US20160321133A1 - Verifying accurate storage in a data storage system - Google Patents

Abstract

A post-encryption checksum is generated for a file to be stored on a remote storage location. It can be generated before sending the encrypted file to the remote storage system. A post-write checksum can be received from the remote storage system. The post-write checksum is generated after the encrypted file is written there. A comparison of the two checksums indicates whether the file has been correctly written to the remote storage system.

Description

CROSS-REFERENCE TO RELATED APPLICATION
• The present application is based on and claims the benefit of U.S. provisional patent application Ser. No. 62/155,886 filed May 1, 2015, and U.S. provisional patent application Ser. No. 62/155,975 filed May 1, 2015 the content of which is hereby incorporated by reference in its entirety.
BACKGROUND
• Computer systems are currently in wide use. Some computer systems use remotely located services to accomplish a variety of different things. The remotely located services, for instance, can provide remote data storage for a client.
• A cloud service provider that provides such a service generally stores customer data remotely from the premises of the customer and provides one or more services relative to the data. Examples of such cloud services include remote file storage and sharing, electronic mail, hosted applications, etc.
• For many customers of the cloud services, such as corporations or other organizations, sensitive and/or confidential information may be stored remotely from the corporation's physical facility. Thus, for some customers of the cloud service, it is important that access to any of the customer's data be strictly controlled. For instance, it may be that customers of cloud services wish to have visibility into actions taken on their content, and wish to have control over access to their content in the cloud, in order to trust the cloud service provider.
• In addition, it can be difficult for some organizations that use cloud services to trust that, when a client asks for data to be deleted from the storage system (which is hosted by a third party), it is actually going to be deleted from both hard drive and backup systems within the third party's storage system. On some systems, orphan copies of the data may remain for unknown periods of time, without the knowledge of the client. This data can be compromised when the third party storage system is subjected to surreptitious attack.
• Further, users of cloud storage services often wish to verify that data is properly written. This can be quite difficult, and can often consume local storage resources, such as local caching of data.
• The discussion above is merely provided for general background information and is not intended to be used as an aid in determining the scope of the claimed subject matter.
SUMMARY
• A post-encryption checksum is generated for a file to be stored on a remote storage location. It can be generated before sending the encrypted file to the remote storage system. A post-write checksum can be received from the remote storage system. The post-write checksum is generated after the encrypted file is written there. A comparison of the two checksums indicates whether the file has been correctly written to the remote storage system.
• This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter. The claimed subject matter is not limited to implementations that solve any or all disadvantages noted in the background.
BRIEF DESCRIPTION OF THE DRAWINGS
• FIG. 1 is a block diagram of one example of a data storage architecture.
• FIGS. 2A and 2B (collectively referred to herein asFIG. 2) show a flow diagram illustrating one example of the operation of the architecture shown inFIG. 1 in storing data.
• FIG. 3 is a flow diagram illustrating one example of the operation of a third party storage system in storing data.
• FIG. 4 is a flow diagram illustrating one example of the operation of a local computing system in receiving and decrypting data.
• FIG. 5A is a more detailed block diagram of one example of a deleted file processing system.
• FIG. 5B is a flow diagram illustrating one example of the operation of the architecture shown inFIG. 1 in processing a file to be deleted.
• FIG. 6 is a block diagram of one example of the architecture shown inFIG. 1, deployed in a cloud computing architecture.
• FIGS. 7-9 show examples of mobile devices that can be used in any of the architectures of the previous figures.
• FIG. 10 is a block diagram of one example of a computing environment that can be used in any of the architectures shown in the previous figures.
DETAILED DESCRIPTION
• FIG. 1 is a block diagram of one example of adata storage architecture100.Architecture100 illustratively includes one ormore clients102 that interact withlocal computing system104. They can interact withsystems104 in order to store information on a remote third partyblob storage system106 and on one or morebackup storage systems108. It will be noted thatbackup storage system108 can be a remote third party blob storage system similar to that shown at106, or it can be different.
• FIG. 1 also shows that, in one example,architecture100 includes akey provider system110 and a masterkey storage system112.Systems104,106,108,110, and112 illustratively communicate with one another over anetwork114.
• In one example,client102 can provide a data stream (e.g., a file)116 tolocal computing system104 which prepares it for storage onsystem106, and provides it tosystem106 for storage.Local computing system104 also validates that thefile116 has been accurately written to system106 (and it may also verify that it has been accurately stored on backup system108) and then provides acommit response118 toclient102 indicating that the write has been successful. In doing so, it can usekey provider system110 and masterkey storage system112, among other things.
• In the example shown inFIG. 1,local computing system104 illustratively includes a set of processors orservers120, and a localapplication data store122 that storesapplications124, a set of encrypted unique key per blob (UKPB)keys126 and it can storeother items128.System104 also illustratively includesshredding component130, per blob encryption/decryption system132,checksum generator system133,comparison system134, key encryption/decryption system136,communication component137, and it can include a variety ofother items138.FIG. 1 also shows that, in one example, remote third partyblob storage system106 illustratively includes one or more data stores140-141 that store a set of encrypted blobs142-144, and that can includeother items146 as well.System106 also illustratively includes achecksum generator component148, one or more processors andservers150, deletedfile processing system152, and it can includeother items154.
• In addition,FIG. 1 also shows that, in one example,key provider system110 includes keyring management system156,key generator component158, one or more processors orservers160, and it can includeother items162. Masterkey storage system112 illustratively includes one ormore data stores164 that store a set of master keys166-168, and that can storeother items170.System112 also includes one or more processors orservers172, masterkey rotation system174, and it can includeother items176.
