Method for writing hardware encrypted backups on a per set basis

• US 9,064,132 B1
• Filed: 03/31/2008
• Issued: 06/23/2015
• Est. Priority Date: 03/31/2008
• Status: Expired due to Fees

• Current Assignee: Veritas Technologies, LLC (Whitehouse Group Ltd.)
• Original Assignee: Symantec Operating Corporation (NortonLifeLock Inc.)
• Inventors: Hamilton, Gregg R., Laird, Bryan C., Seibert, Carl R.
• Primary Examiner(s): Abrishamkar, Kaveh
• Assistant Examiner(s): NGUYEN, NGOC THACH D
• Application Number:
  US12/059,629
• Time in Patent Office: 2,640 Days
• Field of Search: 711/162, 713/193, 380/277
• US Class Current: 1/1
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/72 in cryptographic circuits

Abstract

A method is disclosed. The method includes encrypting a first data, wherein the encrypting the first data set is performed using a first key, and the encrypting the first data set is performed using a dedicated encryption circuit. The first data set is stored on a first storage medium. A second data set is encrypted, wherein the encrypting the second data set is performed using a second key, and the encrypting the second data set is performed using the dedicated encryption circuit. The second data set is stored on the first storage medium.

Claims

1. A method, said method comprising:

generating a first hardware encrypted data set by encrypting a first data set, wherein

said first data set comprises a first set of data backed up at a first time,

said encrypting said first data set is performed using a first key,

said encrypting said first data set is performed using a dedicated encryption circuit that is configured to implement a plurality of hardware-based encryption techniques, and

said encrypting is performed using an initial data structure that comprises information regarding the first key, wherein

said information comprises a hash of the first key to retrieve the first key;

selecting a first hardware-based backup technique of a plurality of hardware-based backup techniques, wherein

said first hardware-based backup technique is selected based on

identifying a backup preference associated with a first backup client, and

determining a connection status associated with said first backup client;

storing a first hardware-encrypted data set in a first storage medium;

generating an another hardware encrypted data set by encrypting a first portion and a second portion of an another data set, wherein

said encrypting is performed using an another key, and

said encrypting of said first and said second portions is performed using disparate hardware-based encryption techniques of said plurality of hardware-based encryption techniques; and

storing said first portion of said another data set in said first storage medium, and

upon performance of a media-span process, storing said second portion of said another data set in a second storage medium, wherein

the second storage medium comprises

an unencrypted data structure linking the second storage medium to the first storage medium.

2. The method of claim 1, wherein said storing said first data set in said first storage medium further comprises:

performing a data set initialization process,

writing an encrypted unit of said first data set to said first storage medium, and

responsive to reaching an end of said first data set, performing an end of data set process.

3. The method of claim 2, further comprising:

performing said media-span process in response to detecting an end of said first storage medium.

4. The method of claim 3, wherein said performing said data set initialization process further comprises:

writing a first data structure containing an unencrypted encryption key name and hash;

writing a first pad to fill at least a first physical block on said first storage medium;

writing a first set of blocks to an item of read-write hardware;

flushing said first set of blocks to said first storage medium; and

activating encryption.

5. The method of claim 3, wherein said performing said media-span process further comprises:

flushing a first set of flush data to said first storage medium;

de-activating encryption;

writing a first filemark to said first storage medium;

writing a first unencrypted block with a second data structure to indicate an end of said first storage medium; and

writing a second filemark to said first storage medium.

6. The method of claim 3, wherein said step of performing said media-span process further comprises:

requesting said second storage medium;

responsive to availability of said second storage medium, writing a third data structure containing an unencrypted linking structure to link first data on said second storage medium to second data on said first storage medium;

writing a second pad to fill at least a second physical block on said second storage medium;

writing a second set of blocks to said second storage medium;

flushing said second set of blocks to said second storage medium; and

activating data encryption.

7. The method of claim 2, wherein said performing said end of data set process further comprises:

flushing a second set of flush data to said first storage medium;

de-activating encryption;

writing a third filemark to said first storage medium;

writing a second unencrypted block to indicate an end of said first data set;

flushing a third set of flush data to said first storage medium; and

activating encryption.

8. The method of claim 2, wherein said performing said end of data set further comprises:

writing a set of one or more encrypted catalog blocks comprising a catalog of said first data set;

flushing a third set of data to said first storage medium;

de-activating encryption;

writing an unencrypted catalog block, wherein

said unencrypted catalog block comprises a catalog of all backup sets written to said first medium, and

an entry supporting a data set comprises an encryption key name and hash associated with said backup set; and

writing to said first storage medium a fourth filemark.

9. The method of claim 2, wherein said storing said first data set on said first storage medium further comprises writing to said first storage medium a first storage structure comprising:

a first set of one or more unencrypted blocks, wherein

said first set of unencrypted blocks comprises a data structure, and

said data structure is configured to mark a beginning of said first data set; and

a first set of one or more encrypted data blocks.

10. The method of claim 9, wherein said storing said first data set on said first storage medium further comprises writing to said first medium a first storage structure comprising:

a fifth filemark, wherein

said fifth filemark is configured to separate said first set of one or more encrypted data blocks from a second set of one or more unencrypted blocks;

a second set of one or more unencrypted blocks containing one or more data structures; and

a first set of encrypted catalog blocks.

11. The method of claim 10, wherein:

said storing said another data set on said first storage medium further comprises writing to said first storage medium a second storage structure for said another data set, wherein

said second storage structure comprises

said first set of one or more unencrypted blocks configured to form a data structure, wherein

said data structure is configured to mark a beginning of said another data set,

said first set of one or more encrypted data blocks,

a third filemark separating said first set of one or more encrypted data blocks from an unencrypted data structure indicating an end of said first medium, wherein

said unencrypted data structure indicates said end of said first storage medium, and

a fourth filemark indicating said end of said first storage medium.

