Methods for secure multi-enterprise storage

• US 8,612,400 B2
• Filed: 05/30/2012
• Issued: 12/17/2013
• Est. Priority Date: 03/02/2011
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Van Buskirk, Ronald E. II, Wright, David L.
• Primary Examiner(s): Lewis, Cheryl
• Assistant Examiner(s): Hoffler, Raheem
• Application Number:
  US13/484,211
• Publication Number:
  US 20120239632A1
• Time in Patent Office: 566 Days
• Field of Search: None
• US Class Current: 707/692
• CPC Class Codes: G06F 16/125 characterised by the use of retention policies retention policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/162 Delete operations erasing in storage systems G06F3/0652
• CPC Class Codes: G06F 16/174 Redundancy elimination performed by the file system management of the data involved in backup or backup restore using de-duplication of the data G06F11/14
• CPC Class Codes: G06F 16/1748 De-duplication implemented within the file system, e.g. based on file segments de-duplication techniques in storage systems for the management of data blocks G06F3/0641
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Abstract

A method in one embodiment includes receiving a data identifier (ID) associated with each of a plurality of files from multiple data providers; storing the data ID associated with each of the plurality of files to a database; identifying any duplicate data IDs in the database to determine if any of the plurality of files associated with the data IDs are non-confidential; querying one of the data providers which provided the file having the duplicate data ID to determine; receiving a response from the data provider indicating whether or not to store the file having the duplicate data ID to the storage network; receiving one of the files having a duplicate data ID from the data provider; storing the file having the duplicate data ID to the storage network; and causing deletion of the file having the duplicate data ID that is stored to the storage network.

Claims

1. A method, comprising:

receiving a data identifier (ID) associated with each of a plurality of files from multiple data providers;

storing the data ID associated with each of the plurality of files to a database;

identifying any duplicate data IDs in the database to determine whether any of the plurality of files associated with the data IDs are non-confidential prior to receiving any non-confidential files, wherein presence of any duplicate data IDs indicates that files corresponding to the duplicate data IDs are duplicates of one another;

querying one of the data providers which provided a file having a duplicate data ID to determine whether the data provider wants to store the file having the duplicate data ID to a storage network prior to receiving the file having the duplicate data ID;

receiving a response from the data provider indicating whether or not to store the file having the duplicate data ID to the storage network prior to receiving the file having the duplicate data ID;

receiving the file having the duplicate data ID from the data provider only when the data provider responds affirmatively to store the file having the duplicate data ID;

storing the file having the duplicate data ID to the storage network; and

causing deletion of an instance of the file having the duplicate data ID that is stored to the storage network from a system of the data provider from which the file having the duplicate data ID was received,

wherein each data ID is unique to each different file and is only duplicated when the different files are duplicates of one another, and

wherein each data ID is a cryptographic hash.

2. The method as recited in claim 1, further comprising:

creating an access list for a first file stored to the storage network; and

populating the access list with any data providers that have authority to access the first file stored to the storage network,

wherein the access list is created when more than one data provider has requested storage of the first file to the storage network.

3. The method as recited in claim 2, wherein any data providers have access to the first file stored to the storage network when a data ID associated with the first file is received from those data providers indicating that the first file was stored in a system of those data providers.

4. The method as recited in claim 1, wherein the database is a remotely accessible database.

5. The method as recited in claim 1, further comprising:

creating an access list for each file stored to the storage network; and

populating the access list with any data providers that have authority to access each file.

6. The method as recited in claim 5, wherein the access list is created when any duplicate data IDs are identified in the database.

7. The method as recited in claim 5, wherein a data provider has access to each file stored to the storage network that has a data ID associated therewith that is received from the data provider indicating that the file was stored in a system of that data provider.

8. The method as recited in claim 1, further comprising:

scanning one or more publicly accessible media content providers to determine when any of the plurality of files exist on the one or more publicly accessible media content providers; and

providing access to any of the plurality of files that exist on the one or more publicly accessible media content providers from the one or more publicly accessible media content providers with the proviso that any of the plurality of files that exist on the one or more publicly accessible media content providers are not stored to the storage network.

9. The method as recited in claim 1, further comprising charging each data provider which provides any of the plurality of files to be stored to the storage network an amount of money corresponding to a storage size of one or more files provided by each data provider.

10. The method as recited in claim 9, wherein each data provider which provides any of the plurality of files to be stored to the storage network is charged a reduced amount of money based on an extent of sharing, among other data providers, of the plurality of files on the storage network.

11. The method as recited in claim 1, wherein the storage network is implemented as a cloud storage network.