• Before describing the overall operation ofarchitecture100, a brief overview of its operation, and some of the items inarchitecture100, will first be provided. Whenlocal computing system104 receivesdata116 fromclient102, for storage onsystem106,shredding component130 illustratively splits the file into a plurality of different blobs. It will be noted that, while shredding splits the file on a letter or word basis, the present discussion also includes chunking which splits the file on a paragraph basis. Both types of splitting, or others, can be used as well. Per blob encryption/decryption system132 obtains an encryption key fromkey generator component158 inkey provider system110 and encrypts each blob with its own encryption key. Thekey provider system110 can be a standalone service or endpoint, or arranged in another way.Checksum generator system133 generates a checksum for the pre-encrypted value of the blob and for the post-encryption value of the blob. In one example, the checksum is a message digest (MD) 5 checksum although others can be used as well.System104 then sends the encrypted blob tosystem106 for storage.System106 writes the encrypted blob to one of data stores140-141. The different blobs for a file are illustratively stored across different data stores140-141 and even across different systems106-108.Checksum generator component148 generates a post-write checksum for the encrypted blob, after it is written on a data store140-141, and provides that checksum back tolocal computing system104.Checksum comparison system134 compares the post-encryption checksum generated bysystem133 and the post-write checksum generated bycomponent148 to ensure that they are the same. If they are,system104 can provide commit118 back toclient102. In one example,system104 can perform the same operations with respect tobackup storage system108 to ensure that the encrypted blob is also accurately written tobackup storage system108, before it provides commit118 toclient102.
• In another example, a checksum of the initial non-encrypted file can be generated and then after it is written into the remote storage system,computing system104 can go through the entire retrieval and decryption process and validate that the resulting file was the same as the initial file before considering the commit to be complete. This may take more time and network resources to accomplish, but may be more precise.
• Key encryption/decryption system136 also illustratively obtains a master key fromkey provider system110 and encrypts the UKPB key used to encrypt the blobs sent tosystem106 for storage. Theencrypted UKPB keys126 are then stored on localapplication data store122. The master keys are then deleted fromsystem104, but are provided to masterkey storage system112 for storage.
• In one example,systems104,106,108 and112 are all in separate physical and geographic locations. Also, in one example, the rights to different information are separated. For example,system104 is unable to enumerate files that are stored insystem106. Thus, if access tosystems112 and106 were obtained maliciously, this only means that specific parts of specific files that are already known can be obtained. A scan for other files cannot be done. Also having control ofsystem104 only means that what one already knows about is what could be retrieved. Each local computing system component has its own set of keys with the locations they map to. They are not aware of each other's data. Therefore, for a surreptitious user to obtain an unencrypted copy of anyfiles116 that are stored onstorage system106, that user must have access not only to theencrypted UKPB keys126 onsystem104, but the user must also have access to the master keys on masterkey storage system112, and to the encrypted blob itself, which is stored onstorage system106. Thus, the surreptitious user must have access to three disparate systems, and a knowledge of how to use the master key, encrypted UKPB keys and encrypted blob, in order to gain access to an unencrypted form of the data.
• Deletedfile processing system152 can also process files where a request has been received in order to delete those files.Architecture100 also ensures that, after a desired amount of time, deleted filters are no longer recoverable. This involves using the keyring management system156 to obtain a key that will expire within a predefined amount of time, and this is described in greater detail below with respect toFIG. 5.
• FIGS. 2A and 2B (collectively referred to herein asFIG. 2) illustrate a flow diagram showing one example of the operation ofarchitecture100 in encrypting and storing data at remote third partyblob storage system106.Communication component137 inlocal computing system104 first detects that data is to be stored onstorage system106. This is indicated byblock190 inFIG. 2.Component137 can detect an input from aclient102, as indicated byblock192. The data can be adata stream194, a receivedfile196, orother data198, and a request to store it on remotethird party system106.
• System104 then prepares the data for storage onsystem106. This is indicated byblock200. In one example, the preparation is performed on-the-fly, as indicated byblock202. For instance, shreddingcomponent130 illustratively divides the receivedfile116 into blobs of data, as it is received. Again, this can include a variety of kinds of splitting, such as chunking or shredding or other splitting. This is indicated byblock204. It can perform other preparation operations as well, as indicated byblock206.
• Checksum generator system133 then generates a pre-encryption checksum for each blob, as it is being processed. This is indicated byblock208, and it can be used when decrypting to validate a file, but is not used to validate the transfer of the file intosystems106 or108. For each blob, encryption/decryption system132 obtains a UKPB key fromkey generator component158 inkey provider system110. This is indicated byblock210 inFIG. 2. Again,system110 need not be a standalone service or endpoint.System132 then encrypts each blob with a corresponding UKPB key. This is indicated byblock212 inFIG. 2.Checksum generator system133 then generates a first post-encryption checksum for each blob. This is indicated byblock214.
• Communication component137 then sends each encrypted blob to the remote third partyblob storage system106. This is indicated byblock216. It will be noted that it can also send the encrypted blob to a redundant orbackup storage system108. This is indicated byblock218. It can provide the data to other locations as well, as indicated byblock220.
• Remote third partyblob storage system106 then receives the encrypted blob, writes it todata store140 and generates a post-write checksum for it. The operation ofsystem106 is described in greater detail below with respect toFIG. 3.
• Checksum comparison system134 then receives the post-write checksum that is calculated bychecksum generator component148 on the third partyblob storage system106. This is indicated byblock222 inFIG. 2. It can also receive any other checksums that are generated by any otherbackup storage systems108. This is indicated byblock224. It can receive other values generated from other systems as well, as indicated byblock226.
• Comparison system134 then compares the post-encryption checksum generated bychecksum generator system133 onlocal computing system104 against the post-write checksum generated bycomponent148 onstorage system106, after the encrypted blob has been written todata store140. This is indicated byblock228 inFIG. 2. It can also compare the checksum generated bylocal computing system104 against other post-write checksums generated by otherbackup storage systems108. This is indicated byblock230. It can compare the values to other items as well, and this is indicated byblock232.
• If the checksums are not the same, this means that the write operation to write the encrypted blob to a data store140-141 or tosystem108, has failed. Determining whether the checksums are the same is indicated byblock234 inFIG. 2.System104 then determines whether any retries are to be attempted, as indicated byblock236. If not,client102 is notified that the write failed, as indicated by block238. In another example, before notifying the client of a write failure, the system can fall back to writing the file into a local cache and retry the whole process later on a timer interval until it succeeds. In such an example, theclient102 is notified if both the commits tosystems106 and108 and the commit to the local cache all failed. However, if, atblock236, the system is to retry writing the blob tostorage system106, then processing reverts to block216 where the encrypted blob is again sent to the remote third partyblob storage system106.
• If, atblock234, checksumcomparison system134 determines that the post-encryption checksum generated onlocal computing system104 is the same as the post-write checksum generated bycomponent148 in thirdparty storage system106, then it can send commit118 toclient102 indicating that the write has been successful. This is indicated byblock240 inFIG. 2. Also,system104 can wait to send the commit118 until both the post-write checksum generated by thirdparty storage system106 and the post-write checksum generated bybackup storage system108 are compared and found to be the same as the post-encryption checksum generated bysystem104. All of these architectures are contemplated herein.
