Secure File Archive through encryption key management

• US 6,754,827 B1
• Filed: 05/19/1999
• Issued: 06/22/2004
• Est. Priority Date: 02/11/1997
• Status: Expired due to Fees

• Current Assignee: Autonomy Incorporated (HP Inc.)
• Original Assignee: Connected Corporation (Iron Mountain Incorporated)
• Inventors: Cane, David, Speare, Philip, Hirschman, David, Vaitzblit, Lev
• Primary Examiner(s): Vu, Kim
• Assistant Examiner(s): Seal, James
• Application Number:
  US09/314,326
• Time in Patent Office: 1,861 Days
• Field of Search: 713/193, 713/201, 713/150, 707/200, 707/204
• US Class Current: 713/193
• CPC Class Codes: G06F 11/1446 Point-in-time backing up or restoration of persistent data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes

Abstract

An information processing system providing archive/backup support with privacy assurances by encrypting data stored thereby. Data generated on a source system is encrypted, the key used thereby is separately encrypted, and both the encrypted data and encrypted key are transmitted to and maintained by a data repository system. The repository system receives only the encrypted data and key, while the source system retains the ability to recover the key and in turn, the data. The source system is therefore assured of privacy and integrity of the archived data by retaining access control yet is relieved of the physical management of the warehousing medium.

Claims

1. A file archive system for storing encrypted files on a computer-readable volume, each encrypted file being encrypted according to a corresponding first key, the system comprising:

an archive server comprising;

a first memory subsystem configured to store the encrypted files on the computer-readable volume; and

a second memory subsystem configured to store, for each encrypted file;

the corresponding first key, according to which the encrypted file was encrypted; and

information associating the computer-readable volume, on which the encrypted file is stored, with the corresponding first key;

wherein deletion of a selected first key from the second memory subsystem effectively precludes future decryption of the encrypted file that was encrypted according to the selected first key, without requiring deletion of the encrypted file from the computer-readable volume.

2. The system of claim 1, wherein the second memory stores an index file configured to store at least one entry, each entry being associated with an encrypted file stored by the first memory, each entry including:

the first key, according to which the encrypted file is encrypted;

the information associating the computer-readable volume, on which the encrypted file is stored, with the first key; and

an identifier associated with the encrypted file.

3. The system of claim 2, wherein the index file is searchable by the identifier associated with the encrypted file.

4. The system of claim 2, wherein a plurality of encrypted files are encrypted according to the first key.

5. The system of claim 1, wherein the first memory subsystem is distinct from the second memory subsystem.

6. The archive server of claim 5, wherein the computer-readable volume comprises a removable volume.

7. The system of claim 6, wherein the computer-readable volume comprises a sequential access memory.

8. The system of claim 7, wherein the computer-readable volume comprises a magnetic tape.

9. The system of claim 8, wherein the second memory subsystem comprises a random access memory.

10. The system of claim 9, wherein the second memory subsystem comprises a disk memory.

11. The system of claim 1, further comprising a source system:

connected to the archive server by a computer network link; and

configured to encrypt a file according to the first key and send the encrypted file, via the computer network link, to the archive server for storage.

12. The system of claim 11, further comprising a key generator configured to generate the first key and provide the first key to the source system.

13. The system of claim 11, further comprising a plurality of source systems.

14. The system of claim 13, further comprising a key generator configured to generate the first key and provide the first key to the plurality of source systems.

15. The system of claim 11, further comprising a cryptographic engine configured to encrypt the first key according to a second key prior to storage of the first key on the second memory.

16. The system of claim 15, wherein the source system is further configured to decrypt the first key according to the second key.

17. The system of claim 16, wherein the source system is further configured to use the decrypted first key to decrypt the encrypted file.

18. The system of claim 15, wherein the archive server is configured to further encrypt the encrypted file.

19. The system of claim 15, wherein the archive server is configured to further encrypt the encrypted first key.

20. The system of claim 1, wherein the archive server is configured to provide:

a selected encrypted file from the first memory subsystem; and

a first key, corresponding to the selected encrypted file, from the second memory subsystem.

