Block-level data storage security system
First Claim
1. A method of securely storing data in a network, the method comprising:
- receiving a block of data from a client device;
splitting the block of data into a predetermined number of secondary blocks of data, each of the secondary blocks of data associated with one of a plurality of shares;
encrypting the plurality of shares with a corresponding number of different session keys, each of the session keys associated with a different physical storage device from among a plurality of physical storage devices; and
storing each secondary block of data and session key used to encrypt the secondary block of data in the share associated with the session key;
encrypting each session key with a workgroup key prior to storing the session key on the physical storage device associated with the session key, wherein the workgroup key is associated with a community of interest capable of accessing the data;
wherein the session keys are associated with a virtual disk associated with one or more communities of interest providing access to shares only to members of associated communities of interest.
7 Assignments
0 Petitions
Accused Products
Abstract
A secure storage appliance is disclosed, along with methods of storing and reading data in a secure storage network. The secure storage appliance is configured to present to a client a virtual disk, the virtual disk mapped to the plurality of physical storage devices. The secure storage appliance is capable of executing program instructions configured to generate a plurality of secondary blocks of data by performing splitting and encrypting operations on a block of data received from the client for storage on the virtual disk and reconstitute the block of data from at least a portion of the plurality of secondary blocks of data stored in shares on corresponding physical storage devices in response to a request from the client.
-
Citations
18 Claims
-
1. A method of securely storing data in a network, the method comprising:
-
receiving a block of data from a client device; splitting the block of data into a predetermined number of secondary blocks of data, each of the secondary blocks of data associated with one of a plurality of shares; encrypting the plurality of shares with a corresponding number of different session keys, each of the session keys associated with a different physical storage device from among a plurality of physical storage devices; and storing each secondary block of data and session key used to encrypt the secondary block of data in the share associated with the session key; encrypting each session key with a workgroup key prior to storing the session key on the physical storage device associated with the session key, wherein the workgroup key is associated with a community of interest capable of accessing the data; wherein the session keys are associated with a virtual disk associated with one or more communities of interest providing access to shares only to members of associated communities of interest. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. A method of reading secured data in a network, the method comprising:
-
receiving a request from a client device to read a block of data managed by a secure storage appliance; determining a number of secondary blocks of data required to reconstitute the block of data; transmitting a request for the number of secondary blocks of data to a plurality of shares located at a plurality of physical storage devices, the plurality of shares corresponding to the number of secondary blocks of data required to reconstitute the block of data, each of the secondary blocks of data representing a portion of the block of data encrypted by a different session key; encrypting each session key with a workgroup key prior to storing the session key on the physical storage device associated with the session key, wherein the workgroup key is associated with a community of interest capable of accessing the data; receiving at least the number of secondary blocks of data required to reconstitute the block of data from the plurality of shares; reconstituting the block of data from the secondary blocks of data by decrypting each of the shares received from the physical storage devices using session keys associated with each of the physical storage devices; and transmitting the reconstituted block of data to the client device; wherein the different session keys are associated with a virtual disk associated with one or more communities of interest providing access to shares only to members of associated communities of interest. - View Dependent Claims (8, 9, 10, 11, 12)
-
-
13. A secure storage network comprising:
-
a client; a plurality of physical storage devices having stored thereon a plurality of shares having associated therewith a corresponding plurality of session keys; and a secure storage appliance configured to present to the client a virtual disk, the virtual disk mapped to the plurality of physical storage devices, the secure storage appliance configured to; generate a plurality of secondary blocks of data by performing splitting and encrypting operations on a block of data received from the client for storage on the virtual disk; storing the plurality of secondary blocks of data and session key used to encrypt the secondary block of data in the share associated with the session key within data storage associated with the virtual disk; reconstitute the block of data from at least a portion of the plurality of secondary blocks of data stored on corresponding physical storage devices in response to a request from the client, wherein each physical storage device is associated with a plurality of different session keys, each of the different session keys corresponding to a different virtual disk; and transmitting the reconstituted block of data to the client device; a workgroup key configured to be used in encrypting each session key prior to storing the session key on the physical storage associated with the session key, wherein the workgroup key is associated with one or more communities of interest capable of accessing the data; and wherein the session keys are associated with the one or more communities of interest providing access to shares only to members of the one or more communities of interest. - View Dependent Claims (14, 15, 16)
-
-
17. A secure storage appliance configured to present to a client a virtual disk located on a network, the virtual disk mapped to the a plurality of physical storage devices located on a network, the secure storage appliance capable of executing program instructions configured to:
-
generating a plurality of secondary blocks of data by performing splitting and encrypting operations on a block of data received from the client using a corresponding number of different session keys, each of the session keys associated with a different physical storage device from among a plurality of physical storage devices, for storage on the virtual disk, the virtual disk associated with one or more communities of interest; storing the plurality of secondary blocks of data and session key used to encrypt the secondary block of data in the share associated with the session key within data storage associated with the virtual disk; encrypting each session key with a workgroup key prior to storing the session key on the physical storage device associated with the session key, wherein the workgroup key is associated with a community of interest capable of accessing the data; reconstituting the block of data from at least a portion of the plurality of secondary blocks of data stored on corresponding physical storage devices associated with the virtual disk in response to a request from the client; and transmitting the reconstituted block of data to the client device; wherein the session keys are associated with the virtual disk associated with one or more communities of interest providing access to shares only to members of associated communities of interest. - View Dependent Claims (18)
-
Specification