• At some point in the processing, key encryption/decryption system136 obtains a master key fromkey provider system110. This is indicated byblock242 inFIG. 2. It then encrypts the UKPB keys that were used to encrypt the blobs sent to storage system106 (and storage system108), with the master key. This is indicated byblock244. It then sends the master key to masterkey storage system112, where the master key is stored indata store164, without keeping any copies of the master key onlocal computing system104. Deleting the master key from thelocal computing system104 is indicated byblock246, and storing the master key on masterkey storage system112 is indicated byblock248.
• It will also be noted that, in one example, the master keys can be rotated according to a system employed by masterkey rotation system174. Rotating the master keys provides even another level of security to the information stored inarchitecture100. Rotating the keys is indicated byblock250. The master keys can be processed in other ways as well, as indicated byblock252.
• Key encryption/decryption system136 then stores theencrypted UKPB keys126 in localapplication data store122. This is indicated byblock254 inFIG. 2. It can thus be seen that, in one example, the encrypted data, the encrypted keys, and the master keys are all needed to decrypt the data and are all stored at geographically separate locations (or facilities).
• FIG. 3 is a flow diagram illustrating one example of the operation of remote third partyblob storage system106 in receiving and storing an encrypted blob ondata store140.System106 first receives an encrypted blob for storage. This is indicated byblock260 inFIG. 3. It then writes the encrypted blob todata store140. This is indicated byblock262.Checksum generator component148 then calculates a post-write checksum for the encrypted blob that it has just written todata store140. This is indicated byblock264. It then sends the post-write checksum to thelocal computing system104 from which it received the encrypted blob. This is indicated byblock266.
• FIG. 4 is a flow diagram illustrating one example of the operation oflocal computing system104 in receiving and decrypting a file (or encrypted blob) from third partyblob storage system106.Communication component137 inlocal computing system104 first detects a request to access a file. This is indicated byblock270. In one example, for instance,client102 may provide a data access request to access a file that is stored onstorage system106.
• In response, blob encryption/decryption system132 then obtains the encrypted blobs for the requested file, fromstorage system106. This is indicated byblock272. This can be done in a variety of different ways. In one example,component137 requests the encrypted blob from one of thestorage systems106 and108 on a first computing thread. This is indicated byblock273. The request may be sent to the geographicallyclosest system106 or108, as indicated byblock275, or to another system, as indicated byblock277. At the same time,component137 schedules a second request to be sent, after a delay period, on a second computing thread, to the other storage system (e.g., tosystem108 if the first request is sent to system106). This is indicated byblock279. If the first request fails,component137 immediately sends the second request, without waiting for the delay period. This is indicated byblock281. The two threads can illustratively cancel one another. Therefore, as soon as the results are returned on one thread, the other thread is canceled. This is indicated byblock283. The encrypted blobs can be obtained in other ways as well.
• System132 also obtains the master key stored ondata store164, for masterkey storage system112, that was used to encrypt theUKPB keys126 that were, themselves, used to encrypt the blobs corresponding to the requested file. Obtaining the master key or keys is indicated byblock274. Key encryption/decryption system136 then uses the master key to decrypt theencrypted UKPB keys126. This is indicated byblock276. Once the keys are decrypted, blob encryption/decryption system132 uses the UKPB keys to decrypt the blobs associated with the requested file. This is indicated byblock278. It then assembles the decrypted shreds (or blobs) and outputs the decrypted file to the requestingclient102. Assembling the shreds from the decrypted blobs is indicated byblock280, and outputting the decrypted file toclient102 is indicated byblock282.
• FIG. 5A shows one example of a more detailed block diagram of deletedfile processing system152.System152 illustratively includes an elapsedtime identifier component326. It also illustratively includes remaining retentiontime identifier component328, file re-encryption/decryption component330, and it can include a variety ofother items332 as well.
• FIG. 5B is a flow diagram illustrating one example of the operation of deletedfile processing system152 in processing files that have been marked for deletion from remote third partyblob storage system106. It should be noted that, in one example,architecture100 provides a variety of different levels of deletion. For example, if a user atclient102 deletes a file, it may go to the client's recycle bin for a predefined amount of time, before it is deleted from the user's recycle bin (either automatically or by the user actively deleting it from the recycle bin). Once it is deleted from the user's recycle bin, the file can then be provided to an administrator's recycle bin, in case the user later decides that he or she wishes to recover the file again. It may remain in the administrator's recycle bin for a predetermined amount of time, unless the administrator actively deletes it from his or her recycle bin.
• In one example, in accordance with the scenario described with respect toFIG. 5B,architecture100 provides an additional level of deletion processing. This can be performed by deletedfile processing system152. This processing can also be used to ensureclient102 that, after a file is deleted by a user, and after a predetermined amount of time has elapsed, the file will actually be deleted from remote third party blob storage system106 (and anybackup storage systems108 where it is stored), and will no longer be accessible.
• Deletedfile processing system152 first detects that a file is to be deleted from third partyblob storage system106. This is indicated byblock300 inFIG. 5. For instance, it may be that a user atclient102 has indicated that a file is to be deleted. In another example, it may be that the administrator oflocal computing system104 has indicated that a file is to be deleted from his or her recycle bin. In any case, a file has been identified for deletion from thirdparty storage system106.
• Deletedfile processing system152 then identifies any applicable intervening deletion levels that may have already occurred. This is indicated byblock302. For instance, it may be that the identified file was first placed in the user's recycle bin for a predetermined amount of time, or until the user actively deleted it from his or her recycle bin. This is indicated byblock304. It may also be that the deleted file was then placed in an administrative recycle bin where it remained for a predetermined amount of time, or until the administrator actively deleted it from his or her recycle bin. This is indicated byblock306. There may be a variety of other intervening deletion levels that had undergone processing as well, and this is indicated byblock308.
• Elapsedtime identifier component326 then identifies any elapsed time that was used in performing the intervening deletion levels. This is indicated byblock310. For instance, it may be that the file was first placed in the user's recycle bin for 30 days, after which it was deleted from there and placed in the administrator's recycle bin. It may have remained in the administrator's recycle bin for an additional 10 days, after which it was deleted from there. Thus, the elapsed time that was consumed by the intervening deletion levels, in that case, would be 40 days.
