Automatic file encryption

• US 9,367,702 B2
• Filed: 09/30/2013
• Issued: 06/14/2016
• Est. Priority Date: 03/12/2013
• Status: Active Grant

• Current Assignee: CommVault Systems Incorporated
• Original Assignee: CommVault Systems Incorporated
• Inventors: Erofeev, Andrei, Pawar, Rahul S.
• Primary Examiner(s): Zaidi, Syed
• Application Number:
  US14/042,061
• Publication Number:
  US 20140281514A1
• Time in Patent Office: 988 Days
• Field of Search: 713/165
• US Class Current: 1/1
• CPC Class Codes: G06F 11/1402 Saving, restoring, recovering or retrying
• CPC Class Codes: G06F 11/1458 Management of the backup or restore process
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/70 Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2201/84 Using snapshots, i.e. a logical point-in-time copy of the data
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

A method for automatically encrypting files is disclosed. In some cases, the method may be performed by computer hardware comprising one or more processors. The method can include detecting access to a first file, which may be stored in a primary storage system. Further, the method can include determining whether the access comprises a write access. In response to determining that the access comprises a write access, the method can include accessing file metadata associated with the first file and accessing a set of encryption rules. In addition, the method can include determining whether the file metadata satisfies the set of encryption rules. In response to determining that the file metadata satisfies the set of encryption rules, the method can include encrypting the first file to obtain a first encrypted file and modifying an extension of the first encrypted file to include an encryption extension.

Claims

1. A method for automatically encrypting files, the method comprising:

by computer hardware comprising one or more processors;

detecting access to a first file, the first file stored in a primary storage system;

determining whether the access comprises a write access;

in response to determining that the access comprises a write access;

accessing file metadata associated with the first file;

accessing a set of encryption rules;

determining whether the file metadata satisfies the set of encryption rules; and

in response to determining that the file metadata satisfies the set of encryption rules;

identifying an application associated with the first file;

encrypting the first file to obtain a first encrypted file;

modifying an extension of the first encrypted file to include an encryption extension; and

associating the encrypted first file with the application, wherein associating the encrypted first file with the application enables the encrypted first file to be displayed with identification information associated with the application.

2. The method of claim 1, further comprising causing the first encrypted file to be displayed to a user without displaying the encryption extension to the user.

3. The method of claim 1, further comprising backing up the first file to a secondary storage system.

4. The method of claim 3, wherein backing up the first file comprises backing up the first encrypted file to the secondary storage system without performing an encryption process during the backup process.

5. The method of claim 1, wherein the write access includes file creation.

6. The method of claim 1, wherein determining whether the file metadata satisfies the set of encryption rules comprises determining whether a subset of the encryption rules is satisfied by the file metadata.

7. The method of claim 1, further comprising storing the first encrypted file on the primary storage system.

8. The method of claim 7, wherein the first file comprises a version of a second file, the second file stored in an encrypted format on a secondary storage system.

9. The method of claim 1, further comprising selecting the set of encryption rules based, at least in part, on at least a subset of the file metadata.

10. The method of claim 1, further comprising locking a copy of the first file in a cache in response to determining that the file metadata satisfies the set of encryption rules.

11. The method of claim 1, further comprising deleting the first file after obtaining the first encrypted file.

12. A system for automatically encrypting files, the system comprising:

a primary storage system configured to store a first file;

a file monitor comprising computer hardware and configured to detect access to the first file and to determine whether the access comprises a write access;

an encryption rules repository configured to store encryption rules;

an encryption rules engine comprising computer hardware and configured to;

access file metadata associated with the first file in response to the file monitor determining that the access comprises a write access;

access a set of encryption rules from the encryption rules repository; and

determine whether the file metadata satisfies the encryption rules; and

an encryption module comprising computer hardware and configured to, in response to the encryption rules engine determining that the file metadata satisfies the encryption rules;

identify an application associated with the first file;

encrypt the first file to obtain a first encrypted file;

modify an extension of the first encrypted file to include an encryption extension; and

associate the encrypted first file with the application, wherein associating the encrypted first file with the application enables the encrypted first file to be displayed with identification information associated with the application.

13. The system of claim 12, wherein the write access includes file creation.

14. The system of claim 12, wherein determining whether the file metadata satisfies the encryption rules comprises determining whether a subset of the encryption rules is satisfied by the file metadata.

15. The system of claim 12, wherein the primary storage system is further configured to store the first encrypted file.

16. The system of claim 12, further comprising a secondary storage system configured to store a second file in an encrypted format, the second file a version of the first file.

17. The system of claim 12, wherein the file monitor is further configured to backup the first file based on the first encrypted file on a secondary storage system.

18. The system of claim 12, wherein the set of encryption rules is based on at least a subset of the file metadata.

19. The system of claim 12, further comprising a cache lock configured to lock copies of the first file in a cache in response to the encryption rules engine determining that the file metadata satisfies the encryption rules.

20. The system of claim 12, wherein the encryption module is further configured to delete the first file after obtaining the first encrypted file.