US 8,621,240 B1Granted

User-specific hash authentication

AssigneeEMC Corporation

InventorsScott C. Auchmoody, Scott Ogata, Greg H. Moulton

Life of this patent

Estimating the term…

Loading patent…

Abstract

Backup data in a single-instance storage device is accessed through a backup server using hashes representative of and pointing to the backup data. To prevent unauthorized access, the server provides each client with encrypted versions of hashes corresponding to data backed up by the client. The hashes can be encrypted using client-specific symmetric encryption keys known to the server. To request data, a client provides the backup server with a corresponding encrypted hash. The backup server decrypts the encrypted hash using the client's encryption key. The original hash is only obtained if the key used for decryption is identical to the key used for encryption. Consequently, if an encrypted hash is stolen or otherwise acquired by a client different from the client that backed up the corresponding data, it cannot be used by the different client to request the corresponding data from the backup server.

Claims20

Dependent claims

A method for protecting backup data from unauthorized access on a backup server that implements a hash file system for storing backup data in content addressed storage, the method comprising:

receiving, at a backup server, a hash value from a client, the hash value identifying a location of data of the client that is stored in the content addressed storage, wherein the hash value is obtained by hashing at least one of the data itself and other data associated with the data;
encrypting at least a portion of the hash value using an encryption key that is specific to the client to generate an encrypted hash value, wherein the hash value is used to eliminate redundant data from the backup data and to point to the data stored in the content addressed storage and identified by the hash value, wherein the encrypted hash value protects the data from being accessed by other clients that are not associated with the encryption key that is specific to the client;
and
providing the encrypted hash value to the client, wherein the client stores the encrypted hash value for later use in communicating with the backup server regarding the data of the client identified by the encrypted hash value, wherein the encrypted hash value encrypted with the encryption key specific to the client prevents a second client from accessing the backup data associated with the client, wherein the backup server enables access to the client's data only if the encrypted hash value is successfully decrypted using the decryption key specific to the client, wherein a decryption key specific to the second client fails to successfully decrypt the encrypted hash value which enables the backup server to protect the client's data from unauthorized access by the second client.

1 more element

A system for restricting access to backup data in single-instance storage to corresponding backup clients, the system comprising:

a storage device for storing a single instance of all backup data received from a plurality of backup clients, wherein the backup data received from the backup clients is stored in locations of the storage device that are identified by hash values of the backup data, wherein the hash values are obtained by hashing the backup data such that the backup data can be identified by and accessed by the hash values, wherein each hash value is a pointer to a location of backup data in the storage device;
and
an encryption and decryption module that includes an encryption key and a decryption key for each backup client, wherein the hash values received from a first backup client are encrypted with the encryption key of the first backup client to generate encrypted hash values, wherein each backup client is associated with a different encryption key, wherein the encrypted hash values encrypted with the encryption key of the first backup client are provided to the first backup client, wherein the first backup clients stores the encrypted hash values for later use in communicating with the system regarding the data pointed to by the encrypted hash values, wherein the hash values are obtained by hashing at least one of the data itself or by hashing other data associated with the data, wherein the encryption and decryption module uses a decryption key associated with the first backup client to access the data of the first backup client such that a second backup client is prevented from accessing the backup data of the first backup client stored in the storage device, wherein the backup server enables access to the data of the first backup client only if the encrypted hash value is successfully decrypted using the decryption key specific to the first backup client, wherein a decryption key specific to the second backup client fails to successfully decrypt the encrypted hash value which enables the backup server to protect the first backup client's data from unauthorized access by the second backup client.

A method of backing up data on a backup client to a backup server such that the backup client can only access its own backed up data, the method comprising:

performing, at a backup client, a hash function to generate a hash representative of data stored in the backed up data by a backup server, wherein the hash value is obtained by hashing at least one of the data itself or by hashing other data associated with the data;
providing the hash to a backup server, wherein the backup server backs up the data associated with the hash in a content addressed storage and wherein the hash points to a location of the data in the content addressed storage and enables access to the data in the content addressed storage;
receiving, from the backup server, an encryption of the hash, wherein the encryption of the hash is generated by the backup server encrypting at least a portion of the hash with an encryption key specific to the backup client and only known to the backup server, wherein the backup server uses a decryption key associated with the encryption key and with the backup client to decrypt the encrypted hash when accessing the backup data of the backup client,
wherein a second backup client is prevented from accessing the backup data since hash values received from the second backup client for the backup data are decrypted with a different decryption key that is associated with the second backup client, wherein the different decryption key is unable to decrypt the encrypted hash value encrypted with the encryption key specific to the backup client, wherein the backup server enables access to data only if the encrypted hash value is successfully decrypted using the decryption key specific to the backup client, wherein the different decryption key fails to successfully decrypt the encrypted hash value which enables the backup server to protect the first backup client's data from unauthorized access by the second backup client;
and
storing the encryption of the hash for later use in communicating with the backup server regarding the data.

3 more elements

Dependencies are inferred from the claim text.