System and method for secure storage, transfer and retrieval of content addressable information

• US 9,497,062 B1
• Filed: 07/24/2012
• Issued: 11/15/2016
• Est. Priority Date: 09/07/1999
• Status: Expired due to Term

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Inventors: Carpentier, Paul R., Van Riel, Jan F., Teugels, Tom
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Truvan, Leynna
• Application Number:
  US13/556,862
• Time in Patent Office: 1,575 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/30 of unstructured textual data document management systems G06F16/93
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 69/00 Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass networks security protocols H04L9/40; wireless communication networks H04W
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99953 Recoverability

Abstract

An algorithm (such as the MD5 hash function) is applied to a file to produce an intrinsic unique identifier (IUI) for the file (or message digest). The file is encrypted using its IUI as the key for the encryption algorithm. An algorithm is then applied to the encrypted file to produce an IUI for the encrypted file. The encrypted file is safely stored or transferred within a network and is uniquely identifiable by its IUI. The encrypted file is decrypted using the IUI of the plaintext file as the key. The IUI serves as both a key to decrypt the file and also as verification that the integrity of the plaintext file has not been compromised. IUIs for any number of such encrypted files may be assembled into a descriptor file that includes meta data for each file, the IUI of the plaintext file and the IUI of the encrypted file. An algorithm is applied to the descriptor file to produce an IUI for the descriptor file. The plaintext descriptor file is then encrypted using the descriptor file IUI as a key for the encryption algorithm. An algorithm is applied to the encrypted descriptor file to produce an IUI for the encrypted descriptor file. The IUI of the encrypted descriptor file is a location-independent identifier to locate the encrypted descriptor file. A flattened descriptor file includes the IUIs of encrypted data files and the IUI of the encrypted descriptor file. An algorithm is applied to the flattened descriptor file to produce its own IUI.

Claims

1. A method of managing a plurality of digital assets stored in a computer system comprising at least a first computer, each of the plurality of digital assets accessible via a corresponding identifier generated based on at least a portion of the contents of the digital asset, the plurality of digital assets comprising a first digital asset, the first digital asset comprising encrypted data and having associated metadata, wherein the first digital asset is stored in an encrypted format, the method comprising acts of:

(A) creating a first descriptor file that comprises at least some of the metadata associated with the first digital asset, including the corresponding identifier of the first digital asset, and at least one searchable keyword that describes the encrypted data of the first digital asset; and

(B) storing the first descriptor file on the computer system, wherein the first descriptor file is accessible as one of the plurality of digital assets via a corresponding identifier for the first descriptor file generated based on at least a portion of the contents of the first descriptor file, and wherein the first descriptor file is stored in an unencrypted format; and

(C) creating the corresponding identifier for the first descriptor file, the corresponding identifier being a unique identifier comprising information that identifies the first descriptor file as belonging to a class of digital assets that comprise metadata relating to other digital assets.

2. The method of claim 1, wherein the at least one searchable keyword is descriptive of the first digital asset.

3. The method of claim 1, further comprising an act of:

(D) creating the corresponding identifier for the first digital asset, the corresponding identifier being a unique identifier for the first digital asset comprising information that identifies the first digital asset as belonging to a class of digital assets that do not comprise metadata relating to other digital assets.

4. The method of claim 1, wherein the first computer manages storage of the second digital asset, and wherein the act (B) comprises an act of storing the second digital asset on the first computer.

5. The method of claim 1, wherein the first digital asset comprises content, and wherein the identifier of the first digital asset is based, at least in part, on a cryptographic hash of at least some of the content of the first digital asset.

6. At least one non-transitory computer readable medium encoded with instruction that, when executed on a computer system, perform a method of managing a plurality of digital assets stored in the computer system, wherein the computer system comprises at least a first computer, the plurality of digital assets comprising a first digital asset, the first digital asset comprising encrypted data and having associated metadata, wherein the first digital asset is stored in an encrypted format and is accessible via a corresponding identifier generated based on at least a portion of the contents of the digital asset, the method comprising acts of:

(A) creating a first descriptor file that comprises the corresponding identifier of the first digital asset and at least some of the metadata associated with the first digital asset, including at least one searchable keyword that describes the encrypted data of the first digital asset; and

(B) storing the first descriptor file on the computer system, wherein the first descriptor file is accessible to a file system of the computer system as one of the plurality of digital assets via a corresponding identifier for the first descriptor file generated based on at least a portion of the contents of the first descriptor file, and wherein the first descriptor file is stored in an unencrypted format; and

(C) creating the corresponding identifier for the first descriptor file, the corresponding identifier being a unique identifier comprising information that identifies the first descriptor file as belonging to a class of digital assets that comprise metadata relating to other digital assets.

7. The at least one non-transitory computer readable medium of claim 6, wherein the at least one searchable keyword is descriptive of the first digital asset.

8. The at least one non-transitory computer readable medium of claim 6, wherein the method further comprises an act of:

(D) creating the corresponding identifier for the first digital asset, the corresponding identifier being a unique identifier for the first digital asset comprising information that identifies the first digital asset as belonging to a class of digital assets that do not comprise metadata relating to other digital assets.

9. The at least one non-transitory computer readable medium of claim 6, wherein the first computer manages storage of the second digital asset, and wherein the act (B) comprises an act of storing the second digital asset on the first computer.

10. The at least one non-transitory computer readable medium of claim 6, wherein the first computer manages storage of the second digital asset, and wherein the act (B) comprises an act of storing the second digital asset on a storage device managed by the first computer.

11. At least one computer, in a computer system, for managing a plurality of digital assets stored in the computer system, each of the plurality of digital assets accessible via an identifier of a first type, wherein the plurality of digital assets comprises a first digital asset, the first digital asset comprising encrypted data and having associated metadata, wherein the first digital asset is stored in an encrypted format, the at least one computer comprising:

at least one storage device; and

at least one controller, coupled to the at least one storage device, that;

(A) creates a first descriptor file that comprises at least the identifier associated with the first digital asset and at least one searchable keyword that describes the encrypted data of the first digital asset; and

(B) stores, on the at least one storage device, the first descriptor file, wherein the first descriptor file is accessible as one of the plurality of digital assets via an identifier of the first type, and wherein the first descriptor file is stored in an unencrypted format; and

(C) creates the corresponding identifier for the first descriptor file, the corresponding identifier being a unique identifier comprising information that identifies the first descriptor file as belonging to a class of digital assets that comprise metadata relating to other digital assets.

12. The at least one computer of claim 11, wherein the at least one searchable keyword is descriptive of the first digital asset.

13. The at least one computer of claim 12, wherein the at least one controller creates the first descriptor file so that the at least some of the metadata associated with the first digital asset includes the at least one searchable keyword.

14. The at least one computer of claim 13, wherein the at least one controller:

(D) creates the corresponding identifier for the first digital asset, the corresponding identifier being a unique identifier for the first digital asset comprising information that identifies the first digital asset as belonging to a class of digital assets that do not comprise metadata relating to other digital assets.

15. The at least one computer of claim 14, wherein the at least one computer manages storage of the second digital asset, and wherein the at least one controller stores the second digital asset on the at least one storage device.