Locally-stored remote block data integrity
Systems and methods to securely store data in a remote storage (e.g., cloud storage or server). In one approach, a method includes: receiving, from a local device, data blocks to be stored; generating a hash from a hash of each data block; storing each respective hash (e.g., in a local or remote memory for later use); and writing the data blocks to remote storage. Data integrity is verified when each data block is read from the remote storage by generating a hash of the respective read data block, and comparing the generated hash to the respective stored hash.
1. A method, comprising:
reading a data block stored in a remote storage;
generating, using a predetermined key, a hash tag from a hash of the read data block;
observing an identifier of the read data block;
retrieving a stored hash tag associated with the read data block identifier, the stored hash tag being previously generated using the predetermined key;
comparing the generated hash tag with the stored hash tag, wherein a match between the generated hash tag and the stored hash tag indicates that the read data block is valid; and
sending the read data block to a local data device after determining that the read data block is valid through the hash tag comparison.
2. The method of claim 1 , further comprising storing a data block identifier with a hash tag, wherein the data block identifier is associated with a data block stored in the remote storage.
3. The method of claim 2 , wherein the data block identifier is a block address provided by a file system of a local data device that provides the data block to be stored.
4. The method of claim 2 , wherein the hash tag is stored in a local memory.
5. The method of claim 1 , further comprising:
receiving, by the local data device, a first data block;
generating, by the local data device, a first hash tag from a cryptographic hash and an identifier of the first data block;
storing the first hash tag in the local data device; and
writing the first data block to the remote storage.
6. The method of claim 1 , wherein the hash tag is generated by an encryption appliance.
7. The method of claim 6 , wherein the hash tag is stored in local memory of the encryption appliance.
8. The method of claim 6 , wherein the remote storage is a first remote storage, and wherein storing the hash tag comprises sending the hash tag over a network to a second remote storage to be stored in memory.
9. The method of claim 8 , wherein comparing the generated hash to the stored hash tag comprises retrieving the hash tag from the second remote storage.
10. A method, comprising:
generating, by a local data device using a predetermined key, a first hash tag from a cryptographic hash and an identifier of a data block received by the local data device;
storing the first hash tag in the local data device;
writing the data block to a remote storage;
reading the data block stored in the remote storage;
generating, using the predetermined key, a second hash tag from the read data block;
observing the identifier of the read data block;
retrieving the stored first hash tag using the identifier that is associated with the stored first hash tag;
comparing the second hash tag with the first hash tag, wherein a match between the first and second hash tag indicates that the read data block is valid; and
sending the read data block to the local data device after determining that the read data block is valid through the hash tag comparison.
11. The method of claim 10 , wherein the remote storage is a first remote storage, and wherein storing the first hash tag comprises sending the first hash tag over a network to a second remote storage to be stored in memory.
12. The method of claim 10 , wherein comparing the second hash tag with the first hash tag includes retrieving the first hash tag from a second remote storage.
13. A system, comprising:
at least one processing device; and
memory storing instructions configured to instruct the at least one processing device to:
read a data block stored in a remote storage;
generate, using a predetermined key, a hash tag from a hash of the read data block;
observe an identifier of the read data block;
retrieve a stored hash tag associated with the read data block identifier, the stored hash tag being previously generated using the predetermined key;
compare the generated hash tag with the stored hash tag, wherein a match between the generated hash tag and the stored hash tag indicates that the read data block is valid; and
send the read data block to a local device after determining that the read data block is valid through the hash tag comparison.
14. The system of claim 13 , wherein the instructions are further configured to instruct the at least one processing device to:
receive, by the local device, a first data block;
generate, by the local device, a first hash tag from a cryptographic hash and an identifier of the first data block; and
write the first data block to the remote storage.
15. The system of claim 14 , wherein the first data block comprises a payload having a plurality of file objects.
16. The system of claim 13 , wherein the instructions are further configured to instruct the at least one processing device to set up a transport protocol using at least one certificate received from a certificate authority, wherein the at least one certificate is verified prior to establishing a connection to the local device using the transport protocol.
17. The system of claim 16 , wherein the instructions are further configured to instruct the at least one processing device to verify the identity of the cloud storage or server using the at least one certificate.
18. The system of claim 16 , wherein the instructions are further configured to instruct the at least one processing device to set up the transport protocol using at least one certificate received from the certificate authority, and to verify the identity of the remote storage, wherein the identity is verified prior to establishing a connection to the remote storage using the transport protocol.
19. The system of claim 13 , wherein the instructions are further configured to instruct the at least one processing device to:
decrypt, using a payload key, the read data block to provide decrypted data; and
send, to the local device, using a transport protocol, the decrypted data.
20. The system of claim 13 , wherein the instructions are further configured to instruct the at least one processing device to verify the identity of the remote storage, the verifying including receiving at least one certificate from a certificate authority.
21. The method of claim 1 , wherein the stored hash tag is a keyed hash.
22. The method of claim 21 , wherein the remote storage is a first remote storage, and wherein storing the hash tag comprises sending the keyed hash over a network to a second remote storage.