Secure file archive through encryption key management
AssigneeConnected Corporation
InventorsDavid Cane, David Hirschman, Philip Speare, Lev Vaitzblit
Life of this patent
Estimating the term…
Abstract
A information processing system providing archive/backup support with privacy assurances by encrypting data stored thereby. Data generated on a source system is encrypted, the key used thereby is separately encrypted, and both the encrypted data and encrypted key are transmitted to and maintained by a data repository system. The repository system receives only the encrypted data and key, while the source system retains the ability to recover the key and in turn, the data. The source system is therefore assured of privacy and integrity of the archived data by retaining access control yet is relieved of the physical management of the warehousing medium.
Claims24
An electronic network for transferring data units among storage elements comprising:
- a communications link;
- a source information processing system at a first end of said communications link further comprising:
- a master encryption key;
- at least one secondary encryption key;
- a first memory for storing data units and said master and said at least one secondary encryption keys;
- and
- an encryption engine for selectively encrypting said data units to produce encrypted data units using at least one of said secondary encryption keys, and for encrypting said at least one secondary encryption key with said master encryption key producing at least one encrypted key;
- and
- an archive server information processing system having at least one archive server key at a second end of said communications link comprising a second memory and in communication with said source information processing system, said archive server information processing system for receiving and storing said encrypted data units and said encrypted keys in said second memory wherein said archive server key is used to further encrypt said encrypted keys.
An electronic network for transferring data units among storage elements comprising:
- a communications link;
- a source information processing system at a first end of said communications link further comprising:
- a master encryption key;
- at least one secondary encryption key;
- a first memory for storing data units and said master and said at least one secondary encryption keys;
- and
- an encryption engine for selectively encrypting said data units to produce encrypted data units using at least one of said secondary encryption keys, and for encrypting said at least one secondary encryption key with said master encryption key producing at least one encrypted key;
- and
- an archive server information processing system having at least one archive server key at a second end of said communications link comprising a second memory and in communication with said source information processing system, said archive server information processing system for receiving and storing said encrypted data units and said encrypted keys in said second memory wherein said archive server key is used to further encrypt said encrypted data units.
A method for providing secure archive for data generated in a first memory within a source information processing system comprising the steps of:
- identifying data for archive within said first memory;
- obtaining a secondary encryption key;
- encrypting said data with said secondary encryption key to produce encrypted data;
- obtaining a master encryption key;
- encrypting said secondary encryption key with said master encryption key to produce an encrypted key;
- transmitting said encrypted data and encrypted key to an archive information system having a second memory;
- writing said encrypted data and said encrypted key to said second memory;
- and
- overwriting the portion of said second memory where said encrypted key is stored.
A method for providing secure archive for data generated in a first memory within a source information processing system comprising the steps of:
- identifying data for archive within said first memory;
- obtaining a secondary encryption key;
- encrypting said data with said secondary encryption key to produce encrypted data;
- obtaining a master encryption key;
- encrypting said secondary encryption key with said master encryption key to produce an encrypted key;
- transmitting said encrypted data and encrypted key to an archive information system having a second memory and an archive server encryption key;
- further encrypting said encrypted key with said archive server encryption key;
- writing said encrypted data and said encrypted key to said second memory.
A method for providing secure archive for data generated in a first memory within a source information processing system comprising the steps of:
- identifying data for archive within said first memory;
- obtaining a secondary encryption key;
- encrypting said data with said secondary encryption key to produce encrypted data;
- obtaining a master encryption key;
- encrypting said secondary encryption key with said master encryption key to produce an encrypted key;
- transmitting said encrypted data and encrypted key to an archive information system having a second memory and an archive server encryption key;
- further encrypting said encrypted data with said archive server encryption key;
- writing said encrypted data and said encrypted key to said second memory.
A method for providing secure archive for data generated in a first memory within a source information processing system comprising the steps of:
- identifying data for archive within said first memory;
- obtaining a secondary encryption key;
- encrypting said data with said secondary encryption key to produce encrypted data;
- obtaining a master encryption key;
- encrypting said secondary encryption key with said master encryption key to produce an encrypted key;
- transmitting said encrypted data and encrypted key to an archive information system having a second memory and an archive server encryption key;
- writing said encrypted data and said encrypted key to said second memory
- retrieving said encrypted data and said encrypted key from said second memory of said archive information system;
- decrypting said encrypted key with said archive server encryption key;
- transmitting said encrypted data and said encrypted key from said archive information system to said source information processing system;
- decrypting said encrypted key with said master encryption key to recover said secondary key;
- and
- decrypting said encrypted data with said secondary key to recover said data.
A method for providing secure archive for data generated in a first memory within a source information processing system comprising the steps of:
- identifying data for archive within said first memory;
- obtaining a secondary encryption key;
- encrypting said data with said secondary encryption key to produce encrypted data;
- obtaining a master encryption key;
- encrypting said secondary encryption key with said master encryption key to produce an encrypted key;
- transmitting said encrypted data and encrypted key to an archive information system having a second memory and an archive server encryption key;
- writing said encrypted data and said encrypted key to said second memory;
- retrieving said encrypted data and said encrypted key from said second memory of said archive information system;
- decrypting said encrypted data with said archive server encryption key;
- transmitting said encrypted data and said encrypted key from said archive information system to said source information processing system;
- decrypting said encrypted key with said master encryption key to recover said secondary key;
- and
- decrypting said encrypted data with said secondary key to recover said data .
Dependencies are inferred from the claim text.