Protected data replication

• US 7,761,419 B2
• Filed: 12/29/2005
• Issued: 07/20/2010
• Est. Priority Date: 12/29/2005
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Wray, John C.
• Primary Examiner(s): Jalil; Neveen Abel
• Assistant Examiner(s): Chbouki; Tarek
• Application Number:
  US11/321,543
• Publication Number:
  US 20070156788A1
• Time in Patent Office: 1,664 Days
• Field of Search: None
• US Class Current: 707/634
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

A solution for replicating protected data is provided. A manifest is managed along with the protected data at each computing device as well as at a server. The manifest is also protected and includes an entry for each protected data item in the protected data. The protected data at each computing device is replicated using both the local version of the manifest and the server version of the manifest. In an embodiment, each entry in the manifest includes an update identifier that can be compared with an update identifier stored with the protected data item as well as the update identifier in a local version of the manifest. In another embodiment, the manifest includes an entry for each computing device that includes a replication identifier. These entries can be used to perform additional checks to ensure that the manifest and/or protected data has not been compromised.

Claims

1. A method of replicating protected data, the method comprising:

obtaining a local version of a manifest for a set of protected data items, the manifest including an identifier for each protected data item and a corresponding update identifier associated with a version of the protected data item and further including a plurality of client identifiers and a corresponding replication identifier for each of the plurality of client identifiers, wherein each client identifier identifies a unique computing device on which the manifest is replicated and wherein the replication identifier is associated with a last replication of the manifest on the corresponding computing device;

obtaining a server version of the manifest from a server; and

replicating, on at least one computing device, the set of protected data items using the local version of the manifest and the server version of the manifest, the replicating including comparing the replication identifiers for each of the plurality of client identifiers in the local version and server version of the manifest to verify a validity of the server version of the manifest.

2. The method of claim 1, further comprising:

updating the replication identifier corresponding to a client identifier for a client in the local version of the manifest;

protecting the manifest from an unauthorized modification; and

providing the manifest for storage at the server.

3. The method of claim 1, further comprising:

comparing a replication identifier in the local version of the manifest to a corresponding replication identifier in the server version of the manifest; and

initiating a response when the replication identifier in the local version of the manifest is newer than the replication identifier in the server version of the manifest.

4. The method of claim 1, further comprising:

determining when another client last updated the server version of the manifest; and

initiating a response when the another client has not updated the manifest for at least a threshold time period.

5. The method of claim 1, the replicating including comparing an update identifier corresponding to a protected data item in the local version of the manifest to an update identifier corresponding to the protected data item in the server version of the manifest.

6. The method of claim 5, the replicating further including, requesting a server version of the protected data item when the update identifier in the local version of the manifest is older than the update identifier in the server version of the manifest.

7. The method of claim 6, the replicating further including:

obtaining the server version of the protected data item; and

updating a local version of the protected data item based on the server version of the protected data item.

8. The method of claim 7, the replicating further including:

comparing an update identifier in the obtained protected data item with the update identifier in the server version of the manifest; and

initiating a response when the update identifiers are different.

9. The method of claim 6, the replicating further including initiating a response when the protected data item is not available on the server.

10. The method of claim 5, the replicating including providing the local protected data item for storage at the server when the update identifier in the local version of the manifest is newer than the update identifier in the server version of the manifest.

20. The method of claim 2, wherein the updating, protecting and providing are performed each time the server version of the manifest is obtained regardless of whether any protected data is modified.

11. A system for replicating protected data, the system comprising:

at least one computing device including;

a system for obtaining a local version of a manifest for a set of protected data items, the manifest including an identifier for each protected data item and a corresponding update identifier associated with a version of the protected data item and further including a plurality of client identifiers and a corresponding replication identifier for each of the plurality of client identifiers, wherein each client identifier identifies a unique computing device on which the manifest is replicated and wherein the replication identifier is associated with a last replication of the manifest on the corresponding computing device;

a system for obtaining a server version of the manifest from a server; and

a system for replicating the set of protected data items using the local version of the manifest and the server version of the manifest, the system for replicating including a system for comparing the replication identifiers for each of the plurality of client identifiers in the local version and server version of the manifest to verify a validity of the server version of the manifest.

