Granted Patent B2

US 12,499,248 · App. 18/655,439 · Granted Dec 16, 2025

Inventors: Ophir Rachman (Sunnyvale, CA); Eric Sites (Palm Harbor, FL); Matthew Wilkinson (Gainesville, FL); Blake Emmons (Louisville, KY); Matt Meuse (Quechee, VT); Kelly McLaughlin (South Plainfield, NJ); Lauren Miehe (East Wenatchee, WA); Paul Lewis (Asbury, NJ)

G06F21/602G06F3/062G06F3/064G06F3/067G06F21/6218H04L9/0819H04L9/0861H04L9/14H04L9/3226H04L63/0428H04L63/08G06F2221/2107H04L67/1097

Abstract

Claims (97)

1 . A cloud-based system for securely storing data formed into cloud technology-specific data objects (hereinafter, “buckets”), comprising:

a processor configured to:

obtain original data buckets from a client cloud storage gateway device;

split the original data buckets into at least three data blocks;

encrypt the data blocks using an encryption key associated with the data blocks; and

write the encrypted data blocks across at least three cloud storage providers, each cloud storage provider located in a different physical location, each data block written to at least two but less than all of the cloud storage providers, whereby there is no single cloud storage provider to which all of the data blocks are written; such that if any one cloud storage provider is unavailable, the encrypted data blocks stored thereon may be retrieved from at least one other cloud storage provider; and in the case any one of the cloud storage providers is compromised, the original data cannot be recovered from the encrypted data blocks stored in that cloud storage provider alone;

create a pointer file containing locations of each of the encrypted data blocks in every cloud storage provider in which they were written;

store the pointer file in a storage device;

delete the original data from a client storage device that provided it to the client cloud storage gateway device;

analyze communications of a specific backup software during the ordinary course of backup and restore operations, including:

identify at least one read operations pattern that the backup software generates during backups;

create a white list that represents the identified read patterns using regex expressions; and

deploy the white list at the backend platform to support multi-factor authentication (MFA) for read operations from the cloud storage used by the backup software as a Restore Control capability.

2 . The system of claim 1 , the processor being further configured, after the original data is deleted, to:

detect a condition in one of the clouds that renders it abnormal and unusable;

abandon the abnormal cloud;

establish a new cloud to replace the abnormal cloud;

use the pointer file to:

identify the encrypted block fragments that were stored in the abnormal cloud; and

locate at least one normal cloud for each of the identified encrypted block fragments in which that identified encrypted block fragment is stored;

copy the identified encrypted block fragments from the located normal clouds to the established new cloud; and

update the pointer file by replacing information contained therein of encrypted block fragments that were stored in the abnormal cloud, with information of corresponding encrypted block fragments stored in the established new cloud.

3 . The system of claim 1 , wherein the processor is further configured to thereafter:

obtain encrypted block storage information from the pointer file;

retrieve the encrypted blocks using the storage information; and

decrypt and reassemble the retrieved encrypted blocks as the original buckets.

4 . The system as recited in claim 1 , wherein a client or application accesses the system via an S3 gateway application programming interface (API).

5 . The system of claim 1 , wherein the processor is further configured to:

obtain a request to restore a backup stored in the cloud storage; and

enforce multi-factor authentication (MFA) for restore operations.

6 . The system of claim 5 , wherein the enforcing multi-factor authentication (MFA) includes issuing a challenge before allowing the backup data to be reconstituted.

7 . The system of claim 1 , wherein the processor is further configured, after the Restore Control is enabled for a Cloud storage vault used by the backup software, to:

responsive to a read operation being requested from the vault, examine the source of the request and determine whether the user agent of the request matches a supported backup software:

in the case the user-agent matches a supported backup software:

determine which specific backup software is requesting the read operation; and

associate the request with the appropriate white list for that backup software;

match the requested file against the whitelist;

in the case there is a match, grant the request;

in the case there is not a match, block the read request;

in the case the user-agent does not match any supported backup software:

associate the request with an empty white list, and block the read request.

