Intelligent storage device for backup system

• US 8,099,605 B1
• Filed: 06/01/2007
• Issued: 01/17/2012
• Est. Priority Date: 06/05/2006
• Status: Active Grant

• Current Assignee: Data Locker Incorporated
• Original Assignee: Inventsec AB
• Inventors: Billsröm, Leif Olov, Lennartsson, Kurt Uno
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): Nobahar, Abdulhakim
• Application Number:
  US11/809,845
• Time in Patent Office: 1,691 Days
• Field of Search: 726 26- 28, 713/165, 713/167, 713/187, 713/189, 713/193
• US Class Current: 713/187
• CPC Class Codes: G06F 11/1448 Management of the data involved in backup or backup restore
• CPC Class Codes: G06F 11/1453 using de-duplication of the data
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

A data storage and data backup device that offers automatic reduction of duplicate data storage, and that easily can be connected to computing devices, computing systems and networks of computing devices. The device offers high protection against destruction or modification of already stored data, and requires flipping a physical switch and possibly require user authentication in order for the protection to be temporarily bypassed. Several connection types of the device to the computer systems are supported such as wired, wireless like Bluetooth or WI-FI, but not limited to those.

Claims

1. A device for securely storing objects comprising:

an object hashing system to generate a unique hash for a unique object;

storage media to store unique hashes and unique objects;

a control function to restrict an ability to alter or remove a stored unique object from the storage media by requiring a manual authorization from an authorized person for deletion of a stored unique object, in order to prevent alteration of the stored unique objects by malicious code or a malicious actor; and

an identical object detection system using the unique hashes to avoid storing in the storage media the already backed up unique objects, the identical object detection system using the unique hashes to enable detection of identical objects which are encrypted with different keys; and

to create a delta file containing a new header with a second key information without storing another copy of the identical object.

2. The device of claim 1, wherein the storage media comprises a plurality of storage units, and further comprising upon detection of an addition or removal of a storage unit to the storage media, rebuilding internal tables, enabling dynamic connection of storage units.

3. The device of claim 1, further comprising:

an object self-verification function to verify an integrity of the unique object using the unique hash associated with the unique object.

4. The device of claim 3, wherein the object self-verification function is continuously active, and verifies the integrity of the unique objects to be stored and the already stored unique objects.

5. The device of claim 1, further comprising:

an automatic auditing function using time information and the unique hashes to enable auditing of addition and removal of the unique objects.

6. The device of claim 1, further comprising:

a network connection to be activated to receive the unique object for storage;

a power connection for the storage media, the power connection powering up the storage media when an active network connection is detected.

7. The device of claim 1, further comprising:

an authentication system to require authentication to activate a backup functionality, the backup functionality for storing a backup in the storage media.

8. The device of claim 1 wherein the control function comprises one of:

a manual switch, an authentication-based switch, an authentication-based software control.

9. The device of claim 1, further comprising:

an object naming system naming the objects based on the generated unique hashes where the names of the objects, as defined by a generated unique hashes, uniquely identifies the objects.

10. A device for securely storing objects comprising:

an object hashing system to generate a unique hash for a unique object;

storage media to store unique hashes and unique objects;

a delta management system to detect a changed object, a changed object representing an update or change to an original object, and to generate a delta between the original object and the changed object and associate the delta with the original object; and

an encryption driver to split a file into a plurality of blocks, and compress and encrypt the plurality of blocks separately, such that a change is applied on a per block basis by the delta management system, wherein the delta contains one or more changes to apply to the original object as a list of block numbers and associated block data, and the delta is saved as a delta object having a unique hash and including a pointer to a different delta object or to the original object.

11. The device of claim 10, further comprising:

the delta management system to disassociate the delta from the original object when the original object is removed, to recreate the changed object based on the delta and the original object, and to store the changed object.

12. The device of claim 10, further comprising:

a control function to restrict an ability to alter or remove a stored unique object from the storage media by requiring a manual authorization from an authorized person for deletion of a stored unique object, in order to prevent alteration of the stored unique objects by malicious code or a malicious actor.

13. The device of claim 10, further comprising:

an automatic auditing function using time information and the unique hashes to enable auditing of addition and removal of the unique objects.

14. A method of providing a backup system comprising:

receiving an object for backup;

generating an object hash, the object hash being unique for the object;

storing the object and the object hash;

receiving a request to alter or delete the object or the object hash;

detecting a changed object, a changed object representing an update or change to an original object;

generating a delta between the original object and the changed object and associating the delta with the original object; and

splitting a file into a plurality of blocks, and compressing and encrypting the plurality of blocks separately, such that a change is applied on a per block basis, wherein the delta contains one or more changes to apply to the original object as a list of block numbers and associated block data, and the delta is saved as a delta object having a unique hash and including a pointer to a different delta object or to the original object.

15. The method of claim 14, wherein the manual authorization comprises one of:

a manual switch, an authentication-based switch, and a software tool requiring authentication of a user as an authorized user to be able to submit the request.

16. The method of claim 15, further comprising-verifying receipt of a manual authorization of alteration or deletion, prior to executing the request.

17. The method of claim 14 further comprising:

detecting a change in storage units associated with the storage media; and

rebuilding internal tables with the changed storage units, enabling dynamic changes to the storage media.

18. The method of claim 14, further comprising:

verifying object integrity based on the object hash associated with the object.

19. The method of claim 18, wherein the verification function is continuously active, and verifies the integrity of objects to be stored and the already stored objects.

20. The method of claim 14, further comprising:

auditing addition and removal of objects, based on time information and the object hash information.

21. The method of claim 14, further comprising:

powering the storage media upon an activation of a network connection to the storage media to enable receiving an object for backup.

22. The method of claim 14, further comprising:

using the unique hashes to avoiding storing in the storage media the already backed up unique objects.

23. The method of claim 14, further comprising:

detecting a changed object, a changed object representing an update or change to an original object stored in the backup system;

generating a delta between the original object and the changed object and associating the delta with the original object; and

storing the delta.

24. The method of claim 23, further comprising when receiving an authorized alteration or deletion:

detecting when the original object is removed, and recreating the changed object using the delta; and

removing the association between the delta and the removed original object.

25. The method of claim 23, further comprising:

associating metadata with the object, the metadata including versioning information regarding the object, thereby enabling retrieval of a latest version and any particular version of an object.

26. The method of claim 14, further comprising:

encrypting the object with a user-specific key prior to storing the object; and

associating metadata with the object, the metadata including a hash of an unencrypted version of the object, thereby enabling detection of duplicated documents across a plurality of storage media.

27. A system comprising:

a storage medium coupled to a network;

one or more a user computer systems coupled to the network;

a backup server coupled to the network to generate a unique hash for each unique object sent to the storage medium; and

an identical object detection system using the unique hashes to avoid storing in the storage media the already backed up unique objects, the identical object detection system using the unique hashes to enable detection of identical objects which are encrypted with different keys; and

to create a delta file containing a new header with a second key information without storing another copy of the identical object.

28. The system of claim 27, wherein the user interface comprises one of:

a manual switch on the backup server, a manual switch coupled to a user computer system, an authentication interface.

29. The system of claim 27, further comprising:

a delta management system to detect a changed object, a changed object representing an update or change to an original object stored in the backup system, to generate a delta between the original object and the changed object, and to associate the delta with the original object.

30. The system of claim 29, further comprising:

the delta management system to detect when the original object is removed, and to recreate the changed object based on the delta and the original object; and

the storage medium to store the changed object.

31. The system of claim 27, further comprising:

a user interface to request a manual authorization from an authorized person for the alteration or removal of stored object on the storage medium.