Cloud data management

• US 8,769,269 B2
• Filed: 08/12/2010
• Issued: 07/01/2014
• Est. Priority Date: 08/12/2010
• Status: Active Grant

• Current Assignee: Terrace Licensing LLC (IP Edge LLC)
• Original Assignee: International Business Machines Corporation
• Inventors: Anglin, Howard N., Emuchay, Nduwuisi, Leung, Wing L.
• Primary Examiner(s): Vaughan, Michael R
• Application Number:
  US12/855,323
• Publication Number:
  US 20120042162A1
• Time in Patent Office: 1,419 Days
• Field of Search: None
• US Class Current: 713/165
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

The different illustrative embodiments provide a method, computer program product, and apparatus for managing data. An encrypted file containing the data is divided into a plurality of segments. The plurality of segments are sent to a plurality of cloud computing environments for storage in the plurality of cloud computing environments. Each cloud computing environment in the plurality of cloud computing environments receives a portion of the plurality of segments. The portion of the plurality of segments is associated with a cloud computing environment in the plurality of cloud computing environments to which the portion of the plurality of segments was sent.

Claims

1. A method for managing data, the method comprising:

receiving a request from a requestor to store an encrypted file;

dividing the encrypted file containing the data into a plurality of segments;

identifying a policy for the data, wherein the request includes the policy;

using a registry to identify a set of cloud computing environments from a plurality of cloud computing environments that meet or exceed storage characteristics identified in the policy to form a plurality of selected cloud computing environments, wherein the registry comprises an identity for each of the plurality of cloud computing environments and capability characteristics for each of the plurality of cloud computing environments;

sending the plurality of segments to the plurality of selected cloud computing environments for storage in the plurality of selected cloud computing environments, wherein each cloud computing environment in the plurality of selected cloud computing environments receives a portion of the plurality of segments; and

associating the portion of the plurality of segments with a cloud computing environment in the plurality of selected cloud computing environments to which the portion of the plurality of segments was sent.

2. The method of claim 1, wherein the step of sending the plurality of segments to the plurality of selected cloud computing environments for storage in the plurality of selected cloud computing environments comprises:

using the policy to identify a level of security desired for the encrypted file;

using the registry to select certain ones of the plurality of cloud computing environments to receive the plurality of segments based on at least meeting the level of security desired for the encrypted file to form the plurality of selected cloud computing environments; and

sending the plurality of segments to the plurality of selected cloud computing environments for storage.

3. The method of claim 1, wherein the portion is a first portion, wherein the cloud computing environment is a first cloud computing environment, and wherein the first portion of the plurality of segments is sent to the first cloud computing environment and a second portion of the of the plurality of segments is sent to a second cloud computing environment in the plurality of cloud computing environments.

4. The method of claim 1, wherein the policy specifies a set of backups for each portion to be stored in the plurality of cloud computing environments, and wherein the step of sending the plurality of segments to the plurality of selected cloud computing environments for storage in the plurality of selected cloud computing environments comprises:

using the registry when identifying the plurality of selected cloud computing environments to receive the number of backups; and

sending each of the portions to the plurality of selected of cloud computing environments.

5. The method of claim 1 further comprising:

receiving a request for the data from the requestor;

identifying the plurality of segments and the plurality of selected cloud computing environments associated with the data;

requesting the plurality of segments from the plurality of selected cloud computing environments;

ordering the plurality of segments to form the data; and

transmitting the data to the requestor.

6. The method of claim 1, further comprising:

receiving updated capability characteristics from at least one of the plurality of cloud computer environments; and

updating the registry with the updated capability characteristics.

7. The method of claim 1, wherein the registry comprises an address for each of the plurality of cloud computing environments.

8. The method of claim 1, wherein the dividing, identifying, using, sending and associating steps are performed by a unified cloud storage process that receives the data from an application program requesting to store the data.

9. The method of claim 8 further comprising:

dividing each of the plurality of segments into a first plurality of subsegments prior to sending the plurality of segments to the plurality of selected cloud computing environments for storage in the plurality of selected cloud computing environments;

dividing the each of the plurality of segments into a second plurality of subsegments prior to sending the plurality of segments to the plurality of selected cloud computing environments for storage in the plurality of selected cloud computing environments, wherein the second plurality of subsegments is different in number to the first plurality of subsegments.

10. The method of claim 9, wherein the plurality of selected cloud computing environments is a first plurality of cloud computing environments, and wherein the step of sending the plurality of segments to the plurality of selected cloud computing environments for storage in the plurality of selected cloud computing environments comprises:

sending the first plurality of subsegments to the first plurality of cloud computing environments;

sending the second plurality of subsegments to a second plurality of cloud computing environments; and

maintaining a directory that indicates where the first and second plurality of subsegments are stored in the plurality of cloud computing environments.