• It is assumed for the sake of the present discussion that remote third partyblob storage system106 has provided assurance toclients102 that, once a file is deleted, the file will be inaccessible after a predefined period (such as 60 days). In that case, once elapsedtime identifier component326 has identified the time that was consumed in the intervening deletion levels, remaining retention time identifier identifies how much time remains before the file is to be completely inaccessible, and it obtains a corresponding key from the keyring management system156 inkey provider system110. This is indicated byblock312.
• In one example, keyring management system156 generates a key every day and assigns that key a predetermined expiration date. For example, it may be that every key issued by keyring management system156 has a life of 60 days, after which it expires and is no longer valid or usable to decrypt information inarchitecture100. Based on the already elapsed time, and the remaining retention time, deletedfile processing system152 illustratively obtains a key from keyring management system156 so that the key only has a remaining life corresponding to the remaining retention time for the file to be deleted. In the scenario described above, assume that the elapsed time for the intervening deletion levels is 40 days. Assume thatstorage system106 has indicated that any deleted file will no longer be accessible after a period of 60 days. In that case,component328 identifies the remaining retention time for the file to be 20 days. Therefore, deletedfile processing system152 obtains a key from keyring management system156 that has a remaining life of 20 days. Obtaining the key for the remaining retention time for a deleted file is indicated byblock314. It can obtain the key in other ways as well, as indicated byblock316.
• System152 then re-encrypts the file to be deleted with the obtained key. This is indicated byblock318. Until that key expires, the deleted file will still be accessible bysystem104. If it requests the deleted file fromstorage system106,storage system106 can use that key to decrypt the file that has been marked for deletion, and provide it, tosystem104. Thus, while the key is unexpired, the file is still accessible bylocal computing system104. This is indicated byblocks320 and322 inFIG. 5B. However, after the obtained key, with which the deleted file was re-encrypted, has expired, then the file is no longer accessible withinarchitecture100. This is indicated byblock324.
• It can thus be seen thatarchitecture100 defines a storage platform that greatly enhances security of stored data. For a surreptitious user to obtain an unencrypted form of data stored onstorage system106, the surreptitious user must have access to not only the encrypted blobs140-144 onstorage system106, but also to one or more master keys166-168 on masterkey storage system112, and toencrypted UKPB keys126 onlocal computing system104. The surreptitious user must also have knowledge of how to assemble this information and use it in order to decrypt theencrypted UKPB keys126 and the encrypted blobs. In addition,storage system106 can provide an indication as to the maximum retention time for a deleted file. Once that retention time is reached, the key obtained from the keyring management system156 will expire and the deleted file will no longer be accessible withinarchitecture100. This can provide additional security to users ofclient102, so that they know that their data, once deleted, will actually be deleted from the entire architecture, and no copies of the data will remain in any of the storage systems106-108.
• Further, the system can provide quicker response times. By requesting data from two different systems, and then using the data from the quickest responding system, fast data access times can be achieved.
• The present discussion has mentioned processors and servers. In one embodiment, the processors and servers include computer processors with associated memory and timing circuitry, not separately shown. They are functional parts of the systems or devices to which they belong and are activated by, and facilitate the functionality of the other components or items in those systems.
• Also, a number of user interface displays have been discussed. They can take a wide variety of different forms and can have a wide variety of different user actuatable input mechanisms disposed thereon. For instance, the user actuatable input mechanisms can be text boxes, check boxes, icons, links, drop-down menus, search boxes, etc. They can also be actuated in a wide variety of different ways. For instance, they can be actuated using a point and click device (such as a track ball or mouse). They can be actuated using hardware buttons, switches, a joystick or keyboard, thumb switches or thumb pads, etc. They can also be actuated using a virtual keyboard or other virtual actuators. In addition, where the screen on which they are displayed is a touch sensitive screen, they can be actuated using touch gestures. Also, where the device that displays them has speech recognition components, they can be actuated using speech commands.
• A number of data stores have also been discussed. It will be noted they can each be broken into multiple data stores. All can be local to the systems accessing them, all can be remote, or some can be local while others are remote. All of these configurations are contemplated herein.
• Also, the figures show a number of blocks with functionality ascribed to each block. It will be noted that fewer blocks can be used so the functionality is performed by fewer components. Also, more blocks can be used with the functionality distributed among more components.
• FIG. 6 is a block diagram ofarchitecture100, shown inFIG. 1, except that its elements are disposed in acloud computing architecture500. Cloud computing provides computation, software, data access, and storage services that do not require end-user knowledge of the physical location or configuration of the system that delivers the services. In various embodiments, cloud computing delivers the services over a wide area network, such as the internet, using appropriate protocols. For instance, cloud computing providers deliver applications over a wide area network and they can be accessed through a web browser or any other computing component. Software or components ofarchitecture100 as well as the corresponding data, can be stored on servers at a remote location. The computing resources in a cloud computing environment can be consolidated at a remote data center location or they can be dispersed. Cloud computing infrastructures can deliver services through shared data centers, even though they appear as a single point of access for the user. Thus, the components and functions described herein can be provided from a service provider at a remote location using a cloud computing architecture. Alternatively, they can be provided from a conventional server, or they can be installed on client devices directly, or in other ways.
• The description is intended to include both public cloud computing and private cloud computing. Cloud computing (both public and private) provides substantially seamless pooling of resources, as well as a reduced need to manage and configure underlying hardware infrastructure.
• A public cloud is managed by a vendor and typically supports multiple consumers using the same infrastructure. Also, a public cloud, as opposed to a private cloud, can free up the end users from managing the hardware. A private cloud may be managed by the organization itself and the infrastructure is typically not shared with other organizations. The organization still maintains the hardware to some extent, such as installations and repairs, etc.
• In the example shown inFIG. 6, some items are similar to those shown inFIG. 1 and they are similarly numbered.FIG. 6 specifically shows thatsystems106,108,110 and112 can be located in cloud502 (which can be public, private, or a combination where portions are public while others are private). Therefore, user(s)506 use aclient system102 andlocal computing system104 to access those systems throughcloud502.
