WO2010057199A3 - Storage and retrieval of crytographically-split data blocks to/from multiple storage devices - Google Patents

Storage and retrieval of crytographically-split data blocks to/from multiple storage devices Download PDF

Info

Publication number
WO2010057199A3
WO2010057199A3 PCT/US2009/064824 US2009064824W WO2010057199A3 WO 2010057199 A3 WO2010057199 A3 WO 2010057199A3 US 2009064824 W US2009064824 W US 2009064824W WO 2010057199 A3 WO2010057199 A3 WO 2010057199A3
Authority
WO
WIPO (PCT)
Prior art keywords
data blocks
storage devices
virtual disk
secure storage
client
Prior art date
Application number
PCT/US2009/064824
Other languages
French (fr)
Other versions
WO2010057199A2 (en
Inventor
David Dodgson
Joseph Neill
Ralph R. Farina
Edward Chin
Albert French
Scott Summers
Original Assignee
Unisys Corporation
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from US12/272,012 external-priority patent/US20100125730A1/en
Priority claimed from US12/336,562 external-priority patent/US20100154053A1/en
Priority claimed from US12/336,559 external-priority patent/US20100153703A1/en
Priority claimed from US12/336,568 external-priority patent/US20100150341A1/en
Priority claimed from US12/336,564 external-priority patent/US8392682B2/en
Priority claimed from US12/336,558 external-priority patent/US20100153740A1/en
Priority claimed from US12/342,610 external-priority patent/US20100161981A1/en
Priority claimed from US12/342,438 external-priority patent/US8135980B2/en
Priority claimed from US12/342,636 external-priority patent/US20100162005A1/en
Priority claimed from US12/342,523 external-priority patent/US20100162003A1/en
Priority claimed from US12/342,575 external-priority patent/US20100161964A1/en
Priority claimed from US12/342,500 external-priority patent/US8386798B2/en
Priority claimed from US12/342,379 external-priority patent/US20100162001A1/en
Priority claimed from US12/342,414 external-priority patent/US20100162002A1/en
Priority claimed from US12/342,464 external-priority patent/US20100162032A1/en
Priority claimed from US12/342,547 external-priority patent/US20100162004A1/en
Priority to AU2009313675A priority Critical patent/AU2009313675A1/en
Application filed by Unisys Corporation filed Critical Unisys Corporation
Priority to EP09826981A priority patent/EP2359298A2/en
Publication of WO2010057199A2 publication Critical patent/WO2010057199A2/en
Publication of WO2010057199A3 publication Critical patent/WO2010057199A3/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1097—Protocols in which an application is distributed across nodes in the network for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0602—Interfaces specially adapted for storage systems specifically adapted to achieve a particular effect
    • G06F3/062—Securing storage systems
    • G06F3/0623—Securing storage systems in relation to content
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/104—Grouping of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H04L9/0833—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] involving conference or group key

Abstract

A secure storage appliance is disclosed, along with methods of storing and reading data in a secure storage network with a virtual disk mapped to the plurality of physical storage devices. The secure storage appliance is configured to present to a client a virtual disk, the virtual disk mapped to the plurality of physical storage devices. The secure storage appliance is capable of executing program instructions configured to generate a plurality of secondary data blocks by performing splitting and encrypting operations on a primary data block received from the client for storage on the virtual disk. For security, the secondary data blocks are stored at geographically-distributed locations. The secure storage appliance is also capable of executing program instructions configured to reconstitute the primary data block from at least a portion of the plurality of secondary data blocks stored in shares on corresponding physical storage devices in response to a request from the client.
PCT/US2009/064824 2008-11-17 2009-11-17 Storage and retrieval of crytographically-split data blocks to/from multiple storage devices WO2010057199A2 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
AU2009313675A AU2009313675A1 (en) 2008-11-17 2009-11-17 Storage and retrieval of crytographically-split data blocks to/from multiple storage devices
EP09826981A EP2359298A2 (en) 2008-11-17 2009-11-17 Storage and retrieval of crytographically-split data blocks to/from multiple storage devices

Applications Claiming Priority (32)

