Securing recovery data distributed amongst multiple cloud-based storage services

A method comprising:

• receiving, at a production system that manages data associated with a client account, an indication to include the data as part of a data recovery service, the data recovery service storing recovery information for the data within each storage system associated with the client account;
• determining a number of the storage systems (N) associated with the client account;
• obtaining, from information associated with the client account, a specified minimum number of the storage systems (K) that are required to recover the data;
• encrypting, by the production system, the data using a secret key (S);
• generating, by the production system, a data identifier for the data;
• performing an operation to generate N key shares of the secret key (S), the operation using a secret sharing algorithm based on a (K, N) threshold scheme requiring at least K number of the N key shares to reconstruct the secret key (S), each of the N key shares corresponding to a different one of the storage systems;
• sending, to at least a first storage system for storage as the recovery information, the encrypted data, a corresponding key, and the data identifier;
• sending, to each remaining storage system for storage as the recovery information, the corresponding key share, and the data identifier;
• decrypting the received encrypted data using the reconstructed secret key (S);
• and
• recovering, by the production system, the data associated with the client account using the decrypted data.

A computer program product comprising a non-transitory computer-readable medium having a computer-readable program code embodied therein to be executed by one or more processors, the program code including instructions to:

• receive, at a production system that manages data associated with a client account, an indication to include the data as part of a data recovery service, the data recovery service storing recovery information for the data within each storage system associated with the client account;
• determine a number of the storage systems (N) associated with the client account;
• obtain, from information associated with the client account, a specified minimum number of the storage systems (K) that are required to recover the data;
• encrypt, by the production system, the data using a secret key (S);
• generate, by the production system, a data identifier for the data;
• perform an operation to generate N key shares of the secret key (S), the operation using a secret sharing algorithm based on a (K, N) threshold scheme requiring at least K number of the N key shares to reconstruct the secret key (S), each of the N key shares corresponding to a different one of the storage systems;
• send, to at least a first storage system for storage as the recovery information, the encrypted data, a corresponding key, and the data identifier;
• send, to each remaining storage system for storage as the recovery information, the corresponding key share, and the data identifier;
• decrypt the received encrypted data using the reconstructed secret key (S);
• and
• recover, by the production system, the data associated with the client account using the decrypted data.