Patent Application
20090110198
1. Field of the Invention
The present invention relates generally to a computer implemented method, data processing system, and computer program product for assuring security in file backup infrastructure. More specifically, the present invention relates to retrieval of backup files and correspondingly restoring such files to a useful state for a user.
2. Description of the Related Art
File systems provide a data structure within which to organize files. Such systems may be organized across several hard disks, and even placed across several computers in a computer network. Despite a file system being accessible through a network, computer users have found it desirable to limit which users can read or write to each file of the file system.
One limitation placed on files is ‘permissions’, whereby a user may prohibit anyone, or people not in his group from accessing the file. Still another limitation placed on some files is encrypting the file, so that even if the file were to be disassociated from the file system, the file would retain a privacy feature.
Encryption features of a file may be embedded in metadata associated with the file. Files are associated with metadata that describe statistics, and other information about the file. In an encrypting file system (EFS), a file also has crypto metadata that supports encryption features. Crypto metadata is data that provides details concerning who is authorized to access the file, and in what manner the file is encrypted. For example, crypto metadata can include a public key of the user that encrypted the file. In addition, crypto metadata can include an encrypted file encryption key.
A file encryption key is a key used to encrypt a file. The file encryption key may be abbreviated as Fk. The file encryption key may be assigned uniquely to a file. The file encryption key may be formed by a hash function that reduces the chances that a second file will share the same file encryption key. The hash function can be a randomizing function. The file encryption key may be a symmetric key such that the file encryption key may be used to decrypt the associated file.
An encrypted file encryption key is an encrypted version of Fk, the key used to encrypt the associated file. Fk is encrypted with, for example, a public key of the user. In this arrangement, where the public key is an asymmetric key or part of a public key pair, an associated private key can be used to decrypt the encrypted key to form Fk. Once Fk is obtained, decrypting the associated file becomes a trivial exercise for modern personal computers. Because Fk is stored as metadata of the file, albeit in encrypted form, Fk is considered part of the file. Thus, decrypting the encrypted Fk is considered decrypting the file.
Administrators of computer systems back up files for a number of reasons. Such reasons include, for example, guarding against accidental file deletion or corruption; mitigating human made disasters; and mitigating natural disasters. Natural disasters tend to occur across a geographic area. Such areas can be small, as in the case of a path of destruction caused by a tornado. Such areas can be large, as in the case of a zone impacted by an earthquake. To avoid subjecting a primary copy of a file and the backup copy of a file to the same disaster, administrators place backup files at a distance from the primary file that is a source for the backup file. Under such a backup regime, the backup file is offsite from the primary file. Offsite is a relative term that describes a location for an activity or apparatus as related to another activity or apparatus. One activity is offsite relative to a second activity if the two activities are sheltered under independent roofs or other shelter. Two roofs can be independent even though such roofs may be connected by a tunnel, ramp, breezeway, skybridge, utility conduit, or the like. Offsite can mean that one activity occurs in one zip code or postal code, while the second activity occurs in a second zip code or postal code.
Users can deprecate public key pairs. A public key pair is a public key and its corresponding private key. When deprecating a public key pair, a user instructs a file system to delete the public key pair, and replaces it with another public key pair, which remains an active public key pair until it too is deprecated. Unfortunately, files created with a deprecated public key pair cannot be used by the user without modification. A user would benefit if some method to modify or update the file, particularly a backed up file, were available.
The present invention provides a computer implemented method, data processing system, and computer program product to restore an encrypted file. A computer receives a command to restore an encrypted file, wherein the encrypted file was previously backed up. The computer identifies a user associated with the encrypted file. The computer looks up a first keystore of the user based on the user, the first keystore having an active private key. The computer determines that a public key of the encrypted file fails to match an active public key of the first keystore. The computer restores a second keystore of the user to form a restored private key, wherein the second keystore was previously backed up. The computer responsive to a determination that the public key of the encrypted file fails to match the active public key of the first keystore, decrypts the encrypted file encryption key based on the restored private key to form a file encryption key. The computer encrypts the file encryption key with the active private key of the first keystore.
The novel features believed characteristic of the invention are set forth in the appended claims. The invention itself, however, as well as a preferred mode of use, further objectives and advantages thereof, will best be understood by reference to the following detailed description of an illustrative embodiment when read in conjunction with the accompanying drawings, wherein:
With reference now to the figures and in particular with reference to
In the depicted example, local area network (LAN) adapter 112 connects to south bridge and I/O controller hub 104 and audio adapter 116, keyboard and mouse adapter 120, modem 122, read only memory (ROM) 124, hard disk drive (HDD) 126, CD-ROM drive 130, universal serial bus (USB) ports and other communications ports 132, and PCI/PCIe devices 134 connect to south bridge and I/O controller hub 104 through bus 138 and bus 140. PCI/PCIe devices may include, for example, Ethernet adapters, add-in cards, and PC cards for notebook computers. PCI uses a card bus controller, while PCIe does not. ROM 124 may be, for example, a flash binary input/output system (BIOS) Hard disk drive 126 and CD-ROM drive 130 may use, for example, an integrated drive electronics (IDE) or serial advanced technology attachment (SATA) interface. A super I/O (SIO) device 136 may be connected to south bridge and I/O controller hub 104.
An operating system runs on processor 106 and coordinates and provides control of various components within data processing system 100 in
Instructions for the operating system, the object-oriented programming system, and applications or programs are located on storage devices, such as hard disk drive 126, and may be loaded into main memory 108 for execution by processor 106. The processes of the present invention can be performed by processor 106 using computer implemented instructions, which may be located in a memory such as, for example, main memory 108, read only memory 124, or in one or more peripheral devices.