Application Number Priority Date Filing Date Title
US12/272,012 US20100125730A1 (en) 2008-11-17 2008-11-17 Block-level data storage security system
US12/272,012 2008-11-17
US12/336,559 US20100153703A1 (en) 2008-12-17 2008-12-17 Storage security using cryptographic splitting
US12/336,564 2008-12-17
US12/336,558 2008-12-17
US12/336,558 US20100153740A1 (en) 2008-12-17 2008-12-17 Data recovery using error strip identifiers
US12/336,559 2008-12-17
US12/336,564 US8392682B2 (en) 2008-12-17 2008-12-17 Storage security using cryptographic splitting
US12/336,562 2008-12-17
US12/336,568 2008-12-17
US12/336,568 US20100150341A1 (en) 2008-12-17 2008-12-17 Storage security using cryptographic splitting
US12/336,562 US20100154053A1 (en) 2008-12-17 2008-12-17 Storage security using cryptographic splitting
US12/342,575 2008-12-23
US12/342,379 2008-12-23
US12/342,636 US20100162005A1 (en) 2008-12-23 2008-12-23 Storage communities of interest using cryptographic splitting
US12/342,379 US20100162001A1 (en) 2008-12-23 2008-12-23 Secure network attached storage device using cryptographic settings
US12/342,414 US20100162002A1 (en) 2008-12-23 2008-12-23 Virtual tape backup arrangement using cryptographically split storage
US12/342,464 US20100162032A1 (en) 2008-12-23 2008-12-23 Storage availability using cryptographic splitting
US12/342,523 2008-12-23
US12/342,547 US20100162004A1 (en) 2008-12-23 2008-12-23 Storage of cryptographically-split data blocks at geographically-separated locations
US12/342,636 2008-12-23
US12/342,464 2008-12-23
US12/342,438 US8135980B2 (en) 2008-12-23 2008-12-23 Storage availability using cryptographic splitting
US12/342,500 US8386798B2 (en) 2008-12-23 2008-12-23 Block-level data storage using an outstanding write list
US12/342,547 2008-12-23
US12/342,610 US20100161981A1 (en) 2008-12-23 2008-12-23 Storage communities of interest using cryptographic splitting
US12/342,414 2008-12-23
US12/342,610 2008-12-23
US12/342,575 US20100161964A1 (en) 2008-12-23 2008-12-23 Storage communities of interest using cryptographic splitting
US12/342,500 2008-12-23
US12/342,438 2008-12-23
US12/342,523 US20100162003A1 (en) 2008-12-23 2008-12-23 Retrieval of cryptographically-split data blocks from fastest-responding storage devices

Publications (2)

Publication Number Publication Date
WO2010057199A2 WO2010057199A2 (en) 2010-05-20
WO2010057199A3 true WO2010057199A3 (en) 2011-03-17

Family

ID=42124888

Family Applications (3)

Application Number Title Priority Date Filing Date
PCT/US2009/064820 WO2010057196A2 (en) 2008-11-17 2009-11-17 Secure storage availability using cryptographic splitting
PCT/US2009/064824 WO2010057199A2 (en) 2008-11-17 2009-11-17 Storage and retrieval of crytographically-split data blocks to/from multiple storage devices
PCT/US2009/064765 WO2010057173A2 (en) 2008-11-17 2009-11-17 Storage communities of interest using cryptographic splitting

Family Applications Before (1)

Application Number Title Priority Date Filing Date
PCT/US2009/064820 WO2010057196A2 (en) 2008-11-17 2009-11-17 Secure storage availability using cryptographic splitting

Family Applications After (1)

Application Number Title Priority Date Filing Date
PCT/US2009/064765 WO2010057173A2 (en) 2008-11-17 2009-11-17 Storage communities of interest using cryptographic splitting

Country Status (3)

Country Link
EP (3) EP2359298A2 (en)
AU (7) AU2009313672A1 (en)
WO (3) WO2010057196A2 (en)