11. A computer program product comprising:

a non-transitory computer readable storage medium;

program code, stored on the computer readable storage medium, for receiving a request from a requestor to store an encrypted file;

program code, stored on the computer readable storage medium, for dividing the encrypted file containing data into a plurality of segments;

program code, stored on the computer readable storage medium, for identifying a policy for the data, wherein the request includes the policy;

program code, stored on the computer readable storage medium, for using a registry to identify a set of cloud computing environments from a plurality of cloud computing environments that meet or exceed storage characteristics identified in the policy to form a plurality of selected cloud computing environments, wherein the registry comprises an identity for each of the plurality of cloud computing environments and capability characteristics for each of the plurality of cloud computing environments;

program code, stored on the computer readable storage medium, for sending the plurality of segments to the plurality of selected cloud computing environments for storage in the plurality of selected cloud computing environments, wherein each cloud computing environment in the plurality of selected cloud computing environments receives a portion of the plurality of segments; and

program code, stored on the computer readable storage medium, for associating the portion of the plurality of segments with a cloud computing environment in the plurality of selected cloud computing environments to which the portion of the plurality of segments was sent.

12. The computer program product of claim 11, wherein the program code, stored on the computer readable storage medium, for sending the plurality of segments to the plurality of selected cloud computing environments for storage in the plurality of selected cloud computing environments comprises:

program code, stored on the computer readable storage medium, for using the policy to identify a level of security desired for the encrypted file;

program code, stored on the computer readable storage medium, for using the registry to select certain ones of the plurality of selected cloud computing environments to receive the plurality of segments based on at least meeting the level of security desired for the encrypted file to form the plurality of selected cloud computing environments; and

program code, stored on the computer readable storage medium, for sending the plurality of segments to the plurality of selected cloud computing environments for storage.

13. The computer program product of claim 11, wherein the portion is a first portion, wherein the cloud computing environment is a first cloud computing environment, and wherein the first portion of the plurality of segments is sent to the first cloud computing environment and a second portion of the of the plurality of segments is sent to a second cloud computing environment in the plurality of cloud computing environments.

14. The computer program product of claim 11, wherein the policy specifies a set of backups for each portion to be stored in the plurality of cloud computing environments, and wherein the program code, stored on the computer readable storage medium, for sending the plurality of segments to the plurality of selected cloud computing environments for storage in the plurality of selected cloud computing environments comprises:

program code, stored on the computer readable storage medium, for using the registry when identifying the plurality of selected cloud computing environments to receive the number of backups; and

program code, stored on the computer readable storage medium, for sending each of the portions to the plurality of selected of cloud computing environments.

15. The computer program product of claim 11 further comprising:

program code, stored on the computer readable storage medium, for dividing each of the plurality of segments into a first plurality of subsegments prior to running the program code for sending the plurality of segments to the plurality of selected cloud computing environments for storage in the plurality of selected cloud computing environments; and

program code, stored on the computer readable storage medium, for dividing the each of the plurality of segments into a second plurality of subsegments prior to running the program code for sending the plurality of segments to the plurality of selected cloud computing environments for storage in the plurality of selected cloud computing environments, wherein the second plurality of subsegments is different in number to the first plurality of subsegments.

16. The computer program product of claim 15, wherein the plurality of selected cloud computing environments is a first plurality of cloud computing environments, and wherein the program code, stored on the computer readable storage medium, for sending the plurality of segments to the plurality of selected cloud computing environments for storage in the plurality of selected cloud computing environments comprises:

program code, stored on the computer readable storage medium, for sending the first plurality of subsegments to the first plurality of cloud computing environments;

program code, stored on the computer readable storage medium, for sending the second plurality of subsegments to a second plurality of cloud computing environments; and

program code, stored on the computer readable storage medium, for maintaining a directory that indicates where the first and second plurality of subsegments are stored in the plurality of cloud computing environments.

17. An apparatus comprising:

a bus system;

a storage device connected to the bus system, wherein the storage device includes program code; and

a processor unit connected to the bus system, wherein the processor unit executes the program code to receive a request from a requestor to store an encrypted file, to divide the encrypted file containing data into a plurality of segments, identify a policy for the data, wherein the request includes the policy, use a registry to identify a set of cloud computing environments from a plurality of cloud computing environments that meet or exceed storage characteristics identified in the policy to form a plurality of selected cloud computing environments, wherein the registry comprises an identity for each of the plurality of cloud computing environments and capability characteristics for each of the plurality of cloud computing environments, send the plurality of segments to the plurality of selected cloud computing environments for storage in the plurality of selected cloud computing environments, wherein each cloud computing environment in the plurality of selected cloud computing environments receives a portion of the plurality of segments, and associate the portion of the plurality of segments with a cloud computing environment in the plurality of selected cloud computing environments to which the portion of the plurality of segments was sent.