Those of ordinary skill in the art will appreciate that the hardware in
In some illustrative examples, data processing system 100 may be a personal digital assistant (PDA), which is configured with flash memory to provide non-volatile memory for storing operating system files and/or user-generated data. A bus system may be comprised of one or more buses, such as a system bus, an I/O bus and a PCI bus. Of course, the bus system may be implemented using any type of communications fabric or architecture that provides for a transfer of data between different components or devices attached to the fabric or architecture. A communication unit may include one or more devices used to transmit and receive data, such as a modem or a network adapter. A memory may be, for example, main memory 108 or a cache such as found in north bridge and memory controller hub 102. A processing unit may include one or more processors or CPUs. The depicted example in
The aspects of the illustrative embodiments include a computer implemented method, data processing system, and computer program product for backing up and restoring files in an encrypting file system (EFS). An individual user may deprecate a key pair between backup cycles and still obtain use of his backed up files. Through a single command specifying at least one file, the file may be restored such that a crypto metadata is available for ready decryption and other security operations on the file.
A user is a unique identifier of one or more sessions that were started using a set of credentials, or a properly updated set of credentials based on the set of credentials. The user is usually associated with an individual who keeps at least one aspect of the credentials private but shared with an authentication mechanism of a data processing system. The aspect can be a password. The user can be a public key of a public key pair, and may be unique.
With each successive backup of one or more files owned by a user, an EFS supporting data processing system may store the current key pair to backup repository 210. A backup repository is non-volatile storage that keeps a copy of data for a user. Data may be a file, for example, a keystore. Each file may be associated with a time so that a user may select which among several backups is to be restored.
Fk is not readily readable to a user. Fk is encrypted using the user private key associated with public key 251. An encrypted private key is a private key that is encrypted. The private key can be encrypted with a password of a user. Consequently, any such encryption on the private key may assure a heightened probability that the individual that uses a session, user, is the only individual having access to the private key. For example, encrypted file encryption key 253 may be encrypted with a user private key formed by decrypting encrypted user private key 261. Further in this example, when forming the crypto metadata 255, the EFS uses user public key 263 as an identifier in public key 211. In other words, a data processing system forms a copy of a user public key in a file's crypto metadata to enhance retrieval by the associated user and diminish clear-text use of the file by non-users. The file, however, is not useful if only data of keystore 200 is used. Since
The command to backup may specify a backup repository located offsite, with respect to the encrypting file system. Accordingly, step 307 may store the keystore and the file in a place that may escape impact from a common disaster with the encrypting file system. After backup 300, the data processing system may receive a command from the user, the command indicating that the user deprecates his key pair. Consequently, the data processing system may delete the keystore used in step 303 from the EFS.
Next, the data processing system retrieves the file from the backup repository (step 403). Next, the data processing system identifies a user for the file (step 405). The data processing system may perform identification by reading a public key of the file. Next, the data processing system looks up the user's keystore (step 407). The keystore is the active keystore, for example, keystore 200 of
If the file's public key does not match the user's public key, the data processing system restores the user's keystore until a match is found (step 415). Restoring may include decrypting an encrypted user private key to form a restored private key. In the example backup repository 200 of
Next, the data processing system may encrypt the file with an active private key of the first keystore (step 419). The active private key is, for example, the private key of the user's keystore of step 407. Encrypting the file may comprise encrypting the file encryption key, Fk, with the user's active private key. Next, the data processing system determines whether there are more files to restore (step 421). If there are more files to restore, processing continues at step 403. Otherwise, processing terminates thereafter.
The illustrative embodiments permit a user to select a file for restoration. Contemporaneously, aspects of the illustrative embodiments permit a user to update or otherwise refresh a file to use an active user keystore. A user may deprecate a keystore and still obtain the benefits of an earlier keystore with respect to files encrypted based on the deprecated keystore.
The invention can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment containing both hardware and software elements. In a preferred embodiment, the invention is implemented in software, which includes but is not limited to firmware, resident software, microcode, etc.
Furthermore, the invention can take the form of a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer or any instruction execution system. For the purposes of this description, a computer-usable or computer readable medium can be any tangible apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.
The medium can be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device) or a propagation medium. Examples of a computer-readable medium include a semiconductor or solid state memory, magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk and an optical disk. Current examples of optical disks include compact disk-read only memory (CD-ROM), compact disk-read/write (CD-R/W) and DVD.
A data processing system suitable for storing and/or executing program code will include at least one processor coupled directly or indirectly to memory elements through a system bus. The memory elements can include local memory employed during actual execution of the program code, bulk storage, and cache memories which provide temporary storage of at least some program code in order to reduce the number of times code must be retrieved from bulk storage during execution.
Input/output or I/O devices (including but not limited to keyboards, displays, pointing devices, etc.) can be coupled to the system either directly or through intervening I/O controllers.
Network adapters may also be coupled to the system to enable the data processing system to become coupled to other data processing systems or remote printers or storage devices through intervening private or public networks. Modems, cable modem and Ethernet cards are just a few of the currently available types of network adapters.
The description of the present invention has been presented for purposes of illustration and description, and is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiment was chosen and described in order to best explain the principles of the invention, the practical application, and to enable others of ordinary skill in the art to understand the invention for various embodiments with various modifications as are suited to the particular use contemplated.
