Group based complete and incremental computer file backup system, process and apparatus

• US 9,037,545 B2
• Filed: 09/19/2011
• Issued: 05/19/2015
• Est. Priority Date: 05/05/2006
• Status: Active Grant

• Current Assignee: Hybir Inc.
• Original Assignee: Hybir Inc.
• Inventors: Young, Hadley Rasch
• Primary Examiner(s): Nguyen, Cam-Linh
• Assistant Examiner(s): DAYE, CHELCIE L
• Application Number:
  US13/236,257
• Publication Number:
  US 20120005479A1
• Time in Patent Office: 1,338 Days
• Field of Search: 707/646, 707/681, 711/162, 713/168, 713/171
• US Class Current: 707/646
• CPC Class Codes: G06F 11/1004 to protect a block of data words, e.g. CRC or checksum G06F11/1076 takes precedence; security arrangements for protecting computers or computer systems against unauthorized activity G06F21/00
• CPC Class Codes: G06F 11/1451 by selection of backup contents
• CPC Class Codes: G06F 11/1453 using de-duplication of the data
• CPC Class Codes: G06F 11/1464 for networked environments
• CPC Class Codes: G06F 16/113 Details of archiving lifecycle management in storage systems G06F3/0649; backup systems G06F11/1446
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/178 Techniques for file synchronisation in file systems
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2201/80 Database-specific techniques
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

The present invention is capable of determining the rights to a file based on providing a descriptor. The descriptor can be calculated using an algorithm, which may be cryptographic and/or non-cryptographic. The descriptor may further be based on the file contents, metadata of the file, other file data, or any combination thereof to uniquely identify the file in a shared file repository. Since the descriptor is generated based on file data it will be the same regardless of which user generates it. Accordingly, only one copy of the file needs to be maintained in the shared file repository, thereby reducing the amount of network bandwidth required to assure the file is backed up and further reducing the amount of storage required to backup the files. This results in a vastly more efficient method of backup in terms of processing time, network bandwidth, and storage requirements.

Claims

1. A method of managing data in an encrypted system comprising a backup server and a client device having a first remote storage medium, the client device and backup server being configured to exchange encrypted communications with one another, the method comprising:

receiving, at the client device, a request to backup data from the first remote storage medium to the backup server;

in response to receiving the request, initiating a backup routine at the client device, the backup routine comprising;

identifying a first set of files stored on the first remote storage medium;

generating, at the client device, a cryptographic signature value for each file in the first set of files, wherein the cryptographic signature value is computed by using actual data of the file as an input to a cryptographic signature generating algorithm which computes the cryptographic signature value;

generating, at the client device, a first inventory for the first set of files, wherein the first inventory reflects a current state of the first remote storage medium, and wherein the first inventory includes the cryptographic signature value generated for each file in the first set of files;

transmitting the first inventory from the client device to the backup server via one or more encrypted communications; and

causing one or more files from the first set of files to be transmitted to the backup server for storage by the backup server upon determining that the cryptographic signature values generated for each file in the first set of files allows access to the one or more files on the backup server.

2. The method of claim 1, further comprising:

receiving a second inventory at the client device, the second inventory including cryptographic signature values found by the backup server in the first inventory and not found in a list containing all cryptographic signature values identifying actual data currently stored by the backup server; and

wherein the one or more files from the first set of files corresponds to every file in the first set of files having a cryptographic signature corresponding to a cryptographic signature found in the second inventory.

3. The method of claim 2, wherein the one or more files from the first set of files does not include every file in the first set of files.

4. The method of claim 1, wherein the cryptographic signature values substantially uniquely identify at least one of a file and data structure that is on the first remote storage medium.

5. The method of claim 1, wherein the cryptographic signature values are generated with at least a 256-bit encryption algorithm.

6. The method of claim 1, wherein the communications between the client device and backup server are encrypted with an encryption algorithm.

7. The method of claim 1, further comprising:

compressing the one or more files prior to causing the one or more files to be transmitted to the backup server.

8. The method of claim 1, wherein the communications between the client device and backup server are transmitted across a secure packet-based network.

9. The method of claim 1, wherein the cryptographic signature values comprise multiple file signatures using multiple cryptographic algorithms.

10. A client device configured to exchange encrypted communications with a backup server over a communication network, the client device comprising:

a first remote storage medium; and

a backup application configured to execute a backup routine comprising;

identifying a first set of files stored on the first remote storage medium;

generating a cryptographic signature value for each file in the first set of files, wherein the cryptographic signature value is computed by using actual data of the file as an input to a cryptographic signature generating algorithm which computes the cryptographic signature value;

generating a first inventory for the first set of files, wherein the first inventory reflects a current state of the first remote storage medium, and wherein the first inventory includes the cryptographic signature values generated for each file in the first set of files;

transmitting the first inventory from the client device to the backup server via one or more encrypted communications; and

causing one or more files from the first set of files to be transmitted to the backup server for storage by the backup server upon determining that the cryptographic signature value generated for each file in the first set of files allows access to the one or more files on the backup server.

11. The client device of claim 10, wherein the first set of files is determined by scanning a list of files stored in the first remote storage medium and identifying the first set of files as being one of new and changed since a last backup operation was performed.

12. The client device of claim 10, wherein the backup application is further configured to receive a second inventory, the second inventory including cryptographic signature values found by the backup server in the first inventory and not found in a list containing all cryptographic signature values identifying actual data currently stored by the backup server, and wherein the one or more files from the first set of files corresponds to every file in the first set of files having a cryptographic signature corresponding to a cryptographic signature found in the second inventory.

13. The client device of claim 12, wherein the one or more files from the first set of files does not include every file in the first set of files and wherein the first inventory includes a description of the hierarchical structure of the first remote storage medium.

14. The client device of claim 10, wherein the cryptographic signature values substantially uniquely identify at least one of a file and data structure that is on the first remote storage medium.

15. The client device of claim 10, wherein the cryptographic signature values are generated with at least one encryption algorithm for portions of data having a predetermined length that is less than a length of the file.

16. The client device of claim 10, wherein the communications between the client device and backup server are encrypted with an encryption algorithm.

17. The client device of claim 10, wherein the backup application is further configured to compress the one or more files prior to causing the one or more files to be transmitted to the backup server.

18. The client device of claim 10, wherein the communications between the client device and backup server are transmitted across a secure packet-based network.

19. The client device of claim 10, wherein the cryptographic signature values comprise multiple file signatures using multiple cryptographic algorithms.

20. A backup server configured to exchange encrypted communications with the client device of claim 10.