Cryptographic method to certify retention lock status with an embedded verification log in a backup system

A computer-implemented method to certify retention lock status of one or more files in a backup system, comprising:

• storing the files in a storage appliance of the backup system, wherein the files are retention locked according to a lock policy and subject to one or more compliance standards regarding storage and protection of data including the file;
• sending one or more requests to obtain a certified retention lock (RL) status of a respective current RL status of the files to a certifier component of a backup server, wherein the RL status is configured to contain metadata comprising a name and full path for the file, mtime for the file, a checksum for the file and checksum algorithm, and the RL status;
• generating the RL status as cleartext in the storage target;
• encrypting the RL status using an encryption key process encrypting the cleartext to create a token encoding the RL status to generate an encrypted RL status;
• receiving, in response to the one or more requests, a respective response of a defined token type of the token;
• generating the token encoding the RL status through a process comprising one of hashing the cleartext and encrypting the hash using a filesystem private key, or encrypting the cleartext using the filesystem private key;
• maintaining a verification log recording a time of the respective response in respective timestamp entries;
• and
• making the verification log available in response to an RL status audit request.

A system for certifying retention lock (RL) status of a file in a data store containing opaque data and stored in a backup system by a backup server, comprising:

• a storage appliance of the backup system storing the files subject to one or more compliance standards regarding storage and protection of data including the file, wherein the files are retention locked according to a lock policy;
• a requestor requesting a current RL status of the files in one or more successive requests;
• a generator component generating the RL status as cleartext in the storage target;
• an encryption key process encrypting the RL status using an encryption key process encrypting the cleartext to create a token encoding the RL status to generate an encrypted RL status,
• a token generator component of the backup server generating the token encoding the RL status through a process comprising one of hashing the cleartext and encrypting the hash using a filesystem private key, or encrypting the cleartext using the filesystem private key;
• a certifier component of the backup server encoding the current RL status in the token comprising either a first type or second type, and sending, in response to each request, a corresponding validation or re-validation response;
• a timestamp component generating a timestamp of each validation or re-validation response;
• and
• a verification log component appending each generate timestamp in a verification log for transmission to an auditor auditing the RL lock status of the files.