12. The method of claim 1, wherein said storing a third data set on said second storage medium further comprises writing to said second storage medium a third storage structure, said third storage structure comprising:

an unencrypted linking structure linking said second storage medium to said first storage medium,

a second set of one or more encrypted data blocks,

a fifth filemark configured to separate said second set of one or more encrypted data blocks from a third set of one or more unencrypted blocks containing one or more data structures an end of said third data set,

said third set of one or more unencrypted blocks containing one or more data structures configured to mark said end of said third data set,

a second set of encrypted catalog blocks,

a second set of unencrypted catalog blocks, and

a sixth filemark.

17. The method of claim 1, further comprising:

reading a block from said first storage medium; and

determining whether a current encryption key matches an associated encryption key, wherein

the associated encryption key was used to encrypt the block.

18. The method of claim 1, further comprising:

specifying a value, wherein

said value indicates whether said first data set is encrypted using hardware encryption.

19. The method of claim 1, comprising

generating a second hardware encrypted data set by encrypting a second data set, wherein

said second data set comprises a second set of data backed up at a second time,

said first time is different from said second time,

said encrypting said second data set is performed using a second key, and

said encrypting said second data set is performed using said dedicated encryption circuit that is configured to implement said plurality of hardware-based encryption techniques;

and

storing said second hardware-encrypted data set in said first storage medium.

20. The method of claim 1, wherein

the encryption of the first portion and the second portion of the another data set is deactivated, and

the encryption of the first portion and the second portion of the another data set is activated after performance of the media-span process.

21. The method of claim 1, wherein

said first data set is associated with a first set of encrypted data blocks, and

a second data set is associated with a second set of encrypted data blocks, wherein

the second set of encrypted data blocks are part of the first set of encrypted data blocks.

22. The method of claim 1, wherein

the unencrypted data structure identifies:

a third key, and

a plurality of data sets backed up in the first storage medium and the second storage medium.

23. The method of claim 1, wherein

said information regarding the first key further comprises:

an identifier for a group of storage mediums, and

a name of said first key used for said first data set.

13. A computer program product in a non-transitory computer-readable medium, said computer program product comprising:

said non-transitory computer-readable medium,

instructions on said non-transitory computer-readable medium for generating a first hardware encrypted data set by encrypting a first data set, wherein said first data set comprises a first set of data backed up at a first time, said encrypting said first data set is performed using a first key,

said encrypting said first data set is performed using a dedicated encryption circuit that is configured to implement a plurality of hardware-based encryption techniques, and

said encrypting is performed using an initial data structure that comprises information regarding the first key, wherein

said information comprises a hash of the first key to retrieve the first key;

instructions on selecting a first hardware-based backup technique of a plurality of hardware-based backup techniques, wherein

said first hardware-based backup technique is selected based on

identifying a backup preference associated with a first backup client, and

determining a connection status associated with said first backup client;

instructions on said non-transitory computer-readable medium for storing a first hardware-encrypted data set in a first storage medium;

instructions on said non-transitory computer-readable medium for generating an another hardware encrypted data set by encrypting a first portion and a second portion of an another data set, wherein

said encrypting is performed using an another key, and

said encrypting of said first and said second portions is performed using disparate hardware-based encryption techniques of said plurality of hardware-based encryption techniques; and

instructions on said non-transitory computer-readable medium for storing said first portion of said another data set in said first storage medium, and

upon performance of a media-span process, storing said second portion of said another data set in a second storage medium, wherein

the second storage medium comprises

an unencrypted data structure linking the second storage medium to the first storage medium.

14. The computer program product of claim 13, wherein

a data set comprises a first portion and a second portion,

said first portion comprises a second data set, and

said second portion comprises a third data set.

15. The computer program product of claim 13, wherein

said instructions on said non-transitory computer-readable medium for storing said first data set in said first storage medium further comprise

instructions on said non-transitory computer-readable medium for performing a data set initialization process,

instructions on said non-transitory computer-readable medium for writing an encrypted unit of said first data set to said first storage medium, and

instructions on said non-transitory computer-readable medium for, responsive to reaching an end of said first data set, performing an end of data set process.

16. An apparatus, said apparatus comprising:

a processor;

means for causing said processor to generate a first hardware encrypted data set by encrypting a first data set, wherein

said first data set comprises a first set of data backed up at a first time,

said means for causing said processor to encrypt said first data set employs a first key,

said means for causing said processor to encrypt said first data set comprises a dedicated encryption circuit that is configured to implement a plurality of hardware-based encryption techniques, and

said encrypting is performed using an initial data structure that comprises information regarding the first key, wherein

said information comprises a hash of the first key to retrieve the first key;

means for selecting a first hardware-based backup technique of a plurality of hardware-based backup techniques, wherein

said first hardware-based backup technique is selected based on

identifying a backup preference associated with a first backup client, and

determining a connection status associated with said first backup client;

means for causing said processor to store a first hardware-encrypted data set in a first storage medium;

means for causing said processor to generate an another hardware encrypted data set by encrypting a first portion and a second portion an another data set, wherein

said means for causing said processor to encrypt said another data set employs an another key, and

said means for causing said processor to encrypt said first and second portions is performed using disparate hardware-based encryption techniques of the plurality of hardware-based encryption techniques; and

means for causing said processor to store said first portion of said another data set in said first storage medium, and

upon performance of a media-span process, storing said second portion of said another data set in a second storage medium, wherein

the second storage medium comprises

an unencrypted data structure linking the second storage medium to the first storage medium.