21. The system of claim 20, further comprising a source system connected to the archive server by a computer network link and configured to:

receive the provided selected encrypted file and the provided first key; and

decrypt the provided selected encrypted file according to the provided first key.

22. The system of claim 21, wherein:

the first key is encrypted according to a second key prior to storage on the second memory; and

the source system is further configured to decrypt the first key according to the second key prior to decrypting the provided selected encrypted file.

23. The system of claim 1, wherein the archive server is configured to delete from the second memory subsystem a first key that corresponds to a selected encrypted file, thereby effectively precluding future decryption of the selected encrypted file.

24. The system of claim 23, wherein the archive server is configured to overwrite the first key in the second memory subsystem to delete the first key.

25. The system of claim 1, wherein the first key is encrypted according to a second key prior to storage on the second memory subsystem.

26. The system of claim 25, wherein the first key is decrypted prior to using the first key to decrypt the encrypted file.

27. A method for storing a file on a computer-readable volume, the method comprising:

storing an encrypted file on the computer-readable volume; and

storing a first key, according to which the encrypted file is encrypted, and information associating the computer-readable volume with the first key in a memory subsystem distinct from the computer-readable volume;

wherein deletion of a selected first key from the memory subsystem effectively precludes future decryption of the encrypted file that was encrypted according to the selected first key, without requiring deletion of the encrypted file from the computer-readable volume.

28. The method of claim 27, further comprising:

encrypting the file according to the first key to produce the encrypted file; and

sending the encrypted file over a computer network link to a server for the storing the encrypted file on the computer-readable volume.

29. The method of claim 28, further comprising:

sending the first key over the computer network link for the storing the first key in the memory subsystem.

30. The method of claim 28, further comprising:

generating the first key.

31. The method of claim 28, further comprising:

encrypting a second file according to the first key to produce a second encrypted file;

sending the second encrypted file over the computer network link;

storing the second encrypted file on the computer-readable volume; and

storing an identifier associated with the second encrypted file in the memory subsystem.

32. The method of claim 27:

further comprising encrypting the first key according to a second key to produce an encrypted first key; and

wherein the storing the first key comprises storing the encrypted first key in the memory subsystem.

33. The method of claim 32, further comprising:

decrypting the first key; and

using the decrypted first key to decrypt the encrypted file.

34. The method of claim 32, further comprising:

providing the encrypted file from the computer-readable volume; and

providing the encrypted first key, according to which the encrypted file is encrypted, from the memory subsystem.

35. The method of claim 34, further comprising:

decrypting the encrypted first key; and

using the decrypted first key to decrypt the encrypted file.

36. The method of claim 27, further comprising:

further encrypting the encrypted file prior to storing the encrypted file on the computer-readable volume.

37. The method of claim 27, further comprising:

storing an identifier associated with the encrypted file in the memory subsystem.

38. The method of claim 27, further comprising:

providing the encrypted file from the computer-readable volume; and

providing the first key, according to which the encrypted file is encrypted, from the memory subsystem.

39. The method of claim 38, wherein the encrypted file and the first key are provided via a computer network link.

40. The method of claim 39, further comprising:

receiving the encrypted file and the first key via the computer network link; and

decrypting the received encrypted file according to the received first key.

41. The method of claim 38, wherein:

the providing the encrypted file comprises using the information associating the computer-readable volume with the first key to identify the computer-readable volume, on which the encrypted file is stored.

42. The method of claim 38:

further comprising storing an identifier associated with the encrypted file in the memory subsystem; and

wherein the providing the encrypted file comprises searching for the identifier associated with the encrypted file.

43. The method of claim 27, further comprising:

deleting a selected first key, corresponding to a selected encrypted file stored on the computer-readable volume, from the memory subsystem, thereby effectively precluding future decryption of the selected encrypted file.

44. The method of claim 43, wherein the deleting comprises overwriting the selected first key.