System and method for encrypting secondary copies of data

• US 8,510,573 B2
• Filed: 03/31/2008
• Issued: 08/13/2013
• Est. Priority Date: 12/29/2006
• Status: Active Grant

• Current Assignee: CommVault Systems Incorporated
• Original Assignee: CommVault Systems Incorporated
• Inventors: Muller, Marcus S., Gokhale, Parag, Erofeev, Andrei
• Primary Examiner(s): CHOUDHURY, AZIZUL Q
• Application Number:
  US12/060,026
• Publication Number:
  US 20080320319A1
• Time in Patent Office: 1,961 Days
• Field of Search: None
• US Class Current: 713/193
• CPC Class Codes: G06F 21/1073 Conversion
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 12/40176 involving redundancy error detection or correction of the data by redundancy in hardware using active fault-masking in interconnections G06F11/2002; error detection or correction of the data by redundancy in hardware using active fault-masking in storage systems using spares or by reconfiguring G06F11/2053
• CPC Class Codes: H04L 2209/605 Copy protection
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols

Abstract

A system and method for encrypting secondary copies of data is described. In some examples, the system encrypts a secondary copy of data after the secondary copy is created. In some examples, the system looks to information about a data storage system, and determines when and where to encrypt data based on the information.

Claims

1. A method of dynamically choosing a time to encrypt a copy of data created from unencrypted data, the method comprising:

receiving information related to a first completion time, wherein the first completion time is within a storage window to complete a data storage operation, wherein the data storage operation creates one or more copies of at least a portion of an unencrypted data set, and transmits the one or more copies to at least one storage device;

estimating with one or more computer processors comprising computer hardware, a second completion time, wherein the second completion time is based on an estimated amount of time it will take to encrypt at least a portion of the one or more copies;

when the second completion time occurs after the first completion time, creating and transferring the one or more copies to the at least one storage device without encrypting the data contained in the one or more copies, and after transfer, encrypting at least a portion of the one or more copies; and

when the second completion time occurs before the first completion time, encrypting at least a portion of the data contained in the one or more copies in association with performing the storage operation.

2. The method of claim 1, wherein encrypting data contained in the one or more copies after creation of the one or more copies includes using resources used by the data storage operation.

3. The method of claim 1, wherein encrypting data contained in the one or more copies during creation of the one or more copies includes using resources used by the data storage operation.

4. A method of dynamically choosing a resource to encrypt a copy of data created from unencrypted data, the method comprising:

receiving information related to a first completion time, wherein the first completion time is within a storage window to complete a data storage operation, wherein the data storage operation creates one or more copies of at least a portion of an unencrypted data set, and transmits the one or more copies to at least one storage device;

estimating with one or more computer processors comprising computer hardware, a second completion time, wherein the second completion time is based on an estimated amount of time it will take to encrypt the one or more copies; and

when the second completion time occurs after the first completion time, creating and transferring the one or more copies to the at least one storage device without encrypting the data contained in the one or more copies.

5. A method of encrypting data to be stored as a secondary copy of an unencrypted data set, the method comprising:

determining storage operations to be performed in creating the secondary copy of at least a portion of an unencrypted data set, wherein determining storage operations includes identifying storage resources to be utilized by the storage operations;

identifying from amongst the determined storage operations one or more storage operations to be used to encrypt the secondary copy;

calculating a first completion time, wherein the first completion time is within a storage window to perform the determined storage operations including the identified storage operations to be used to encrypt the secondary copy;

when the first completion time exceeds a threshold time for creating the secondary copy of the at least a portion of the unencrypted data set;

identifying with one or more computer processors comprising computer hardware, data within the unencrypted data set to be stored without encryption, wherein identifying the data includes reviewing characteristics of the data to determine whether the data requires encryption under a pre-determined encryption criteria;

storing the identified data within the unencrypted data set to be stored without encryption, wherein storing the identified data includes utilizing the identified storage resources; and

encrypting the non-identified data within the unencrypted data set using storage resources not utilized by the storage operations.

6. The method of claim 5, wherein the characteristics of the data include a classification of the data.

7. The method of claim 5, further comprising:

storing the encrypted non-identified data utilizing the identified storage resources.