup client computer is able to use said APK to encrypt and store client security software (CSS) files in said backup client computer.

2. The method of claim 1, wherein said encrypted APK and said encrypted IUID are encrypted within a primary client computer.

3. The method of claim 2, wherein said encrypted APK and said encrypted IUID are encrypted within said primary client computer using an Enterprise Public Key (EPK).

4. The method of claim 1, wherein said backup file is downloaded from said primary client computer to said backup client computer at a user'"'"'s request.

5. The method of claim 1, wherein method further includes sending a denial message to said backup client computer when said IUID from said backup server does not match said CIUID from said backup client computer.

6. An authentication server comprising:

means for receiving at an authentication server a user'"'"'s Clear Intranet UserID (CIUID) from a backup client computer via an intranet;

means for receiving at said authentication server an Intranet UserID (IUID) from a backup server, wherein said IUID is extracted from a backup file previously sent by said backup client computer to said backup server, wherein said backup file includes a backup admin file (BAF) and an encrypted AES key, wherein said BAF includes an encrypted Admin Private Key (APK) concatenated with an encrypted IUID; and

means for instructing said backup server to send an unencrypted Admin Private Key (APK) to said backup client computer when said IUID from said backup server matches said CIUID from said backup client computer, such that said backup client computer is able to use said APK to encrypt and store client security software (CSS) files in said backup client computer.

7. The authentication server of claim 6, wherein said encrypted APK and said encrypted IUID are encrypted within a primary client computer.

8. The authentication server of claim 7, wherein said encrypted APK and said encrypted IUID are encrypted within said primary client computer using an Enterprise Public Key (EPK).

9. The authentication server of claim 6, wherein said authentication server further includes means for sending a denial message to said backup client computer when said IUID from said backup server does not match said CIUID from said backup client computer.