Block-level data storage security system

• US 9,384,149 B2
• Filed: 03/15/2013
• Issued: 07/05/2016
• Est. Priority Date: 01/31/2005
• Status: Active Grant

• Current Assignee: Unisys Corporation
• Original Assignee: Unisys Corporation
• Inventors: French, Albert, Johnson, Robert, Dodgson, David, Neill, Joseph, Farina, Ralph, Chin, Edward, Summers, Scott
• Primary Examiner(s): Jeudy, Josnel
• Application Number:
  US13/835,185
• Publication Number:
  US 20130311789A1
• Time in Patent Office: 1,208 Days
• Field of Search: 380 28- 30, 380 44- 47, 713151-153
• US Class Current: 1/1
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A secure storage appliance is disclosed, along with methods of storing and reading data in a secure storage network. The secure storage appliance is configured to present to a client a virtual disk, the virtual disk mapped to the plurality of physical storage devices. The secure storage appliance is capable of executing program instructions configured to generate a plurality of secondary blocks of data by performing splitting and encrypting operations on a block of data received from the client for storage on the virtual disk and reconstitute the block of data from at least a portion of the plurality of secondary blocks of data stored in shares on corresponding physical storage devices in response to a request from the client.

Claims

1. A method of securely storing data in a network, the method comprising:

receiving a block of data from a client device;

splitting the block of data into a predetermined number of secondary blocks of data, each of the secondary blocks of data associated with one of a plurality of shares;

encrypting the plurality of shares with a corresponding number of different session keys, each of the session keys associated with a different physical storage device from among a plurality of physical storage devices; and

storing each secondary block of data and session key used to encrypt the secondary block of data in the share associated with the session key;

encrypting each session key with a workgroup key prior to storing the session key on the physical storage device associated with the session key, wherein the workgroup key is associated with a community of interest capable of accessing the data;

wherein the session keys are associated with a virtual disk associated with one or more communities of interest providing access to shares only to members of associated communities of interest.

2. The method of claim 1, wherein the workgroup key is stored on a key management server separate from the plurality of physical storage devices.

3. The method of claim 1, wherein receiving data from the client device comprises receiving a write request from the client device, the write request associated with the virtual disk.

4. The method of claim 1, wherein the virtual disk provides access to a volume mapped to a plurality of the physical storage devices.

5. The method of claim 4, wherein the virtual disk appears to the client as a physical storage location.

6. The method of claim 1, further comprising storing metadata defining the predetermined number of shares in a database accessible to the secure storage appliance.

7. A method of reading secured data in a network, the method comprising:

receiving a request from a client device to read a block of data managed by a secure storage appliance;

determining a number of secondary blocks of data required to reconstitute the block of data;

transmitting a request for the number of secondary blocks of data to a plurality of shares located at a plurality of physical storage devices, the plurality of shares corresponding to the number of secondary blocks of data required to reconstitute the block of data, each of the secondary blocks of data representing a portion of the block of data encrypted by a different session key;

encrypting each session key with a workgroup key prior to storing the session key on the physical storage device associated with the session key, wherein the workgroup key is associated with a community of interest capable of accessing the data;

receiving at least the number of secondary blocks of data required to reconstitute the block of data from the plurality of shares;

reconstituting the block of data from the secondary blocks of data by decrypting each of the shares received from the physical storage devices using session keys associated with each of the physical storage devices; and

transmitting the reconstituted block of data to the client device;

wherein the different session keys are associated with a virtual disk associated with one or more communities of interest providing access to shares only to members of associated communities of interest.

8. The method of claim 7, further comprising decrypting each of the session keys with the workgroup key prior to decrypting the shares.

9. The method of claim 8, wherein the workgroup key is associated with a community of interest capable of accessing the virtual disk.

10. The method of claim 8, wherein the workgroup key is stored on a key management server separate from the physical storage devices.

11. The method of claim 7, wherein each of the session keys is stored at the physical storage device associated with that session key.

12. The method of claim 7, wherein the number of secondary blocks of data required to reconstitute the block of data is less than the number of secondary blocks of data stored on the physical storage devices.

13. A secure storage network comprising:

a client;

a plurality of physical storage devices having stored thereon a plurality of shares having associated therewith a corresponding plurality of session keys; and

a secure storage appliance configured to present to the client a virtual disk, the virtual disk mapped to the plurality of physical storage devices, the secure storage appliance configured to;

generate a plurality of secondary blocks of data by performing splitting and encrypting operations on a block of data received from the client for storage on the virtual disk;

storing the plurality of secondary blocks of data and session key used to encrypt the secondary block of data in the share associated with the session key within data storage associated with the virtual disk;

reconstitute the block of data from at least a portion of the plurality of secondary blocks of data stored on corresponding physical storage devices in response to a request from the client, wherein each physical storage device is associated with a plurality of different session keys, each of the different session keys corresponding to a different virtual disk; and

transmitting the reconstituted block of data to the client device;

a workgroup key configured to be used in encrypting each session key prior to storing the session key on the physical storage associated with the session key, wherein the workgroup key is associated with one or more communities of interest capable of accessing the data; and

wherein the session keys are associated with the one or more communities of interest providing access to shares only to members of the one or more communities of interest.

14. The secure storage network of claim 13, wherein the secure storage appliance performs a cryptographic splitting operation to generate the plurality of shares.

15. The secure storage network of claim 13, further comprising a plurality of secure storage appliances.

16. The secure storage network of claim 13, wherein the workgroup key is associated with the virtual disk.

17. A secure storage appliance configured to present to a client a virtual disk located on a network, the virtual disk mapped to the a plurality of physical storage devices located on a network, the secure storage appliance capable of executing program instructions configured to:

generating a plurality of secondary blocks of data by performing splitting and encrypting operations on a block of data received from the client using a corresponding number of different session keys, each of the session keys associated with a different physical storage device from among a plurality of physical storage devices, for storage on the virtual disk, the virtual disk associated with one or more communities of interest;

storing the plurality of secondary blocks of data and session key used to encrypt the secondary block of data in the share associated with the session key within data storage associated with the virtual disk;

encrypting each session key with a workgroup key prior to storing the session key on the physical storage device associated with the session key, wherein the workgroup key is associated with a community of interest capable of accessing the data;

reconstituting the block of data from at least a portion of the plurality of secondary blocks of data stored on corresponding physical storage devices associated with the virtual disk in response to a request from the client; and

transmitting the reconstituted block of data to the client device;

wherein the session keys are associated with the virtual disk associated with one or more communities of interest providing access to shares only to members of associated communities of interest.

18. The secure storage appliance of claim 17, wherein the secure storage appliance is configured to perform a cryptographic splitting operation to generate a plurality of shares.