• FIG. 6 also depicts another example of a cloud architecture.FIG. 6 shows that it is also contemplated that some elements ofarchitecture100 are disposed incloud502 while others are not. By way of example,data stores122,140 and164 can be disposed outside ofcloud502, and accessed throughcloud502. In another example, key provider system110 (or other systems) can be outside ofcloud502. Regardless of where they are located, they can be accessed directly bysystem104, through a network (either a wide area network or a local area network), they can be hosted at a remote site by a service, or they can be provided as a service through a cloud or accessed by a connection service that resides in the cloud. All of these architectures are contemplated herein.
• It will also be noted thatarchitecture100, or portions of it, can be disposed on a wide variety of different devices. Some of those devices include servers, desktop computers, laptop computers, tablet computers, or other mobile devices, such as palm top computers, cell phones, smart phones, multimedia players, personal digital assistants, etc.
• FIG. 7 is a simplified block diagram of one illustrative example of a handheld or mobile computing device that can be used as a user's or client's hand helddevice16, in which the present system (or parts of it) can be deployed.FIGS. 8-9 are examples of handheld or mobile devices.
• FIG. 7 provides a general block diagram of the components of aclient device16 that can run components ofarchitecture100 or that interacts witharchitecture100, or both. In thedevice16, acommunications link13 is provided that allows the handheld device to communicate with other computing devices and under some embodiments provides a channel for receiving information automatically, such as by scanning. Examples of communications link13 include an infrared port, a serial/USB port, a cable network port such as an Ethernet port, and a wireless network port allowing communication though one or more communication protocols including General Packet Radio Service (GPRS), LTE, HSPA, HSPA+and other 3G and 4G radio protocols, 1Xrtt, and Short Message Service, which are wireless services used to provide cellular access to a network, as well as Wi-Fi protocols, and Bluetooth protocol, which provide local wireless connections to networks.
• In other examples, applications or systems are received on a removable Secure Digital (SD) card that is connected to aSD card interface15.SD card interface15 andcommunication links13 communicate with a processor17 (which can also embodyprocessors120,150,160 or172 fromFIG. 1) along abus19 that is also connected tomemory21 and input/output (I/O)components23, as well asclock25 andlocation system27.
• I/O components23, in one embodiment, are provided to facilitate input and output operations. I/O components23 for various embodiments of thedevice16 can include input components such as buttons, touch sensors, multi-touch sensors, optical or video sensors, voice sensors, touch screens, proximity sensors, microphones, tilt sensors, and gravity switches and output components such as a display device, a speaker, and or a printer port. Other I/O components23 can be used as well.
• Clock25 illustratively comprises a real time clock component that outputs a time and date. It can also, illustratively, provide timing functions forprocessor17.
• Location system27 illustratively includes a component that outputs a current geographical location ofdevice16. This can include, for instance, a global positioning system (GPS) receiver, a LORAN system, a dead reckoning system, a cellular triangulation system, or other positioning system. It can also include, for example, mapping software or navigation software that generates desired maps, navigation routes and other geographic functions.
• Memory21stores operating system29,network settings31,applications33,application configuration settings35,data store37,communication drivers39, and communication configuration settings41.Memory21 can include all types of tangible volatile and non-volatile computer-readable memory devices. It can also include computer storage media (described below).Memory21 stores computer readable instructions that, when executed byprocessor17, cause the processor to perform computer-implemented steps or functions according to the instructions. Similarly,device16 can have aclient system24 which can run various business applications or embody parts or all ofarchitecture100.Processor17 can be activated by other components to facilitate their functionality as well.
• Examples of thenetwork settings31 include things such as proxy information, Internet connection information, and mappings.Application configuration settings35 include settings that tailor the application for a specific enterprise or user. Communication configuration settings41 provide parameters for communicating with other computers and include items such as GPRS parameters, SMS parameters, connection user names and passwords.
• Applications33 can be applications that have previously been stored on thedevice16 or applications that are installed during use, although these can be part ofoperating system29, or hosted external todevice16, as well.
• FIG. 8 shows one example in whichdevice16 is atablet computer600. InFIG. 8,computer600 is shown with userinterface display screen602.Screen602 can be a touch screen (so touch gestures from a user's finger604 can be used to interact with the application) or a pen-enabled interface that receives inputs from a pen or stylus. It can also use an on-screen virtual keyboard. Of course, it might also be attached to a keyboard or other user input device through a suitable attachment mechanism, such as a wireless link or USB port, for instance.Computer600 can also illustratively receive voice inputs as well.
• Additional examples ofdevices16 can be used as well.Device16 can be, a feature phone, smart phone or mobile phone. The phone can include a set of keypads for dialing phone numbers, a display capable of displaying images including application images, icons, web pages, photographs, and video, and control buttons for selecting items shown on the display. The phone can include an antenna for receiving cellular phone signals such as General Packet Radio Service (GPRS) and 1Xrtt, and Short Message Service (SMS) signals. In some examples the phone also includes a Secure Digital (SD) card slot that accepts a SD card.
• The mobile device can also be a personal digital assistant or a multimedia player or a tablet computing device, etc. (hereinafter referred to as a PDA). The PDA can include an inductive screen that senses the position of a stylus (or other pointers, such as a user's finger) when the stylus is positioned over the screen. This allows the user to select, highlight, and move items on the screen as well as draw and write. The PDA can also include a number of user input keys or buttons which allow the user to scroll through menu options or other display options which are displayed on the display, and allow the user to change applications or select user input functions, without contacting the display. The PDA can also include an internal antenna and an infrared transmitter/receiver that allow for wireless communication with other computers as well as connection ports that allow for hardware connections to other computing devices. Such hardware connections are typically made through a cradle that connects to the other computer through a serial or USB port. As such, these connections are non-network connections.
• FIG. 9 shows that the phone can be asmart phone71.Smart phone71 has a touchsensitive display73 that displays icons or tiles or otheruser input mechanisms75.Mechanisms75 can be used by a user to run applications, make calls, perform data transfer operations, etc. In general,smart phone71 is built on a mobile operating system and offers more advanced computing capability and connectivity than a feature phone.
• Note that other forms of thedevices16 are possible.