12. The system of claim 11, the system for replicating further including:

a system for determining when another client last updated the server version of the manifest;

a system for updating the replication identifier corresponding to a client identifier for a client in the local version of the manifest;

a system for protecting the manifest from an unauthorized modification; and

a system for providing the manifest for storage at the server.

13. The system of claim 11, the system for replicating further including:

a system for comparing an update identifier corresponding to a protected data item in the local version of the manifest to an update identifier corresponding to the protected data item in the server version of the manifest;

a system for obtaining a server version of the protected data item when the update identifier in the local version of the manifest is older than the update identifier in the server version of the manifest;

a system for comparing an update identifier in the obtained protected data item with the update identifier in the server version of the manifest; and

a system for updating a local version of the protected data item based on the server version of the protected data item.

14. The system of claim 11, the system for replicating further including:

a system for comparing an update identifier for a local protected data item to an update identifier in the server version of the manifest; and

a system for providing the local protected data item for storage at the server when the update identifier for the local protected data item is newer than the update identifier in the server version of the manifest.

15. A program product stored on a physical computer-readable storage medium, which when executed, enables a computer infrastructure to replicate protected data, the program product comprising computer program code for enabling the computer infrastructure to:

obtain a local version of a manifest for a set of protected data items, the manifest including an identifier for each protected data item and a corresponding update identifier for the protected data item and further including a plurality of client identifiers and a corresponding replication identifier associated with a version of each of the plurality of client identifiers, wherein each client identifier identifies a unique computing device on which the manifest is replicated and wherein the replication identifier is associated with a last replication of the manifest on the corresponding computing device;

obtain a server version of the manifest from a server; and

replicate the set of protected data items using the local version of the manifest and the server version of the manifest, wherein the replicating includes comparing the replication identifiers for each of the plurality of client identifiers in the local version and server version of the manifest to verify a validity of the server version of the manifest.

16. The program product of claim 15, the program product further comprising computer program code for enabling the computer infrastructure to:

determine when another client last updated the server version of the manifest;

update the replication identifier corresponding to a client identifier for a client in the local version of the manifest;

protect the manifest from an unauthorized modification; and

provide the manifest for storage at the server.

17. The program product of claim 15, the computer program code for enabling the computer infrastructure to replicate including computer program code for enabling the computer infrastructure to:

compare an update identifier corresponding to a protected data item in the local version of the manifest to an update identifier corresponding to the protected data item in the server version of the manifest;

obtain a server version of the protected data item when the update identifier in the local version of the manifest is older than the update identifier in the server version of the manifest;

compare an update identifier in the obtained protected data item with the update identifier in the server version of the manifest; and

update a local version of the protected data item based on the server version of the protected data item.

18. The program product of claim 15, the computer program code for enabling the computer infrastructure to replicate including computer program code for enabling the computer infrastructure to:

compare an update identifier for a local protected data item to an update identifier in the server version of the manifest; and

provide the local protected data item for storage at the server when the update identifier for the local protected data item is newer than the update identifier in the server version of the manifest.

19. A method of generating a system for replicating protected data, the method comprising:

providing a computer infrastructure including at least one computing device operable to;

obtain a local version of a manifest for a set of protected data items, the manifest including an identifier for each protected data item and a corresponding update identifier associated with a version of the protected data item and further including a plurality of client identifiers and a corresponding replication identifier for each of the plurality of client identifiers, wherein each client identifier identifies a unique computing device on which the manifest is replicated and wherein the replication identifier is associated with a last replication of the manifest on the corresponding computing device;

obtain a server version of the manifest from a server; and

replicate the set of protected data items using the local version of the manifest and the server version of the manifest, wherein the replicating includes comparing the replication identifiers for each of the plurality of client identifiers in the local version and server version of the manifest to verify a validity of the server version of the manifest.