# US 10,484,348 B1 · Network device with virtual private file system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,348 B1 - Document ID: US10484348B1 - Status: Granted - Kind: B1 - Application number: 15/388,548 - Filed: 2016-12-22 - Granted: 2019-11-19 - Earliest claimed: 2016-12-22 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Alex Levin; Ron Diamant; Ihab Bishara; Michael Butler Fortin; Gary Lee Szilagyi; Georgy Machulsky - Web page: https://patentgrep.com/patent/US10484348B1 ## CPC - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - H04L 63/0471: {applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding} - G06F 16/156: {Query results presentation} - G06F 16/182: Distributed file systems - G06F 16/188: Virtual file systems - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation} - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics} - H04L 9/0877: {using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] - G06F 2221/2107: File encryption - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A network device includes a processor coupled to network interface circuitry and cryptographic circuitry. The network interface circuitry is configured to couple the network device to a local computer communication network. The processor is configured to generate an encryption key based on a hardware specific value recorded in the network device, and apply the cryptographic circuitry and the encryption key to encrypt files for storage in an Internet storage system coupled to a remote computer communication network, and present the encrypted files stored, by the processor, in the Internet storage system, to a computing device coupled to the network device via the local computer communication network, as a storage system attached to the local computer communication network. ## Claims ### Claim 1 A network router, comprising: cryptographic circuitry; a first transceiver configured to provide communication via a local area network; a second transceiver configured to provide communication via a wide area network; a processor coupled to the cryptographic circuitry, the first transceiver, and the second transceiver, wherein the processor is configured to: receive, via the local area network, a first plaintext file; determine that the first plaintext file is to be stored in a cloud storage system accessible via the wide area network; generate an encryption key based on a hardware specific value recorded in the network router; encrypt the first plaintext file using the cryptographic circuitry and the encryption key to create an encrypted file; send the encrypted file to the cloud storage system via the wide area network; receive, via the local area network, a second plaintext file; determine that the second plaintext file is to be stored locally; store the second plaintext file in unencrypted form locally in a data store coupled to the network router; maintain a list of files, the list including encrypted files stored on the cloud storage system and unencrypted files stored locally in the data store coupled to the network router; and present the list of files to a computing device coupled to the local area network as a file system resident on the local area network. ### Claim 2 (depends on 1) The network router of claim 1, wherein the processor is further configured to: receive from the computing device a request to access the first plaintext file; retrieve the encrypted file from the cloud storage system; decrypt the encrypted file using the cryptographic circuitry to recreate the first plaintext file; and send the first plaintext file to the computing device. ### Claim 3 (depends on 1) The network router of claim 1, wherein generating the encryption key comprises: receiving, via the local area network, user specified security information; and combining the user specified security information with the hardware specific value to create the encryption key. ### Claim 4 (depends on 1) The network router of claim 1, wherein determining that the first plaintext file is to be stored in the cloud storage system comprises examining a pathname for the first plaintext file, and wherein determining that the second plaintext file is to be store locally comprises examining a pathname for the second plaintext file. ### Claim 5 A method, comprising: receiving, by a network device coupled to a local computer communication network, a first plaintext file; generating, by the network device, an encryption key based on a hardware specific value recorded in the network device; responsive to determining that the first plaintext file is to be stored as ciphertext: encrypting, by the network device, the first plaintext file with the encryption key to produce an encrypted file; and transmitting, by the network device, the encrypted file to an Internet storage system; receiving, by the network device, a second plaintext file; responsive to determining that the second plaintext file is to be stored as plaintext, storing the second plaintext file in a local storage system; maintaining, by the network device, a list of files, the list including a reference to the encrypted file stored on the Internet storage system and the second plaintext file stored in the local storage system; and presenting, to a computing device coupled to the local computer communication network, the list of files as a file system resident on the local computer communication network. ### Claim 6 (depends on 5) The method of claim 5, further comprising determining that the