• FIG. 10 is one example of a computing environment in whicharchitecture100, or parts of it, (for example) can be deployed. With reference toFIG. 10, an example system for implementing some embodiments includes a general-purpose computing device in the form of acomputer810. Components ofcomputer810 may include, but are not limited to, a processing unit820 (which can compriseprocessors120,150,160 or172), asystem memory830, and asystem bus821 that couples various system components including the system memory to theprocessing unit820. Thesystem bus821 may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. By way of example, and not limitation, such architectures include Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus also known as Mezzanine bus. Memory and programs described with respect toFIG. 1 can be deployed in corresponding portions ofFIG. 10.
• Computer810 typically includes a variety of computer readable media. Computer readable media can be any available media that can be accessed bycomputer810 and includes both volatile and nonvolatile media, removable and non-removable media. By way of example, and not limitation, computer readable media may comprise computer storage media and communication media. Computer storage media is different from, and does not include, a modulated data signal or carrier wave. It includes hardware storage media including both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed bycomputer810. Communication media typically embodies computer readable instructions, data structures, program modules or other data in a transport mechanism and includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media. Combinations of any of the above should also be included within the scope of computer readable media.
• Thesystem memory830 includes computer storage media in the form of volatile and/or nonvolatile memory such as read only memory (ROM)831 and random access memory (RAM)832. A basic input/output system833 (BIOS), containing the basic routines that help to transfer information between elements withincomputer810, such as during start-up, is typically stored inROM831.RAM832 typically contains data and/or program modules that are immediately accessible to and/or presently being operated on by processingunit820. By way of example, and not limitation,FIG. 10 illustratesoperating system834,application programs835,other program modules836, andprogram data837.
• Thecomputer810 may also include other removable/non-removable volatile/nonvolatile computer storage media. By way of example only,FIG. 10 illustrates ahard disk drive841 that reads from or writes to non-removable, nonvolatile magnetic media, and anoptical disk drive855 that reads from or writes to a removable, nonvolatileoptical disk856 such as a CD ROM or other optical media. Other removable/non-removable, volatile/nonvolatile computer storage media that can be used in the exemplary operating environment include, but are not limited to, magnetic tape cassettes, flash memory cards, digital versatile disks, digital video tape, solid state RAM, solid state ROM, and the like. Thehard disk drive841 is typically connected to thesystem bus821 through a non-removable memory interface such asinterface840, andoptical disk drive855 are typically connected to thesystem bus821 by a removable memory interface, such asinterface850.
• Alternatively, or in addition, the functionality described herein can be performed, at least in part, by one or more hardware logic components. For example, and without limitation, illustrative types of hardware logic components that can be used include Field-programmable Gate Arrays (FPGAs), Program-specific Integrated Circuits (ASICs), Program-specific Standard Products (ASSPs), System-on-a-chip systems (SOCs), Complex Programmable Logic Devices (CPLDs), etc.
• The drives and their associated computer storage media discussed above and illustrated inFIG. 10, provide storage of computer readable instructions, data structures, program modules and other data for thecomputer810. InFIG. 10, for example,hard disk drive841 is illustrated as storingoperating system844,application programs845,other program modules846, andprogram data847. Note that these components can either be the same as or different fromoperating system834,application programs835,other program modules836, andprogram data837.Operating system844,application programs845,other program modules846, andprogram data847 are given different numbers here to illustrate that, at a minimum, they are different copies.
• A user may enter commands and information into thecomputer810 through input devices such as akeyboard862, amicrophone863, and apointing device861, such as a mouse, trackball or touch pad. Other input devices (not shown) may include a joystick, game pad, satellite dish, scanner, or the like. These and other input devices are often connected to theprocessing unit820 through auser input interface860 that is coupled to the system bus, but may be connected by other interface and bus structures, such as a parallel port, game port or a universal serial bus (USB). Avisual display891 or other type of display device is also connected to thesystem bus821 via an interface, such as avideo interface890. In addition to the monitor, computers may also include other peripheral output devices such asspeakers897 andprinter896, which may be connected through an outputperipheral interface895.
• Thecomputer810 is operated in a networked environment using logical connections to one or more remote computers, such as aremote computer880. Theremote computer880 may be a personal computer, a hand-held device, a server, a router, a network PC, a peer device or other common network node, and typically includes many or all of the elements described above relative to thecomputer810. The logical connections depicted inFIG. 10 include a local area network (LAN)871 and a wide area network (WAN)873, but may also include other networks. Such networking environments are commonplace in offices, enterprise-wide computer networks, intranets and the Internet.
• When used in a LAN networking environment, thecomputer810 is connected to theLAN871 through a network interface or adapter870. When used in a WAN networking environment, thecomputer810 typically includes amodem872 or other means for establishing communications over theWAN873, such as the Internet. Themodem872, which may be internal or external, may be connected to thesystem bus821 via theuser input interface860, or other appropriate mechanism. In a networked environment, program modules depicted relative to thecomputer810, or portions thereof, may be stored in the remote memory storage device. By way of example, and not limitation,FIG. 10 illustratesremote application programs885 as residing onremote computer880. It will be appreciated that the network connections shown are exemplary and other means of establishing a communications link between the computers may be used.
• It should also be noted that the different embodiments described herein can be combined in different ways. That is, parts of one or more embodiments can be combined with parts of one or more other embodiments. All of this is contemplated herein.
EXAMPLE 1
• is a computing system, comprising:
• a data encryption system that receives a data file to be stored on a remote storage system and transforms the data file by encrypting the data file with a file-specific encryption key to obtain an encrypted data file;
• a checksum generator component that generates a post-encryption checksum on the encrypted data file;
• a communication component that sends the encrypted data file to the remote storage system; and
• a checksum comparison system that receives a first post-write checksum from the remote storage system, the first post-write checksum being generated from the encrypted data file after being written to the remote storage system, and compares the first post-write checksum to the post-encryption checksum to determine whether the encrypted data file is correctly written to the remote storage system and generates a comparison output signal indicative of a result of the comparison.
EXAMPLE 2
• is the computing system of any or all previous examples wherein the communication component receives a storage request from a client to store the data file on the remote storage system, and wherein the communication component indicates to the client that the data file has been successfully written to the remote storage system, when the comparison output signal indicates that the first post-write checksum and the post-encryption checksum are the same.
EXAMPLE 3
