US 2017/0249467 A1Published application

End-to-end encryption and backup in data protection environments

AssigneeInternational Business Machines Corporation

InventorsChristian Mueller, Dominic Mueller-Wicke, Erik Rueger

Life of this patent

Estimating the term…

Loading patent…

Abstract

A computer receives a set of objects from a client, whereby at least one of the objects of the set are respectively associated and encrypted with a unique file encryption key (FEK). The computer encrypts each of the FEKs with a common master encryption key, MEK, resulting in respective locked keys. In an initial backup, the encrypted objects together with their associated locked keys are transmitted to a backup server where a first module determines if locked key has changed via referencing an encryption state associated with the encrypted objects. If an MEK has changed, the existing FEKs are re-encrypted with the changed MEK to generate new locked keys, and, in a subsequent backup operation, sending the new locked keys to the backup server to replace the existing locked keys, while avoiding transmitting to the backup server the objects whose associated FEKs are affected by the changed MEK.

Claims11

Dependent claims

A computer implemented method for performing a backup of a set of objects by a client, whereby at least one of the objects of the set of objects are respectively associated and encrypted with a unique file encryption key (FEK), the method comprising:

encrypting each of the FEKs with a common master encryption key (MEK), said encryption resulting in respective locked keys;
transmitting, in an initial backup operation, the encrypted objects together with their associated locked keys to a backup server;
determining, by a first module, whether an event occurred in which a locked key of an object has changed due to a change of the MEK, wherein the change of the locked key is determined via an encryption state associated with the objects whose FEKs are affected by the change of the MEK, and wherein the encryption state indicates the change;
and
based on determining that an event occurred in which a locked key of an object has changed due to a change of the MEK, re-encrypting the existing FEKs with the changed MEK, wherein said re-encrypting results in new locked keys, and wherein, in a subsequent backup operation, the new locked keys are sent to the backup server to replace the existing locked keys while not transmitting to the backup server the objects whose associated FEKs are affected by the changed MEK.

2 more elements

A computer implemented method for restoring a backup of a set of objects by a client, whereby at least one of the objects of the set of objects are respectively associated and encrypted with a unique file encryption key (FEK), at least one of the FEKs being stored in the backup encrypted with a common master encryption key (MEK), said encryption resulting in respective locked keys, said locked keys stored in the backup, each object that is comprised in the backup being associated with an encryption state, the encryption state indicating if, with respect to the current backup, the locked key has changed due to a change of the MEK, the method comprising:

receiving a request for a restore one of the objects;
determining if the encryption state associated with the object to be restored indicates that the locked key has changed after the current backup was performed;
based on determining that the encryption state associated with the object to be restored indicates that the locked key has changed after the current backup was performed, disregarding the object from restoring;
and
based on determining that the encryption state associated with the object to be restored indicates that the locked key is unchanged since the current backup was performed, restoring the encrypted FEK associated with said object and the object.

2 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/054,521Filed 26 Feb 2016
Published: 31 Aug 2017
Term ends: Not estimatedThe source records don’t support an estimate.

Classification13 codes

G06F 21/602
Protecting data: providing cryptographic facilities or services
G06F 11/14
Responding to the occurrence of a fault, e.g. fault tolerance: error detection or correction of the data by redundancy in operations
G06F 11/1451
Management of the data involved in backup or backup restore: by selection of backup contents
G06F 11/1464
Management of the backup or restore process: for networked environments