System and method for encrypting secondary copies of data

• US 8,775,823 B2
• Filed: 12/28/2007
• Issued: 07/08/2014
• Est. Priority Date: 12/29/2006
• Status: Active Grant

• Current Assignee: CommVault Systems Incorporated
• Original Assignee: CommVault Systems Incorporated
• Inventors: Gokhale, Parag, Erofeev, Andrei, Muller, Marcus S.
• Primary Examiner(s): CHOUDHURY, AZIZUL Q
• Application Number:
  US11/966,842
• Publication Number:
  US 20100031017A1
• Time in Patent Office: 2,384 Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/1073 Conversion
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 12/40176 involving redundancy error detection or correction of the data by redundancy in hardware using active fault-masking in interconnections G06F11/2002; error detection or correction of the data by redundancy in hardware using active fault-masking in storage systems using spares or by reconfiguring G06F11/2053
• CPC Class Codes: H04L 2209/605 Copy protection
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols

Abstract

A system and method for encrypting secondary copies of data is described. In some examples, the system encrypts a secondary copy of data after the secondary copy is created. In some examples, the system looks to information about a data storage system, and determines when and where to encrypt data based on the information.

Claims

1. A system for re-encrypting data stored as secondary copies on secondary storage media under a first encryption scheme, comprising:

a first storage processor comprising computer hardware having one or more computer processors, first storage processor configured to monitor primary data created by different software applications in a primary data production network, the primary data stored in primary storage within the primary data production network, the primary data further comprising data types associated with the native formats of the different software applications executing within the primary data production network;

a storage manager that is in communication with the primary data production network, the storage manager configured to direct the first storage processor to create at least a first copy of the primary data based on at least one backup storage policy, wherein the first copy of the primary data is stored in an unencrypted format;

an encryption tracking component executing on computer hardware comprising one or more computer processors, wherein the encryption tracking component is located remotely from the primary data production network, the encryption tracking component configured to;

selectively encrypt portions of the first copy of the primary data based on the types of data in the first copy of the primary data to create a secondary copy of the primary data on one or more secondary storage devices, the secondary copy having encrypted portions and unencrypted portions; and

maintain an index that identifies the unencrypted and encrypted portions of the secondary copy; and

a media retrieval component executing on the one or more computer processors, wherein the media retrieval component receives an indication from the encryption tracking component to change an encryption scheme for the secondary copy and retrieves at least the encrypted portions of the secondary copy associated with a first encryption scheme; and

an encryption component executing on the one or more computer processors, wherein the encryption component decrypts the encrypted portions of the secondary copy associated with the first encryption scheme and encrypts the decrypted portions of the secondary copy with a second encryption scheme, wherein the second encryption scheme was created after the secondary copy was stored on the one or more secondary storage devices, and wherein the unencrypted portions of the secondary copy remain unencrypted.

2. The system of claim 1, wherein the encryption tracking component monitors encryption schemes associated with classes of data stored as secondary copies of data.

3. A method of re-encrypting data stored as secondary copies on secondary storage media under a first encryption scheme, comprising:

monitoring primary data created by different software applications in a primary data production network, the primary data stored in primary storage within the primary data production network, the primary data further comprising data types associated with the native formats of the different software applications executing within the primary data production network;

creating with a storage manager that is in communication with the primary data production network, at least a first copy of the primary data based on at least one backup storage policy, wherein the first copy of the primary data is stored in an unencrypted format;

selectively encrypting portions of the first copy of the primary data with an encryption component that is located remotely from the primary data production network, wherein the selectively encrypting is based on the types of data in the first copy of the primary data to create a secondary copy of the primary data on one or more secondary storage devices, the secondary copy having encrypted portions and unencrypted portions;

maintaining an index that identifies the unencrypted and encrypted portions of the secondary copy;

receiving an indication to change an encryption scheme for the encrypted portions of the secondary copy;

decrypting, with one or more computer processors, the encrypted portions of the secondary copy of data associated with a first encryption scheme; and

encrypting the decrypted portions of the secondary copy with a second encryption scheme, wherein the second encryption scheme was created after the secondary copy was stored on the one or more secondary storage devices, and wherein the unencrypted portions of the secondary copy remain unencrypted.

4. The method of claim 3, wherein said monitoring comprises monitoring encryption schemes associated with classes of data stored as secondary copies of data.