• is the computing system of any or all previous examples wherein the communication component sends the encrypted data file to a remote backup storage system for storage on the backup storage system.
EXAMPLE 4
• is the computing system of any or all previous examples wherein the checksum comparison system receives a second post-write checksum from the remote backup storage system, the second post-write checksum being generated from the encrypted data file after being written to the remote backup storage system, and compares the second post-write checksum to the post-encryption checksum to determine whether the encrypted data file is correctly written to the remote backup storage system and generates a comparison output signal indicative of a result of the comparison.
EXAMPLE 5
• is the computing system of any or all previous examples wherein the computing system receives a storage request from a client to store the data file on the remote storage system, and wherein the communication component indicates to the client that the data file has been successfully written to the remote storage system, when the comparison output signal indicates that the first post-write checksum and the post-encryption checksum are the same, and that the second post-write checksum and the post-encryption checksum are the same.
EXAMPLE 6
• is the computing system of any or all previous examples wherein, in response to receiving a data access request, for the data file, from the client, the communication component is configured to send a first request for the encrypted data file to the remote storage location on a first computing thread and to schedule a second request to the remote backup storage location on a second thread to occur after a delay period.
EXAMPLE 7
• is the computing system of any or all previous examples wherein the communication component is configured to send the second request to the backup storage location within the delay period if the first request fails within the delay period.
EXAMPLE 8
• is the computing system of any or all previous examples wherein the communication component is configured to cancel a given one of the first request and the second request when the encrypted data file is returned in response another one of the first request or the second request.
EXAMPLE 9
• is a computer implemented method, comprising:
• receiving a data file to be stored on a remote storage system;
• transforming the data file by encrypting the data file with a file-specific encryption key to obtain an encrypted data file;
• generating a post-encryption checksum on the encrypted data file;
• sending the encrypted data file to the remote storage system;
• receiving a first post-write checksum from the remote storage system, the first post-write checksum being generated from the encrypted data file after being written to the remote storage system;
• comparing the first post-write checksum to the post-encryption checksum to determine whether the encrypted data file; and
• generating a comparison output signal indicative of a result of the comparison.
EXAMPLE 10
• is the computer implemented method of any or all previous examples wherein receiving the data file includes receiving a storage request from a client to store the data file on the remote storage system.
EXAMPLE 11
• is the computer implemented method of any or all previous examples wherein sending the encrypted data file to the remote storage system comprises:
• sending the encrypted data file to a remote backup storage system for storage on the backup storage system.
EXAMPLE 12
• is the computer implemented method of any or all previous examples and further comprising:
• receiving a second post-write checksum from the remote backup storage system, the second post-write checksum being generated from the encrypted data file after being written to the remote backup storage system;
• comparing the second post-write checksum to the post-encryption checksum; and
• generating a comparison output signal indicative of a result of the comparison.
EXAMPLE 13
• is the computer implemented method of any or all previous examples and further comprising:
• indicating to the client that the data file has been successfully written to the remote storage system, when the comparison output signal indicates that the first post-write checksum and the post-encryption checksum are the same, and that the second post-write checksum and the post-encryption checksum are the same.
EXAMPLE 14
• is the computer implemented method of any or all previous examples and further comprising:
• receiving a data access request, for the data file, from the client;
• sending a first request for the encrypted data file to the remote storage location on a first computing thread in response to the data request; and
• scheduling a second request to the remote backup storage location on a second thread to occur after a delay period, in response to the data request.
EXAMPLE 15
• is the computer implemented method of any or all previous examples and further comprising:
• detecting that the first request failed within the delay period; and
• in response to detecting that the first request failed, sending the second request to the backup storage location within the delay period.
EXAMPLE 16
• is the computer implemented method of any or all previous examples and further comprising:
• cancelling a given one of the first request and the second request when the encrypted data file is returned in response another one of the first request or the second request.
EXAMPLE 17
• is the computer implemented method of any or all previous examples and further comprising:
• decrypting the encrypted data file with the file-specific encryption key; and
• returning the data file to the client in response to the data request.
EXAMPLE 18
• is a computing system, comprising:
• a communication component configured to receive a storage request from a client to store the data file on the remote storage system;
• a data encryption system configured to transform the data file by encrypting the data file with a file-specific encryption key to obtain an encrypted data file, the communication component sending the encrypted data file to the remote storage system and a backup remote storage system;
• a checksum generator component that generates a post-encryption checksum on the encrypted data file; and
• a checksum comparison system that receives a first post-write checksum from the remote storage system and a second post-write checksum from the backup remote storage system, the first post-write checksum being generated from the encrypted data file after being written to the remote storage system, and the second post-write checksum being generated from the encrypted data file after being written to the remote backup storage system, the checksum comparison system comparing the first post-write checksum to the post-encryption checksum and comparing the second post-write checksum to the post-encryption checksum and generating a comparison output signal indicative of a result of the comparison, the communication component confirming to the client that the data file is successfully stored on the remote storage location if the comparison signal indicates that the post-encryption checksum is the same as both the first and second post-write checksums.
EXAMPLE 19
• is the computing system of any or all previous examples wherein, in response to receiving a data access request for the data file from the client, the communication component is configured to send a first request for the encrypted data file to the remote storage location on a first computing thread and to schedule a second request to the remote backup storage location on a second thread to be sent after a delay period, and wherein the communication component is configured to send the second request to the backup storage location within the delay period if the first request fails within the delay period.
EXAMPLE 20
• is the computing system of any or all previous examples wherein the communication component is configured to cancel a given one of the first request and the second request when the encrypted data file is returned in response to another one of the first request or the second request.
• Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims (20)