Families Citing this family (22)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8725688B2 (en) 2008-09-05 2014-05-13 Commvault Systems, Inc. Image level copy or restore, such as image level restore without knowledge of data object metadata
GB2496111A (en) * 2011-10-28 2013-05-08 Intergence Systems Ltd Tracing the real-world storage location of critical data items to form part of physical network map
US9633216B2 (en) 2012-12-27 2017-04-25 Commvault Systems, Inc. Application of information management policies based on operation with a geographic entity
US9459968B2 (en) 2013-03-11 2016-10-04 Commvault Systems, Inc. Single index to query multiple backup formats
US10169121B2 (en) 2014-02-27 2019-01-01 Commvault Systems, Inc. Work flow management for an information management system
US9648100B2 (en) * 2014-03-05 2017-05-09 Commvault Systems, Inc. Cross-system storage management for transferring data across autonomous information management systems
US9740574B2 (en) 2014-05-09 2017-08-22 Commvault Systems, Inc. Load balancing across multiple data paths
US11249858B2 (en) 2014-08-06 2022-02-15 Commvault Systems, Inc. Point-in-time backups of a production application made accessible over fibre channel and/or ISCSI as data sources to a remote application by representing the backups as pseudo-disks operating apart from the production application and its host
US9852026B2 (en) 2014-08-06 2017-12-26 Commvault Systems, Inc. Efficient application recovery in an information management system based on a pseudo-storage-device driver
US9766825B2 (en) 2015-07-22 2017-09-19 Commvault Systems, Inc. Browse and restore for block-level backups
US10296368B2 (en) 2016-03-09 2019-05-21 Commvault Systems, Inc. Hypervisor-independent block-level live browse for access to backed up virtual machine (VM) data and hypervisor-free file-level recovery (block-level pseudo-mount)
US10838821B2 (en) 2017-02-08 2020-11-17 Commvault Systems, Inc. Migrating content and metadata from a backup system
US10740193B2 (en) 2017-02-27 2020-08-11 Commvault Systems, Inc. Hypervisor-independent reference copies of virtual machine payload data based on block-level pseudo-mount
US10891069B2 (en) 2017-03-27 2021-01-12 Commvault Systems, Inc. Creating local copies of data stored in online data repositories
US10776329B2 (en) 2017-03-28 2020-09-15 Commvault Systems, Inc. Migration of a database management system to cloud storage
US11074140B2 (en) 2017-03-29 2021-07-27 Commvault Systems, Inc. Live browsing of granular mailbox data
US10664352B2 (en) 2017-06-14 2020-05-26 Commvault Systems, Inc. Live browsing of backed up data residing on cloned disks
GB2567146B (en) 2017-09-28 2022-04-13 Red Flint Llp Method and system for secure storage of digital data
US10795927B2 (en) 2018-02-05 2020-10-06 Commvault Systems, Inc. On-demand metadata extraction of clinical image data
US10789387B2 (en) 2018-03-13 2020-09-29 Commvault Systems, Inc. Graphical representation of an information management system
US11308034B2 (en) 2019-06-27 2022-04-19 Commvault Systems, Inc. Continuously run log backup with minimal configuration and resource usage from the source machine
BR112022013093A2 (en) * 2019-12-31 2022-09-06 Nagravision Sa TECHNIQUES TO CONTROL ACCESS TO SEGMENTED DATA

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040133577A1 (en) * 2001-01-11 2004-07-08 Z-Force Communications, Inc. Rule based aggregation of files and transactions in a switched file system
US20050165972A1 (en) * 2004-01-27 2005-07-28 Kenichi Miyata File input/output control device and method for the same
US20050273686A1 (en) * 2004-06-03 2005-12-08 Turner Bryan C Arrangement in a network node for secure storage and retrieval of encoded data distributed among multiple network nodes
US20070160198A1 (en) * 2005-11-18 2007-07-12 Security First Corporation Secure data parser method and system
US20080183975A1 (en) * 2005-09-30 2008-07-31 Lynn Foster Rebuilding data on a dispersed storage network

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6167531A (en) * 1998-06-18 2000-12-26 Unisys Corporation Methods and apparatus for transferring mirrored disk sets during system fail-over
US7391865B2 (en) * 1999-09-20 2008-06-24 Security First Corporation Secure data parser method and system
US20030188153A1 (en) * 2002-04-02 2003-10-02 Demoff Jeff S. System and method for mirroring data using a server
US6928514B2 (en) * 2002-08-05 2005-08-09 Lsi Logic Corporation Method and apparatus for teaming storage controllers
EP1771979B1 (en) * 2004-07-23 2011-11-23 Citrix Systems, Inc. A method and systems for securing remote access to private networks
US7284020B2 (en) * 2004-09-01 2007-10-16 Hitachi, Ltd. System and method for data recovery in a storage system
US20070067644A1 (en) * 2005-08-26 2007-03-22 International Business Machines Corporation Memory control unit implementing a rotating-key encryption algorithm
US7574579B2 (en) * 2005-09-30 2009-08-11 Cleversafe, Inc. Metadata management system for an information dispersed storage system
EP2127204A2 (en) * 2006-12-08 2009-12-02 Unisys Corporation Securing multicast data

