Automatic file encryption

• US 9,734,348 B2
• Filed: 06/07/2016
• Issued: 08/15/2017
• Est. Priority Date: 03/12/2013
• Status: Active Grant

• Current Assignee: CommVault Systems Incorporated
• Original Assignee: CommVault Systems Incorporated
• Inventors: Erofeev, Andrei, Pawar, Rahul S.
• Primary Examiner(s): ZAIDI, SYED A
• Application Number:
  US15/175,534
• Publication Number:
  US 20170004320A1
• Time in Patent Office: 434 Days
• Field of Search: 713165
• CPC Class Codes: G06F 11/1402 Saving, restoring, recovering or retrying
• CPC Class Codes: G06F 11/1458 Management of the backup or restore process
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/70 Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2201/84 Using snapshots, i.e. a logical point-in-time copy of the data
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

A method for automatically encrypting files is disclosed. In some cases, the method may be performed by computer hardware comprising one or more processors. The method can include detecting access to a first file, which may be stored in a primary storage system. Further, the method can include determining whether the access comprises a write access. In response to determining that the access comprises a write access, the method can include accessing file metadata associated with the first file and accessing a set of encryption rules. In addition, the method can include determining whether the file metadata satisfies the set of encryption rules. In response to determining that the file metadata satisfies the set of encryption rules, the method can include encrypting the first file to obtain a first encrypted file and modifying an extension of the first encrypted file to include an encryption extension.

Claims

1. A method for displaying encrypted files, the method comprising:

by a computer system comprising one or more hardware processors and a storage;

accessing an encrypted file, the encrypted file an encrypted version of an unencrypted file, the unencrypted file having an extension that is different than an extension of the encrypted file;

accessing metadata associated with the encrypted file;

determining a file type of the unencrypted file based, at least in part, on the metadata;

determining an application associated with the unencrypted file, wherein the application is not installed on the storage of the computer system and the application is capable of processing the unencrypted file;

associating the encrypted file with the application to maintain an association between the encrypted file and the application;

determining a role of a user accessing the encrypted file; and

outputting for display a reference to the encrypted file based, at least in part, on the file type and the role of the user, wherein the reference to the encrypted file is configured to mimic, at least in part, the extension of the unencrypted file when the role of the user comprises a first role, and wherein the reference to the encrypted file includes an encryption extension when the role of the user comprises a second role.

2. The method of claim 1, wherein the application associated with the unencrypted file is determined by accessing data available on a network.

3. The method of claim 1, wherein the metadata associated with the encrypted file includes, at least in part, metadata associated with the unencrypted file.

4. The method of claim 1, wherein the reference to the encrypted file includes an icon associated with the unencrypted file.

5. The method of claim 4, wherein the icon includes an annotation indicating that the encrypted file is an encrypted version of the unencrypted file.

6. The method of claim 1, further comprising causing a file extension of the encrypted file to be hidden from display, the file extension indicating the encryption status of the encrypted file.

7. The method of claim 1, further comprising:

accessing file metadata associated with the unencrypted file;

accessing a set of encryption rules; and

determining whether the file metadata satisfies the encryption rules.

8. The method of claim 7, further comprising encrypting the unencrypted file to obtain the encrypted file in response to identifying a write command associated with the unencrypted file and determining that the file metadata satisfies the encryption rules.

9. A method for displaying encrypted files, the method comprising:

by a computer system comprising one or more hardware processors and a storage;

accessing an encrypted file, the encrypted file an encrypted version of a file;

determining a file type of the file, wherein the storage of the computer system does not include an application programmed to access the file;

associating the encrypted file with the application to maintain an association between the encrypted file and the application programmed to access the file;

determining a role of a user accessing the encrypted file; and

outputting for display a reference to the encrypted file based, at least in part, on the file type and the role of the user, wherein the reference to the encrypted file is configured to mimic, at least in part, a reference to the file when the role of the user comprises a first role, and wherein the reference to the encrypted file includes an encryption extension when the role of the user comprises a second role.

10. The method of claim 9, further comprising determining the application programmed to access the file by accessing data available on a network.

11. The method of claim 9, wherein the reference to the encrypted file includes an annotation, the annotation configured to indicate that the encrypted file is a file of the file type that has been encrypted.

12. The method of claim 9, wherein the reference to the encrypted file includes an icon associated with the file.

13. The method of claim 9, further comprising causing a file extension of the encrypted file to be hidden from display, the file extension indicating the encryption status of the encrypted file.

14. A system for displaying encrypted files, the system comprising:

a display screen configured to output a user interface;

an interface agent comprising computer hardware that includes one or more processors programmed to;

access an encrypted file, the encrypted file an encrypted version of a file, the file having an extension that is different than an extension of the encrypted file;

access metadata associated with the encrypted file;

determine a file type of the file based, at least in part, on the metadata;

determine an application associated with the file, wherein the application is not installed on a storage of the system and the application is capable of processing the file;

associate the encrypted file with the application to maintain an association between the encrypted file and the application;

determine a role of a user accessing the encrypted file; and

output for display on the display screen a reference to the encrypted file based, at least in part, on the file type and the role of the user, the reference to the encrypted file configured to mimic, at least in part, a reference to the file when the role of the user comprises a first role, and the reference to the encrypted file including an encryption extension when the role of the user comprises a second role.

15. The system of claim 14, wherein the one or more processors are further programmed to access data available on a network to determine the application associated with the file.

16. The system of claim 14, wherein the metadata associated with the encrypted file includes, at least in part, metadata associated with the file.

17. The system of claim 14, wherein the reference to the encrypted file includes an icon associated with the unencrypted file.

18. The system of claim 17, wherein the icon includes an annotation indicating that the encrypted file is an encrypted version of the unencrypted file.

19. The system of claim 14, wherein the one or more processors are further programmed to cause a file extension of the encrypted file to be hidden from display on the display screen, the file extension indicating the encryption status of the encrypted file.

20. The system of claim 14, wherein the reference to the encrypted file is further based, at least in part, on an identity of the application.