File backup with selective encryption

• US 9,483,655 B2
• Filed: 09/30/2013
• Issued: 11/01/2016
• Est. Priority Date: 03/12/2013
• Status: Active Grant

• Current Assignee: CommVault Systems Incorporated
• Original Assignee: CommVault Systems Incorporated
• Inventors: Erofeev, Andrei, Pawar, Rahul S.
• Primary Examiner(s): Jhaveri, Jayesh
• Application Number:
  US14/042,095
• Publication Number:
  US 20140281517A1
• Time in Patent Office: 1,128 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/1402 Saving, restoring, recovering or retrying
• CPC Class Codes: G06F 11/1458 Management of the backup or restore process
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/70 Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2201/84 Using snapshots, i.e. a logical point-in-time copy of the data
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

A method for automatically encrypting files is disclosed. In some cases, the method may be performed by computer hardware comprising one or more processors. The method can include detecting access to a first file, which may be stored in a primary storage system. Further, the method can include determining whether the access comprises a write access. In response to determining that the access comprises a write access, the method can include accessing file metadata associated with the first file and accessing a set of encryption rules. In addition, the method can include determining whether the file metadata satisfies the set of encryption rules. In response to determining that the file metadata satisfies the set of encryption rules, the method can include encrypting the first file to obtain a first encrypted file and modifying an extension of the first encrypted file to include an encryption extension.

Claims

1. A method for backing up a file, the method comprising:

receiving, at a media agent hosted by a secondary computing device comprising one or more hardware processors, a command from a storage manager to backup a file at a secondary storage device, the storage manager comprising one or more hardware processors programmed to manage data within an information management system comprising a plurality of client computing devices and a plurality of secondary computing devices;

receiving the file at the media agent from a data agent hosted by a client computing device from the plurality of client computing devices, wherein the client computing device differs from the secondary computing device, wherein the media agent is programmed as an interface to the secondary storage device for the client computing device, and wherein the data agent is programmed as a data manager at the client computing device for managing data, including the file, stored at a primary storage device;

determining whether the file is an encrypted file;

in response to determining that the file is an encrypted file;

identifying an encryption algorithm used to encrypt the file;

storing metadata associated with the file, the metadata including an identity of the encryption algorithm; and

storing the file at the secondary storage device without performing an encryption process; and

in response to determining that the file is not an encrypted file;

encrypting the file to obtain an encrypted file; and

storing the encrypted file at the secondary storage device.

2. The method of claim 1, wherein the command is received as part of an execution of a backup policy.

3. The method of claim 1, further comprising determining whether the file is an encrypted file based, at least in part, on a file extension of the file.

4. The method of claim 1, further comprising determining whether the file is an encrypted file based, at least in part, on the command received from the storage manager.

5. The method of claim 1, wherein, in response to determining that the file is not an encrypted file, the method further comprises:

selecting an encryption algorithm for encrypting the file; and

storing metadata associated with the file, the metadata including an identity of the encryption algorithm.

6. The method of claim 5, wherein the encryption algorithm is selected based, at least in part, on the command received from the storage manager.

7. The method of claim 1, wherein the secondary storage device is one of a plurality of secondary storage devices.

8. The method of claim 7, further comprising selecting the secondary storage device from the plurality of secondary storage devices based, at least in part, on the command received from the storage manager file.

9. The method of claim 1, wherein, in response to determining that the file is an encrypted file, the method further comprises storing a cached copy of the file at the media agent.

10. The method of claim 1, wherein, in response to determining that the file is not an encrypted file, the method further comprises storing a cached copy of the encrypted file at the media agent.

11. A system for backing up a file, the system comprising:

a primary storage device configured to store a set of files;

a secondary storage device configured to store a backup of a file from the set of files;

a storage manager comprising one or more hardware processors programmed to manage data within an information management system comprising a plurality of client computing devices and a plurality of secondary computing devices, the storage manager programmed to initiate the backup of the file, wherein initiating the backup of the file comprises sending a first backup command to a data agent;

the data agent hosted by a client computing device from the plurality of client computing devices, wherein the client computing device differs from a secondary computing device, and wherein the data agent is programmed as a data manager at the client computing device for managing data, including the file, stored at the primary storage device, and wherein the data agent is further programmed to provide the file to a media agent responsive to receiving the first backup command; and

the media agent hosted by the secondary computing device comprising one or more hardware processors, wherein the media agent is programmed as an interface to the secondary storage device for the client computing device, and wherein the media agent is further programmed to;

receive the file from the data agent;

determine whether the file is an encrypted file;

in response to determining that the file is an encrypted file;

identify an encryption algorithm used to encrypt the file;

store metadata associated with the file, the metadata including an identity of the encryption algorithm; and

store the file at the secondary storage device without performing an encryption process; and

in response to determining that the file is not an encrypted file, encrypt the file to obtain an encrypted file and store the encrypted file at the secondary storage device.

12. The system of claim 11, wherein the storage manager is further configured to send a second backup command to the media agent.

13. The system of claim 12, wherein the media agent is further configured to select the secondary storage device from a plurality of secondary storage devices based, at least in part, on the second backup command.

14. The system of claim 12, wherein the media agent is further configured to select the encryption algorithm based, at least in part, on the second backup command.

15. The system of claim 11, wherein providing the file to the media agent comprises providing a copy of the file to the media agent.

16. The system of claim 11, wherein the media agent is further configured to identify an encryption algorithm used to encrypt the file in response to determining that the file is encrypted.

17. The system of claim 16, further comprising a media agent database configured to store metadata associated with the file, wherein the media agent is further configured to store the identity of the encryption algorithm at the media agent database.

18. The system of claim 16, wherein the secondary storage device is one of a plurality of secondary storage devices and wherein the metadata includes the identity of the secondary storage device that includes the backup of the file.

19. The system of claim 11, wherein the data agent is one of a plurality of data agents and wherein the data agent is selected from the plurality of data agents based, at least in part, on a file type of the file.

20. The system of claim 11, wherein the media agent is further configured to store, for a time period, a cached copy of the file stored at the secondary storage device.