US 10,873,454 B2Granted

Cloud storage encryption with variable block sizes

AssigneeZettaset, Inc.

InventorsEric A. Murray, Maksim Yankovsky

Life of this patent

Estimating the term…

Loading patent…

Abstract

Techniques are disclosed for securing data in a cloud storage. Plaintext files are stored as secured, encrypted files in the cloud. The ciphering scheme employs per-block authenticated encryption and decryption. A unique file-key is used to encrypt each file. The file-key is wrapped by authenticated encryption in a wrapping-key that may be shared between files. A centralized security policy contains policy definitions which determine which files will share the wrapping-key. Wrapping-keys are stored in a KMIP compliant key manager which may be backed by a hardware security module (HSM). File metadata is protected by a keyed-hash message authentication code (HMAC). A policy engine along with administrative tools enforce the security policy which also remains encrypted in the system. Various embodiments support blocks of fixed as well as variable sizes read/written from/to the cloud storage.

Claims25

Dependent claims

A computer-implemented method for securing a plaintext file Fp as an encrypted, ciphertext file Fc in a cloud storage, said method comprising the steps of:

(a) providing a user U1 using a client device, a network-based access to said cloud storage;
(b) assigning to said plaintext file Fp, a symmetric file-key FK;
(c) using a first authenticated encryption to encrypt each variable sized block Mi of said plaintext file Fp with said file-key FK by utilizing a corresponding initialization vector IVi to obtain a corresponding variable sized encrypted block Ci and a corresponding authentication tag Ti;
(d) storing in said cloud storage, a corresponding data block *Ci of said encrypted, ciphertext file Fc, said data block *Ci comprising a sequence number of said corresponding block Mi, said corresponding initialization vector IVi, said corresponding variable sized encrypted block Ci and said corresponding authentication tag Ti;
(e) using a second authenticated encryption to encrypt said file-key FK by a symmetric wrapping-key WK by utilizing an initialization vector IVFK to obtain a wrapped-file-key WFK and an authentication tag TFK;
(f) storing said wrapping-key WK in a key manager in accordance with a security policy;
and
(g) storing a block table BT and a default block size DBS in a metadata of said encrypted, ciphertext file Fc.

5 more elements

A cloud storage encryption system comprising at least one memory device storing computer-readable instructions, at least one microprocessor coupled to said at least one memory device for executing said computer-readable instructions, said system further comprising a client device with network-based access to a cloud storage and said at least one microprocessor configured to:

(a) assign a symmetric file-key FK to a plaintext file Fp;
(b) use a first authenticated encryption to encrypt each variable sized block Mi of said plaintext file Fp with said file-key FK by utilizing a corresponding initialization vector IVi to obtain a corresponding variable sized encrypted block Ci and a corresponding authentication tag Ti;
(c) store in said cloud storage a corresponding data block *Ci of an encrypted, ciphertext file Fc, said data block *Ci comprising a sequence number of said corresponding block Mi, said corresponding initialization vector IVi, said corresponding variable sized encrypted block Ci and said corresponding authentication tag Ti;
(d) in accordance with a security policy, use a second authenticated encryption to encrypt said file-key FK by a symmetric wrapping-key WK by utilizing an initialization vector IVFK to obtain a wrapped-file-key WFK and an authentication tag TFK, and store said wrapping-key WK in a key manager;
and
(e) store a block table BT and a default block size DBS in a metadata of said encrypted, ciphertext file Fc.

3 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/026,279Filed 3 Jul 2018 · continuation in part
Priority: 4 Apr 2014
Published: US 2019/0013936 A110 Jan 2019
Granted: 22 Dec 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification9 codes

H04L 9/088
Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords: usage controlling of secret information,…
G06F 21/602
Protecting data: providing cryptographic facilities or services
G06F 21/6218
Protecting access to data via a platform, e.g. using keys or access control rules: to a system of files or objects, e.g. local or distributed file…
G06F 21/6245
To a system of files or objects, e.g. local or distributed file system or database: protecting personal data, e.g. for financial or medical purposes

Family

Application14/245,295Parent of this continuation-in-part · filed 4 Apr 2014
Application15/168,332Parent of this continuation-in-part · filed 31 May 2016
US 9,363,247 B2Parent of this continuation-in-part · filed 7 Jun 2016
Application62/425,821Us provisional application · filed 23 Nov 2016
Application15/813,943Parent of this continuation-in-part · filed 15 Nov 2017
US 2019/0013936 A1Pre-grant publication · published 10 Jan 2019
US 10,043,029 B2Parent of this continuation-in-part
US 10,298,555 B2Parent of this continuation-in-part
US 2015/0288664 A1Published application
US 2016/0277373 A1Published application
US 2018/0082076 A1Published application
US 10,873,454 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key