Backup and recovery of private information on edge devices onto surrogate edge devices
A system and method for backing up critical data of edge devices includes originator, surrogate, and target edge devices as well as a vault-broker server. The critical data, encrypted, is transmitted to and stored by a surrogate. The association of originator and surrogate is managed by the vault-broker server. Encryption protects the data from recovery by unauthorized parties while allowing surrogate edge devices to determine if recovery attempts are made by authorized parties.
1. A method for backing up critical data stored on an originator edge device associated with a user such that the backed up critical data may be recovered onto a target edge device, the method comprising:
requesting, by a vault-broker server, the originator edge device to create an export backup record of critical data stored on the originator edge device;
generating a wrapping key;
generating, by the originator edge device, the export backup record in response to the request for the export backup record, the export backup record being a function of the wrapping key, a cryptographic key, and the critical data being backed up;
transmitting a backup-response message including the export backup record, by the originator edge device to the vault-broker server;
transmitting the backup-response message including the export backup record by the vault-broker server to a surrogate edge device;
storing the export backup record on the surrogate edge device without information allowing the surrogate edge device to access the critical data backed up from the originator edge device; and
storing an association between the originator edge device and the surrogate edge device on the vault-broker server.
2. The method of claim 1 comprising:
establishing at least one implied circle of trust among edge devices based on a common cryptographic key issued by a trusted certificate authority or knowledge of a certificate of the trusted certificate authority;
provisioning the surrogate edge device with a certificate issued by the trusted certificate authority;
selecting, by the vault-broker server, the surrogate edge device from an implied circle of trust to which the originator edge device belongs; and
verifying, by the originator edge device, that the surrogate edge device belongs to the same implied circle of trust as the originator edge device by checking the certificate of the surrogate edge device using the common cryptographic key or the knowledge of the certificate of the trusted certificate authority.
3. The method of claim 2 , wherein the implied circle of trust includes multiple surrogate edge devices and the method further comprises, for each surrogate edge device of a plurality of such multiple surrogate edge devices, repeating the steps of:
requesting, by the vault-broker server, the originator edge device to create an export backup record of critical data stored on the originator edge device;
generating a wrapping key;
generating, by the originator edge device, the export backup record in response to the request for the export backup record, the export backup record being a function of the wrapping key, a cryptographic key, and the critical data being backed up;
transmitting a backup-response message including the export backup record, by the originator edge device to the vault-broker server;
transmitting the backup-response message including the export backup record by the vault-broker server to said each surrogate edge device;
storing the export backup record on said each surrogate edge device; and
storing an association between the originator edge device and said each surrogate edge device on the vault-broker server.
4. The method of claim 1 comprising:
establishing at least one implied circle of trust among edge devices based on a common cryptographic key issued by a trusted certificate authority;
provisioning the target edge device with a certificate issued by the trusted certificate authority;
and
verifying, by the surrogate edge device, that the target edge device belongs to the same implied circle of trust as the originator edge device by checking the certificate of the target edge device using the common cryptographic key.
5. The method of claim 1 , wherein
the export backup record is generated by:
encrypting the critical data using the wrapping key;
hashing the wrapping key; and
creating the export backup record from the encrypted critical data and the hashed wrapping key; and
the backup-response message is generated by encrypting the export backup record with a cryptographic key of the surrogate edge device.
6. The method of claim 1 , wherein
the export backup record is generated by:
creating a wrapping key as a function of a backup-retrieval code;
encrypting the critical data using the wrapping key;
creating a hash value by hashing the wrapping key or the backup-retrieval code; and
creating the export backup record from the encrypted critical data and the hashed value; and
the backup-response message is generated by encrypting the export backup record with a cryptographic key of the surrogate edge device.
7. The method of claim 6 , wherein the backup-retrieval code is entered by the user of the originator edge device.
8. The method of claim 6 , wherein the backup-retrieval code is a personal identification number, a biometric, a password, or a challenge-response dialog.
