File backup with selective encryption

• US 9,990,512 B2
• Filed: 09/30/2016
• Issued: 06/05/2018
• Est. Priority Date: 03/12/2013
• Status: Active Grant

• Current Assignee: CommVault Systems Incorporated
• Original Assignee: CommVault Systems Incorporated
• Inventors: Erofeev, Andrei, Pawar, Rahul S.
• Primary Examiner(s): JHAVERI, JAYESH M
• Application Number:
  US15/282,931
• Publication Number:
  US 20170116433A1
• Time in Patent Office: 613 Days
• CPC Class Codes: G06F 11/1402 Saving, restoring, recovering or retrying
• CPC Class Codes: G06F 11/1458 Management of the backup or restore process
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/70 Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2201/84 Using snapshots, i.e. a logical point-in-time copy of the data
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

A method for automatically encrypting files is disclosed. In some cases, the method may be performed by computer hardware comprising one or more processors. The method can include detecting access to a first file, which may be stored in a primary storage system. Further, the method can include determining whether the access comprises a write access. In response to determining that the access comprises a write access, the method can include accessing file metadata associated with the first file and accessing a set of encryption rules. In addition, the method can include determining whether the file metadata satisfies the set of encryption rules. In response to determining that the file metadata satisfies the set of encryption rules, the method can include encrypting the first file to obtain a first encrypted file and modifying an extension of the first encrypted file to include an encryption extension.

Claims

1. A system for backing up an encrypted file, the system comprising:

a primary storage system;

a secondary storage device residing in a secondary storage system; and

a data agent implemented in computer hardware of a computing system within the primary storage system, the data agent configured to;

receive an indication to backup an encrypted file stored in the primary storage system to the secondary storage device, the encrypted file comprising an encrypted version of a file and a plurality of encrypted keys, wherein a first encrypted key of the plurality of encrypted keys is an encrypted data encryption key assigned to the computing system and a second encrypted key of the plurality of encrypted keys is an encrypted data encryption key assigned to a user; and

in response to the indication;

extract the first encrypted key from the encrypted file;

decrypt the first encrypted key to obtain a copy of a data encryption key;

discard the first encrypted key;

decrypt the encrypted file using the copy of the data encryption key to obtain a decrypted file; and

provide the decrypted file to a secondary storage system for backup to the secondary storage device.

2. The system of claim 1, wherein the system further comprises a storage manager configured to store a first asymmetric key of a first asymmetric key pair associated with the computing system, the first asymmetric key corresponding to a second asymmetric key of the asymmetric key pair, the second asymmetric key stored by the computing system.

3. The system of claim 2, wherein decrypting the first encrypted key comprises:

providing the first encrypted key to the storage manager; and

receiving the copy of the data encryption key from the storage manager.

4. The system of claim 1, wherein the data agent is further configured to:

obtain a second asymmetric key pair associated with the computing system, the second asymmetric key pair comprising a third asymmetric key and a fourth asymmetric key corresponding to the third asymmetric key;

encrypt the data encryption key using the third asymmetric key to obtain a third encrypted key; and

embed the third encrypted key with the encrypted version of the file.

5. The system of claim 4, wherein the data agent is further configured to provide the fourth asymmetric key to a storage manager.

6. The system of claim 4, wherein, in response to the user being authorized to access the file, the data agent is further configured to:

obtain a third asymmetric key pair associated with the user, the third asymmetric key pair comprising a fifth asymmetric key and a sixth asymmetric key corresponding to the fifth asymmetric key;

encrypt the copy of the data encryption key with the fifth asymmetric key to obtain the second encrypted key.

7. The system of claim 6, wherein the data agent is further configured to:

obtain a passphrase for the user;

hash the passphrase to obtain a modified passphrase; and

encrypt the sixth asymmetric key using the modified passphrase.

8. The system of claim 7, wherein hashing the passphrase to obtain the modified passphrase further comprises performing a hashing algorithm a plurality of times, thereby reducing the probability that unauthorized attempts to access the passphrase are successful.

9. The system of claim 7, wherein the passphrase for the user corresponds to a password used by the user to access the computing system.

10. A method for backing up an encrypted file, the method comprising:

by a computing system comprising one or more hardware processors;

receiving an indication to backup an encrypted file stored in a primary storage system to a secondary storage device, the encrypted file comprising an encrypted version of a file and a plurality of encrypted keys, wherein a first encrypted key of the plurality of encrypted keys is an encrypted data encryption key assigned to the computing system and a second encrypted key of the plurality of encrypted keys is an encrypted data encryption key assigned to a user; and

in response to the indication;

extracting the first encrypted key from the encrypted file;

decrypting the first encrypted key to obtain a copy of a data encryption key;

discarding the first encrypted key;

decrypting the encrypted file using the copy of the data encryption key to obtain a decrypted file; and

providing the decrypted file to a secondary storage system for backup to the secondary storage device.

11. The method of claim 10, wherein decrypting the first encrypted key comprises:

providing the first encrypted key to a storage manager; and

receiving the copy of the data encryption key from the storage manager, wherein the storage manager is configured to store a first asymmetric key of a first asymmetric key pair associated with the computing system, the first asymmetric key corresponding to a second asymmetric key of the asymmetric key pair, the second asymmetric key stored by the computing system.

12. The method of claim 10, further comprising:

obtaining a second asymmetric key pair associated with the computing system, the second asymmetric key pair comprising a third asymmetric key and a fourth asymmetric key corresponding to the third asymmetric key;

encrypting the data encryption key using the third asymmetric key to obtain a third encrypted key; and

embedding the third encrypted key with the encrypted version of the file.

13. The method of claim 12, further comprising providing the fourth asymmetric key to a storage manager.

14. The method of claim 10, wherein the plurality of encrypted keys includes a fourth encrypted key assigned to a second user.

15. The method of claim 10, wherein, in response to the user being authorized to access the file, the method further comprises:

obtaining a third asymmetric key pair associated with the user, the third asymmetric key pair comprising a fifth asymmetric key and a sixth asymmetric key corresponding to the fifth asymmetric key;

encrypting the copy of the data encryption key with the fifth asymmetric key to obtain the second encrypted key.

16. The method of claim 15, wherein the method further comprises:

obtaining a passphrase for the user;

hashing the passphrase to obtain a modified passphrase; and

encrypting the sixth asymmetric key using the modified passphrase.

17. The method of claim 16, wherein hashing the passphrase to obtain the modified passphrase further comprises performing a hashing algorithm a plurality of times, thereby reducing the probability that unauthorized attempts to access the passphrase are successful.

18. The method of claim 16, wherein the passphrase for the user corresponds to a password used by the user to access the computing system.