What is claimed is:

1. A computing system, comprising:

a data encryption system that receives a data file to be stored on a remote storage system and transforms the data file by encrypting the data file with a file-specific encryption key to obtain an encrypted data file;

a checksum generator component that generates a post-encryption checksum on the encrypted data file;

a communication component that sends the encrypted data file to the remote storage system; and

a checksum comparison system that receives a first post-write checksum from the remote storage system, the first post-write checksum being generated from the encrypted data file after being written to the remote storage system, and compares the first post-write checksum to the post-encryption checksum to determine whether the encrypted data file is correctly written to the remote storage system and generates a comparison output signal indicative of a result of the comparison.

2. The computing system ofclaim 1 wherein the communication component receives a storage request from a client to store the data file on the remote storage system, and wherein the communication component indicates to the client that the data file has been successfully written to the remote storage system, when the comparison output signal indicates that the first post-write checksum and the post-encryption checksum are the same.

3. The computing system ofclaim 1 wherein the communication component sends the encrypted data file to a remote backup storage system for storage on the backup storage system.

4. The computing system ofclaim 3 wherein the checksum comparison system receives a second post-write checksum from the remote backup storage system, the second post-write checksum being generated from the encrypted data file after being written to the remote backup storage system, and compares the second post-write checksum to the post-encryption checksum to determine whether the encrypted data file is correctly written to the remote backup storage system and generates a comparison output signal indicative of a result of the comparison.

5. The computing system ofclaim 4 wherein the computing system receives a storage request from a client to store the data file on the remote storage system, and wherein the communication component indicates to the client that the data file has been successfully written to the remote storage system, when the comparison output signal indicates that the first post-write checksum and the post-encryption checksum are the same, and that the second post-write checksum and the post-encryption checksum are the same.

6. The computing system ofclaim 3 wherein, in response to receiving a data access request, for the data file, from the client, the communication component is configured to send a first request for the encrypted data file to the remote storage location on a first computing thread and to schedule a second request to the remote backup storage location on a second thread to occur after a delay period.

7. The computing system ofclaim 6 wherein the communication component is configured to send the second request to the backup storage location within the delay period if the first request fails within the delay period.

8. The computing system ofclaim 7 wherein the communication component is configured to cancel a given one of the first request and the second request when the encrypted data file is returned in response another one of the first request or the second request.

9. A computer implemented method, comprising:

receiving a data file to be stored on a remote storage system;

transforming the data file by encrypting the data file with a file-specific encryption key to obtain an encrypted data file;

generating a post-encryption checksum on the encrypted data file;

sending the encrypted data file to the remote storage system;

receiving a first post-write checksum from the remote storage system, the first post-write checksum being generated from the encrypted data file after being written to the remote storage system;

comparing the first post-write checksum to the post-encryption checksum to determine whether the encrypted data file; and

generating a comparison output signal indicative of a result of the comparison.

10. The computer implemented method ofclaim 9 wherein receiving the data file includes receiving a storage request from a client to store the data file on the remote storage system.

11. The computer implemented method ofclaim 10 wherein sending the encrypted data file to the remote storage system comprises:

sending the encrypted data file to a remote backup storage system for storage on the backup storage system.

12. The computer implemented method ofclaim 11 and further comprising:

receiving a second post-write checksum from the remote backup storage system, the second post-write checksum being generated from the encrypted data file after being written to the remote backup storage system;

comparing the second post-write checksum to the post-encryption checksum; and

generating a comparison output signal indicative of a result of the comparison.

13. The computer implemented method ofclaim 12 and further comprising:

indicating to the client that the data file has been successfully written to the remote storage system, when the comparison output signal indicates that the first post-write checksum and the post-encryption checksum are the same, and that the second post-write checksum and the post-encryption checksum are the same.

14. The computer implemented method ofclaim 11 and further comprising:

receiving a data access request, for the data file, from the client;

sending a first request for the encrypted data file to the remote storage location on a first computing thread in response to the data request; and

scheduling a second request to the remote backup storage location on a second thread to occur after a delay period, in response to the data request.

15. The computer implemented method ofclaim 14 and further comprising:

detecting that the first request failed within the delay period; and

in response to detecting that the first request failed, sending the second request to the backup storage location within the delay period.

16. The computer implemented method ofclaim 15 and further comprising:

cancelling a given one of the first request and the second request when the encrypted data file is returned in response another one of the first request or the second request.

17. The computer implemented method ofclaim 16 and further comprising:

decrypting the encrypted data file with the file-specific encryption key; and

returning the data file to the client in response to the data request.

18. A computing system, comprising:

a communication component configured to receive a storage request from a client to store the data file on the remote storage system;

a data encryption system configured to transform the data file by encrypting the data file with a file-specific encryption key to obtain an encrypted data file, the communication component sending the encrypted data file to the remote storage system and a backup remote storage system;

a checksum generator component that generates a post-encryption checksum on the encrypted data file; and

a checksum comparison system that receives a first post-write checksum from the remote storage system and a second post-write checksum from the backup remote storage system, the first post-write checksum being generated from the encrypted data file after being written to the remote storage system, and the second post-write checksum being generated from the encrypted data file after being written to the remote backup storage system, the checksum comparison system comparing the first post-write checksum to the post-encryption checksum and comparing the second post-write checksum to the post-encryption checksum and generating a comparison output signal indicative of a result of the comparison, the communication component confirming to the client that the data file is successfully stored on the remote storage location if the comparison signal indicates that the post-encryption checksum is the same as both the first and second post-write checksums.

19. The computing system ofclaim 18 wherein, in response to receiving a data access request for the data file from the client, the communication component is configured to send a first request for the encrypted data file to the remote storage location on a first computing thread and to schedule a second request to the remote backup storage location on a second thread to be sent after a delay period, and wherein the communication component is configured to send the second request to the backup storage location within the delay period if the first request fails within the delay period.

20. The computing system ofclaim 19 wherein the communication component is configured to cancel a given one of the first request and the second request when the encrypted data file is returned in response to another one of the first request or the second request.

Images