Cryptographic method to certify retention lock status for opaque data in a backup system

A computer-implemented method to certify retention lock status of a file in a data store containing opaque data and stored in a storage target of a backup system, comprising:

• first storing one or more files in the storage target, wherein the files are retention locked according to a lock policy and subject to one or more compliance standards regarding storage and protection of data including the file;
• defining opaque data comprising a read payload that will not be interpreted by a filesystem, the opaque data comprising data in a read payload that will not be interpreted by a filesystem and proving that an owner of the opaque data had the data at or before the certain time, and wherein the opaque data comprises an encrypted hardware clock time to prove a clock time upon decryption;
• sending a request to obtain a certified retention lock (RL) status of the file to a certifier component of a backup server, wherein the request contains the opaque data, wherein the RL status is generated as cleartext in the storage target, and is configured to contain metadata comprising a name and full path for the file, mtime for the file, a checksum for the file and checksum algorithm, and the RL status;
• encrypting the RL status using an encryption key process encrypting the cleartext to create a token encoding the RL status to generate an encrypted RL status;
• receiving, in response to the request, a response type encoding the RL status and the opaque data;
• and
• generating the token encoding the RL status through a process comprising one of hashing the cleartext and encrypting the hash using a filesystem private key, or encrypting the cleartext using the filesystem private key.

A system for certifying retention lock (RL) status of a file in a data store containing opaque data and stored in a backup system by a backup server, comprising:

• a storage storing the file in the backup system and subject to one or more compliance standards regarding storage and protection of data including the file;
• a hardware clock maintaining a time of actions performed by users of the backup system;
• a requestor requesting the RL status of the file in a request that incorporates the opaque data, wherein the opaque data comprises data in a read payload that will not be interpreted by a filesystem, the opaque data comprising data in a read payload that will not be interpreted by a filesystem and proving that an owner of the opaque data had the data at or before the certain time, and wherein the opaque data comprises an encrypted hardware clock time to prove a clock time of an action upon decryption;
• a certifier component of the backup server encoding the RL status in a token of either a first type or second type, and wherein creating the token comprises the action proven by the clock time;
• a generator generating the RL status as cleartext in the storage target;
• an encryptor encrypting the RL status using an encryption key process encrypting the cleartext to create a token encoding the RL status to generate an encrypted RL status;
• an interface sending a request to obtain the RL status to the backup server, and receiving back a response type the token encoding the RL status and the opaque data;
• and
• generating the token encoding the RL status through a process comprising one of hashing the cleartext and encrypting the hash using a filesystem private key, or encrypting the cleartext using the filesystem private key.