System and method for backing up and restoring files encrypted with file-level content protection

A computer-implemented method of backing up a computing device, the method causing a computing device to perform steps comprising:

• sending from a second device a backup ticket containing encryption keys encrypted with a backup secret and the backup secret to a first device having an encrypted file system,
• wherein each file in the file system is encrypted with a unique file encryption key, each file encryption key is encrypted with a class encryption key, and each class encryption key is encrypted with an additional encryption key, and the class encryption key corresponds to an assigned protection class that allows access rights to be associated with the file, and
• wherein the first device retrieves an escrow key bag containing protection class keys for a plurality of protection classes encrypted using the backup ticket and a unique device specific code associated with the first device, decrypts protection class keys with the backup ticket and backup secret, generates a backup key bag containing backup protection class keys, selects a set of encrypted files to back up, decrypts file encryption keys corresponding to the selected set of encrypted files on the first device with the decrypted protection class keys from the escrow key bag, and re-encrypts the file encryption keys corresponding to the selected set of encrypted files with the backup protection class keys on the first device;
• and
• receiving at the second device the selected set of encrypted files, the backup key bag and metadata associated with the selected set of encrypted files from the first device.

A system for restoring backup files, the system comprising:

• a processor:
• a first module controlling the processor to send a backup ticket, a backup secret, and a host identifier to a first device having an encrypted file system,
• wherein each file in the file system is encrypted with a unique file encryption key, each file encryption key is encrypted with a class encryption key, and each class encryption key is encrypted with an additional encryption key, and the class encryption key corresponds to an assigned protection class that allows access rights to be associated with the file;
• a second module controlling the processor to send to the first device encrypted backup files, a backup key bag and associated metadata;
• a third module controlling the processor to decrypt the protection class keys in the backup key bag on the first device using a backup ticket;
• a fourth module controlling the processor to decrypt file encryption keys on the first device with the decrypted protection class keys from the backup key bag;
• a fifth module controlling the processor to retrieve an escrow key bag containing original protection class keys on the first device, the protection class keys for a plurality of protection classes and encrypted using the backup ticket and a unique device specific code associated with the first device;
• a sixth module controlling the processor to re-encrypt the decrypted file encryption keys with the original protection class keys on the first device and the unique device specific code associated with the first device;
• and
• a seventh module controlling the processor to restore the re-encrypted backup files based on the encrypted file keys on the first device.

A computer-implemented method of restoring backup files, the method causing a computing device to perform steps comprising:

• receiving, at a first device having an encrypted file system, a backup ticket, a backup secret, and a host identifier from a second device,
• wherein each file in the file system is encrypted with a unique file encryption key, each file encryption key is encrypted with a class encryption key, and each class encryption key is encrypted with an additional encryption key, and the class encryption key corresponds to an assigned protection class that allows access rights to be associated with the file;
• receiving from the second device encrypted backup files, a backup key bag and associated metadata comprising encrypted file keys;
• decrypting the protection class keys in the backup key bag on the first device using a backup ticket;
• decrypting file encryption keys on the first device with the decrypted protection class keys from the backup key bag;
• retrieving an escrow key bag containing original protection class keys on the first device;
• re-encrypting the file encryption keys with the original protection class keys on the first device, the protection class keys for a plurality of protection classes and encrypted using the backup ticket and a unique device specific code associated with the first device;
• and
• restoring the re-encrypted backup files based on the encrypted file keys on the first device.