first plaintext file is to be stored as ciphertext based on metadata for the first plaintext file. ### Claim 7 (depends on 5) The method of claim 5, further comprising: receiving, by the network device, from the computing device, a request to access the first plaintext file; retrieving, by the network device, the encrypted file from the Internet storage system; decrypting, by the network device, the encrypted file to recreate the first plaintext file; and transmitting, by the network device, the first plaintext file to the computing device. ### Claim 8 (depends on 5) The method of claim 5, further comprising: receiving, by the network device, user specified security information; and generating, by the network device, the encryption key using the user specified security information and the hardware specific value of the network device. ### Claim 9 (depends on 8) The method of claim 8, wherein generating the encryption key comprises applying, by the network device, a hash to the user specified security information and to the hardware specific value. ### Claim 10 (depends on 5) The method of claim 5, further comprising: storing, by the network device, metadata for the first plaintext file; and comparing, by the network device, the metadata to a file identification provided to the network device in a request to access the first plaintext file to determine that the encrypted file is to be retrieved from the Internet storage system. ### Claim 11 (depends on 5) The method of claim 5, further comprising configuring a different network device to access the encrypted file stored in the Internet storage system by: providing the different network device with a hardware specific value provided to the network device; providing the different network device with user specified security information provided to the network device; and generating, by the different network device, the encryption key using the user specified security information and the hardware specific value. ### Claim 12 (depends on 11) The method of claim 11, wherein providing the different network device with the hardware specific value comprises using the different network device to retrieve the hardware specific value from a database. ### Claim 13 A network device, comprising: a processor; and a network interface coupled to the processor and configured to couple the network device to a computer communication network; wherein the processor is configured to: generate an encryption key based on a hardware specific value recorded in the network device; determine whether a first plaintext file received for storage is to be stored as plaintext or ciphertext; responsive to a determination that the first plaintext file is to be stored as ciphertext, encrypt the first plaintext file using the encryption key and send the encrypted file to an Internet storage system; determine whether a second plaintext file received for storage is to be stored as plaintext or ciphertext; responsive to a determination that the second plaintext file is to be stored as plaintext, store the second plaintext file in a local storage system; maintain a list of files, the list including a reference to the encrypted file stored on the Internet storage system and the second plaintext file stored in the local storage system; and present the list of files as a file system resident on the local storage system. ### Claim 14 (depends on 13) The network device of claim 13, wherein each of the determinations is based on metadata for the respective plaintext file. ### Claim 15 (depends on 13) The network device of claim 13, further comprising another network interface coupled to the processor, wherein the processor is further configured to: transmit all files as plaintext via the network interface; determine, for each file to be transmitted via the other network interface, whether to encrypt the file prior to transmission; and encrypt at least some files prior to transmission via the other network interface. ### Claim 16 (depends on 13) The network device of claim 13, wherein the processor is further configured to: receive, from the computing device, a request to access the first plaintext file; retrieve the encrypted file from the Internet storage system; decrypt the encrypted file to recreate the first plaintext file; and transmit the first plaintext file to the computing device. ### Claim 17 (depends on 13) The network device of claim 13, wherein the processor is further configured to present, to a computing device coupled to the computer communication network, the encrypted file stored in the Internet storage system and the second plaintext file as being stored in a file system in the computer communication network. ### Claim 18 (depends on 13) The network device of claim 13, wherein the processor is further configured to: store metadata for encrypted files stored in the Internet storage system; and compare the metadata to file identification provided to the processor in a request to access the first plaintext file to identify the encrypted file to be retrieved from the Internet storage system. ### Claim 19 (depends on 13) The network device of claim 13, further comprising a storage device coupled to the processor, wherein the second plaintext file is stored in the storage device coupled to the processor. ### Claim 20 (depends on 13) The network device of claim 13, wherein the network device is a network router, a network switch, a wireless network access point, a digital media server, or a network attached storage device.