Remote verification of file protections for cloud data storage

A method comprising:

• providing a file to a file system for encoding by the file system;
• receiving from the file system a corresponding encoded file;
• and
• verifying that the file system stores at least a designated portion of an encapsulation of the encoded file;
• wherein the verifying step comprises generating the encapsulation of the encoded file;
• wherein the encapsulation of the encoded file is generated by application of an hourglass function to the encoded file, the hourglass function providing a block-by-block transformation of the encoded file;
• wherein the hourglass function enforces a minimum resource requirement on translation from the encoded file to particular blocks of the encapsulation;
• and
• wherein the providing, receiving and verifying steps are performed by a processing device comprising a processor coupled to a memory.

An apparatus comprising:

• a processing device comprising a processor coupled to a memory;
• wherein the processing device further comprises a file processing module, the file processing module being operative to provide a file to a file system for encoding by the file system, to receive from the file system a corresponding encoded file, and to verify that the file system stores at least a designated portion of an encapsulation of the encoded file;
• wherein the file processing module is operative to verify that the file system stores at least a designated portion of an encapsulation of the encoded file by:
• generating the encapsulation of the encoded file;
• generating a plurality of challenges based on respective randomly-selected blocks of the encapsulation;
• sending the plurality of challenges to the file system;
• processing responses to the plurality of challenges from the file system to verify that the file system stores at least the designated portion of the encapsulation of the encoded file;
• and
• determining that the file system stores at least the designated portion of the encapsulation of the encoded file if and only if valid responses to the plurality of challenges are received from the file system within a designated period of time from the sending of the plurality of challenges.

A method comprising:

• receiving a file in a file system for encoding by the file system;
• encoding the file to generate an encoded file;
• and
• providing information sufficient to allow verification that the file system stores at least a designated portion of an encapsulation of the encoded file;
• wherein the providing step further comprises:
• generating the encapsulation of the encoded file;
• receiving a plurality of challenges based on respective randomly-selected blocks of the encapsulation from a client;
• generating responses to the plurality of challenges;
• and
• sending the responses to the client within a designated period of time from receiving the plurality of challenges to permit the client to verify that the file system stores at least the designated portion of the encapsulation of the encoded file;
• and
• wherein the receiving, encoding and providing steps are performed by a processing device comprising a processor coupled to a memory.

An apparatus comprising:

• a processing device comprising a processor coupled to a memory;
• wherein the processing device further comprises a file processing module, the file processing module being operative to receive a file in a file system for encoding by the file system, to encode the file to generate an encoded file, and to provide information sufficient to allow verification that the file system stores at least a designated portion of an encapsulation of the encoded file;
• wherein the file processing module is operative to provide information sufficient to allow verification that the file system stores at least the designated portion of the encapsulation of the encoded file by:
• generating the encapsulation of the encoded file;
• receiving a plurality of challenges based on respective randomly-selected blocks of the encapsulation from a client;
• generating responses to the plurality of challenges;
• and
• sending the responses to the client within a designated period of time from receiving the plurality of challenges to permit the client to verify that the file system stores at least the designated portion of the encapsulation of the encoded file.