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040133577A1 (en) * 2001-01-11 2004-07-08 Z-Force Communications, Inc. Rule based aggregation of files and transactions in a switched file system
US20050165972A1 (en) * 2004-01-27 2005-07-28 Kenichi Miyata File input/output control device and method for the same
US20050273686A1 (en) * 2004-06-03 2005-12-08 Turner Bryan C Arrangement in a network node for secure storage and retrieval of encoded data distributed among multiple network nodes
US20080183975A1 (en) * 2005-09-30 2008-07-31 Lynn Foster Rebuilding data on a dispersed storage network
US20070160198A1 (en) * 2005-11-18 2007-07-12 Security First Corporation Secure data parser method and system

Also Published As

Publication number Publication date
AU2018236850B2 (en) 2020-07-09
AU2016210716A1 (en) 2016-09-08
WO2010057196A2 (en) 2010-05-20
WO2010057173A3 (en) 2010-10-07
AU2020200461A1 (en) 2020-02-13
EP2359295A2 (en) 2011-08-24
AU2009313675A1 (en) 2011-07-07
AU2009313672A1 (en) 2011-07-07
WO2010057196A3 (en) 2011-12-29
EP2359249A2 (en) 2011-08-24
AU2020200461B2 (en) 2021-10-07
EP2359298A2 (en) 2011-08-24
AU2018236850A1 (en) 2018-10-18
AU2016210718B2 (en) 2018-10-25
AU2009313728A1 (en) 2011-07-07
WO2010057173A2 (en) 2010-05-20
WO2010057199A2 (en) 2010-05-20
AU2016210718A1 (en) 2016-09-15

Similar Documents

Publication Publication Date Title
WO2010057199A3 (en) Storage and retrieval of crytographically-split data blocks to/from multiple storage devices
WO2010057151A3 (en) Block-level data storage security system
WO2013081983A3 (en) Migrating authenticated content towards content consumer
WO2014108835A3 (en) A method for providing security using secure computation
GB2522372A (en) Storage system and method of storing and managing data
WO2013002833A3 (en) Binding of cryptographic content using unique device characteristics with server heuristics
WO2019137563A3 (en) Anti-replay attack authentication protocol
EP2645673A3 (en) Storage device and its control method
EP2495681A3 (en) Remote pre-boot authentication
WO2013066898A3 (en) Cooperative storage management
WO2009105280A3 (en) Systems and methods for secure workgroup management and communication
WO2011135529A3 (en) Method and nodes for providing secure access to cloud computing for mobile users
WO2008140509A3 (en) System and method for preserving consumer choice
RU2017115745A (en) ACTIONS TO FULL ERASE OF MOVABLE CONTENT BETWEEN DEVICES
WO2013114125A3 (en) A method and database system for secure storage and communication of information
WO2009134662A3 (en) In-line content based security for data at rest in a network storage system
WO2014049483A3 (en) Supporting coordinated access to a file system's shared storage using automatic alignment of a parallel file access protocol and metadata management
WO2012145533A3 (en) Shared resource and virtual resource management in a networked environment
UA117951C2 (en) Method and system for generating an advanced storage key in a mobile device without secure elements
GB201021312D0 (en) Distributed file system
WO2010141445A3 (en) Workgroup key wrapping for community of interest membership authentication
WO2011025185A3 (en) Security usb storage medium generation and decryption method, and medium having the record of a program for generation of security usb storage medium
WO2011047014A3 (en) Interacting with data in hidden storage
WO2010068377A3 (en) Simultaneous state-based cryptographic splitting in a secure storage appliance
GB2453077A8 (en) File system authentication

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 09826981

Country of ref document: EP

Kind code of ref document: A2

WWE Wipo information: entry into national phase

Ref document number: 2009826981

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2009313675

Country of ref document: AU

WWE Wipo information: entry into national phase

Ref document number: 4606/DELNP/2011

Country of ref document: IN

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2009313675

Country of ref document: AU

Date of ref document: 20091117

Kind code of ref document: A