Method and apparatus of securely processing data for file backup, de-duplication, and restoration

• US 8,527,472 B2
• Filed: 03/29/2011
• Issued: 09/03/2013
• Est. Priority Date: 03/29/2011
• Status: Active Grant

• Current Assignee: Datto LLC
• Original Assignee: Kaseya International Limited (Kaseya Limited)
• Inventors: Bosson, Charles
• Primary Examiner(s): DANG, THANH HA T
• Application Number:
  US13/074,231
• Publication Number:
  US 20120254125A1
• Time in Patent Office: 889 Days
• Field of Search: 707/679, 707/690, 707/693, 707/791, 707/802
• US Class Current: 707/679
• CPC Class Codes: G06F 11/1453 using de-duplication of the data
• CPC Class Codes: G06F 11/1464 for networked environments
• CPC Class Codes: G06F 11/1469 Backup restoration techniques
• CPC Class Codes: G06F 16/1748 De-duplication implemented within the file system, e.g. based on file segments de-duplication techniques in storage systems for the management of data blocks G06F3/0641
• CPC Class Codes: G06F 2201/00 Indexing scheme relating to error detection, to error correction, and to monitoring
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

Disclosed are an apparatus and method of restoring at least one data file. The method may include retrieving the at least one data file to be restored from a data storage location, determining that the at least one data file is a link file, and regenerating a previously exchanged shared secret. The method may also include decrypting a key from the link file using the shared secret, and retrieving data from a data repository location to be restored.

Claims

1. A method of restoring at least one data file, the method comprising:

retrieving the at least one data file to be restored from a data storage location which also stores at least one de-duplicated file;

determining that the at least one data file is a link file storing metadata comprising a uniform resource identifier (URI) of a repository source file, and which also includes a key encrypted with an agent and server shared secret that was previously exchanged;

regenerating the previously exchanged shared secret;

decrypting the key from the link file using the shared secret; and

retrieving data from a data repository location to be restored using the decrypted key.

2. The method of claim 1, wherein the data storage location is an online data storage location.

3. The method of claim 1, wherein the shared secret is shared between an agent application and a server application.

4. The method of claim 3, wherein the shared secret is a Diffie-Hellman (D-H) type shared secret.

5. The method of claim 1, wherein the key is a random advanced encryption standard (AES) key.

6. The method of claim 5, wherein the AES key is decrypted from metadata of the link file.

7. The method of claim 1, further comprising:

decrypting the retrieved data from the data repository location via the AES key.

8. An apparatus configured to restore at least one data file, the apparatus comprising:

a receiver configured to receive the at least one data file to be restored from a data storage location which also stores at least one de-duplicated file; and

a processor configured to

determine that the at least one data file is a link file storing metadata comprising a uniform resource identifier (URI) of a repository source file, and which also includes a key encrypted with an agent and server shared secret that was previously exchanged;

regenerate the previously exchanged shared secret; and

decrypt the key from the link file using the shared secret; and

wherein the receiver is further configured to receive data from a data repository location to be restored using the decrypted key.

9. The apparatus of claim 8, wherein the data storage location is an online data storage location.

10. The apparatus of claim 8, wherein the shared secret is shared between an agent application and a server application.

11. The apparatus of claim 10, wherein the shared secret is a Diffie-Hellman (D-H) type shared secret.

12. The apparatus of claim 8, wherein the key is a random advanced encryption standard (AES) key.

13. The apparatus of claim 12, wherein the AES key is decrypted from metadata of the link file.

14. The apparatus of claim 8, wherein the processor is further configured to decrypt the received data from the data repository location via the AES key.

15. A non-transitory computer readable storage medium configured to store instructions that when executed cause a processor to perform restoring at least one data file, the processor being further configured to perform:

retrieving the at least one data file to be restored from a data storage location which also stores at least one de-duplicated file;

determining that the at least one data file is a link file storing metadata comprising a uniform resource identifier (URI) of a repository source file, and which also includes a key encrypted with an agent and server shared secret that was previously exchanged;

regenerating the previously exchanged shared secret;

decrypting the key from the link file using the shared secret; and

retrieving data from a data repository location to be restored using the decrypted key.

16. The non-transitory computer readable storage medium of claim 15, wherein the data storage location is an online data storage location.

17. The non-transitory computer readable storage medium of claim 15, wherein the shared secret is shared between an agent application and a server application.

18. The non-transitory computer readable storage medium of claim 17, wherein the shared secret is a Diffie-Hellman (D-H) type shared secret.

19. The non-transitory computer readable storage medium of claim 15, wherein the key is a random advanced encryption standard (AES) key.

20. The non-transitory computer readable storage medium of claim 19, wherein the AES key is decrypted from metadata of the link file.