8 . The system of claim 7 , wherein the processor is further configured, after the read request is blocked, to:

cause a Restore Control request to appear in a back-end management console;

cause a Restore Control notification to be sent to a user having rights sufficient to approve the request;

receive from a user a request to log on to a back-end management console, including an interactive MFA;

authorize the user and allow them to log on to the back-end management console and approve the Restore Control request;

allow read operations for a pre-determined period; and

notify the user who initiated the restore operation that they can restart the restore operation using the backup software; and

responsive to a new request for restore operations received from the initiating user, allow the restore operation to begin and run to completion.

9 . A computer implemented method for securely storing data formed into cloud technology-specific data objects (hereinafter, “buckets”), comprising:

causing a processor to complete steps including:

obtaining original data buckets from a client cloud storage gateway device;

splitting the original data buckets into at least three data blocks each; encrypting the data blocks using an encryption key associated with the data blocks;

writing the encrypted data blocks across at least three cloud storage providers, each cloud storage provider located in a different physical location, each data block written to at least two but less than all of the cloud storage providers, whereby there is no single cloud storage provider to which all of the data blocks are written; such that if any one cloud storage provider is unavailable, the encrypted data blocks stored thereon may be retrieved from at least one other cloud storage provider; and in the case any one of the cloud storage providers is compromised, the original data cannot be recovered from the encrypted data blocks stored in that cloud storage provider alone;

creating a pointer file containing locations of the encrypted data blocks in every cloud storage provider to which each of the encrypted data blocks was written;

storing the pointer file in the client cloud storage gateway device;

deleting the original data from the client cloud storage gateway device;

analyze communications of a specific backup software during the ordinary course of backup and restore operations, including:

identify at least one read operations pattern that the backup software generates during backups;

create a white list that represents the identified read patterns using regex expressions; and

deploy the white list at the backend platform to support multi-factor authentication (MFA) for read operations from the cloud storage used by the backup software as a Restore Control capability.

10 . The method of claim 9 , further causing the processor to complete steps after the original data is deleted, including:

detecting a condition in one of the clouds that renders it abnormal and unusable;

abandoning the abnormal cloud;

establishing a new cloud to replace the abnormal cloud;

using the pointer file to:

identify the encrypted block fragments that were stored in the abnormal cloud; and

locate at least one normal cloud in which each of the identified encrypted block fragments is stored;

copying the identified encrypted block fragments from the located normal clouds to the established new cloud; and

updating the pointer file by replacing information contained therein of encrypted block fragments that were stored in the abnormal cloud, with information of corresponding encrypted block fragments stored in the established new cloud.

11 . The method of claim 10 , further causing the processor to complete steps including:

obtaining encrypted block storage information from the pointer file;

retrieving the encrypted blocks using the storage information; and

decrypting and reassembling the retrieved encrypted blocks as the original data buckets.

12 . The method of claim 9 , wherein a client or application accesses the system via an S3 gateway application programming interface (API).

13 . The method of claim 9 , wherein the processor is further configured to:

obtain a request to restore a backup stored in the cloud storage; and

enforce multi-factor authentication (MFA) for restore operations.

14 . The method of claim 13 , wherein the enforcing multi-factor authentication (MFA) includes issuing a challenge before allowing the backup data to be reconstituted.

15 . The method of claim 9 , wherein the processor is further configured, after the Restore Control is enabled for a Cloud storage vault used by the backup software, to:

responsive to a read operation being requested from the vault, examine the source of the request and determine whether the user agent of the request matches a supported backup software:

in the case the user-agent matches a supported backup software:

determine which specific backup software is requesting the read operation; and

associate the request with the appropriate white list for that backup software;

match the requested file against the associated whitelist;

in the case there is a match, grant the request;

in the case there is not a match, block the read request;

in the case the user-agent does not match any supported backup software:

associate the request with an empty white list, and block the read request.

16 . The system of claim 15 , wherein the processor is further configured, after the read request is blocked, to:

cause a Restore Control request to appear in a back-end management console;

cause a Restore Control notification to be sent to a user having rights sufficient to approve the request;

receive from a user a request to log on to a back-end management console, including an interactive MFA;

authorize the user and allow them to log on to the back-end management console and approve the Restore Control request;

allow read operations for a pre-determined period; and

notify the user who initiated the restore operation that they can restart the restore operation using the backup software; and

responsive to a new request for restore operations received from the initiating user, allow the restore operation to begin and run to completion.

Assignments (1)

Continuity (7)

References Cited (40)