System and method for encrypting secondary copies of data

• US 9,411,986 B2
• Filed: 08/07/2013
• Issued: 08/09/2016
• Est. Priority Date: 11/15/2004
• Status: Active Grant

• Current Assignee: CommVault Systems Incorporated
• Original Assignee: CommVault Systems Incorporated
• Inventors: Muller, Marcus S., Gokhale, Parag, Erofeev, Andrei
• Primary Examiner(s): Choudhury, Azizul
• Application Number:
  US13/961,315
• Publication Number:
  US 20140053002A1
• Time in Patent Office: 1,098 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/1073 Conversion
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 12/40176 involving redundancy error detection or correction of the data by redundancy in hardware using active fault-masking in interconnections G06F11/2002; error detection or correction of the data by redundancy in hardware using active fault-masking in storage systems using spares or by reconfiguring G06F11/2053
• CPC Class Codes: H04L 2209/605 Copy protection
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols

Abstract

A system and method for encrypting secondary copies of data is described. In some examples, the system encrypts a secondary copy of data after the secondary copy is created. In some examples, the system looks to information about a data storage system, and determines when and where to encrypt data based on the information.

Claims

1. A data storage system that encrypts secondary copies of data, the system comprising:

at least one computer processor comprising computer hardware, the computer processor configured to perform a storage operation that creates at least one secondary copy of data;

the computer processor further configured to calculate a completion time to create and encrypt at least a portion of the secondary copy;

when the completion time exceeds a threshold time, the computer processor is configured to transfer the secondary copy to at least one storage device without encrypting at least a portion of the secondary copy, and after transfer, encrypt one or more unencrypted portions of the secondary copy; and

when the completion time is less than the threshold time, the computer processor is configured to encrypt at least a portion of the secondary copy in association with performing the storage operation.

2. The system of claim 1, wherein the computer processor is further configured to maintain an index of encrypted and unencrypted portions of the secondary copy.

3. The system of claim 1, wherein the threshold time is static.

4. The system of claim 1, wherein the threshold time dynamically changes based on the performance of the storage operation.

5. The system of claim 1, wherein the threshold time dynamically changes based on system capacity.

6. The system of claim 1, wherein the threshold time is based on a storage window.

7. The system of claim 1, wherein the computer processor is further configured to determine which portions of the secondary copy can be stored without encryption.

8. The system of claim 1, wherein the computer processor is further configured to determine which portions of the secondary copy can be stored without encryption based on types of data.

9. The system of claim 1, further comprising a second computer processor that is remotely located from the at least one computer processor, the second computer processor configured to encrypt the unencrypted portions of the secondary copy.

10. The system of claim 1, wherein the computer processor is further configured to maintain an index of encrypted and unencrypted portions of multiple secondary copies associated with different storage operations.

11. A data storage system that that encrypts secondary copies of data, the system comprising:

at least one computer processor comprising computer hardware, the computer processor configured to perform a storage operation that creates at least one secondary copy of data;

the computer processor further configured to calculate a completion time to create and encrypt at least a portion of the secondary copy; and

when the completion time exceeds a threshold time, the computer processor is configured to transfer the secondary copy to at least one storage device without encrypting at least a portion of the secondary copy, and after transfer, encrypt one or more unencrypted portions of the secondary copy.

12. The system of claim 11, wherein the computer processor is further configured to maintain an index of encrypted and unencrypted portions of the secondary copy.

13. The system of claim 11, wherein the threshold time is static.

14. The system of claim 11, wherein the threshold time dynamically changes based on the performance of the storage operation.

15. The system of claim 11, wherein the threshold time dynamically changes based on system capacity.

16. The system of claim 11, wherein the threshold time is based on a storage window.

17. The system of claim 11, wherein the computer processor is further configured to determine which portions of the secondary copy can be stored without encryption.

18. The system of claim 11, wherein the computer processor is further configured to determine which portions of the secondary copy can be stored without encryption based on types of data.

19. The system of claim 11, further comprising a second computer processor that is remotely located from the at least one computer processor, the second computer processor configured to encrypt the unencrypted portions of the secondary copy.

20. The system of claim 11, wherein the computer processor is further configured to maintain an index of encrypted and unencrypted portions of multiple secondary copies associated with different storage operations.