9. The method of claim 1 , further comprising recovering the backed up private data on the target edge device, comprising:
generating, by the target edge device, a recovery-retrieval-code message and transmitting the recovery-retrieval-code message to the vault-broker server;
determining, by the vault-broker server, a surrogate edge device on which the export backup record of the originator edge device from which recovery is sought has been saved;
forwarding, by the vault-broker server, the recovery-retrieval-code message to the recovery surrogate edge device;
validating, by the recovery surrogate edge device, the recovery-retrieval-code message; and
upon successful validation of the recovery-retrieval-code message, transmitting a recovery-response message including the export backup record of the originator edge device to the vault-broker server; and
upon failure of the validation of the recovery-retrieval-code message, transmitting a recovery-response message including an error code;
forwarding, by the vault-broker server, the recovery-response message to the target edge device; and
in response to the recovery-response message including the export backup record, recovering, by the target edge device, the export backup record; and
in response to the recovery-response message including the error code, allowing the user an additional attempt to provide a valid backup-retrieval code.
10. The method of claim 9 , wherein the recovery-retrieval-code message includes a hash value of a wrapping key or a backup-retrieval code and an encryption key certificate of the target edge device.
11. The method of claim 9 , comprising:
establishing at least one implied circle of trust among edge devices based on a common cryptographic key issued by a trusted certificate authority or knowledge of a certificate of the trusted certificate authority;
provisioning the target edge device with a certificate issued by the trusted certificate authority;
and
verifying, by the surrogate edge device, that the target edge device belongs to the same implied circle of trust as the originator edge device by checking the certificate of the target edge device using the common cryptographic key.
12. The method of claim 11 , wherein the implied circle of trust includes multiple surrogate edge devices and the method further comprises, for each surrogate edge device of a plurality of such multiple surrogate edge devices, repeating the steps of:
requesting, by the vault-broker server, the originator edge device to create an export backup record of critical data stored on the originator edge device;
generating a wrapping key;
generating, by the originator edge device, the export backup record in response to the request for the export backup record, the export backup record being a function of the wrapping key, a cryptographic key, and the critical data being backed up;
transmitting a backup-response message including the export backup record, by the originator edge device to the vault-broker server;
transmitting the backup-response message including the export backup record by the vault-broker server to said each surrogate edge device;
storing the export backup record on said each surrogate edge device; and
storing an association between the originator edge device and said each surrogate edge device on the vault-broker server.
13. The method of claim 9 , wherein
the export backup record is generated by:
encrypting the critical data using the wrapping key;
hashing the wrapping key; and
creating the export backup record from the encrypted critical data and the hashed wrapping key; and
the backup-response message is generated by encrypting the export backup record with a cryptographic key of the surrogate edge device.
14. The method of claim 9 , wherein
the export backup record is generated by:
creating a wrapping key as a function of a backup-retrieval code;
encrypting the critical data using the wrapping key;
creating a hash value by hashing the wrapping key or the backup-retrieval code; and
creating the export backup record from the encrypted critical data and the hashed value; and
the backup-response message is generated by encrypting the export backup record with a cryptographic key of the surrogate edge device.
15. The method of claim 14 , wherein the backup-retrieval code is entered by the user of the originator edge device.
16. The method of any of claim 14 , wherein the backup retrieval code is a personal identification number, a biometric, a password, or a challenge-response dialog.
17. A system comprising:
a vault-broker server, an originator edge device, a surrogate edge device, and a target edge device, wherein
the vault-broker server is configured to request the originator edge device to create an export backup record of critical data stored on the originator edge device;
wherein the vault-broker server or the originator edge device is configured to generate a wrapping key;
wherein the originator edge device is configured to:
generate the export backup record in response to the request for the export backup record, the export backup record being a function of the wrapping key, a cryptographic key, and the critical data being backed up;
transmit a backup-response message including the export backup record to the vault-broker server;
wherein the vault-broker server is further configured to:
transmit the backup-response message including the export backup record by the vault-broker server to the surrogate edge device; and
store an association between the originator edge device and the surrogate edge device on the vault-broker server; and
wherein the surrogate edge device is configured to store the export backup record without information allowing the surrogate edge device to access the critical data backed up from the originator edge device.
18. The system of claim 17 ,
wherein the originator edge device, the surrogate edge device, and the target edge device are members of an implied circle of trust based on a common cryptographic key issued by a trusted certificate authority or knowledge of a certificate of the trusted certificate authority;
wherein the surrogate edge device is provisioned with a certificate issued by the trusted certificate authority;
wherein the vault-broker server is configured to select the surrogate edge device from the implied circle of trust to which the originator edge device belongs; and
wherein the originator edge device is configured to verify that the surrogate edge device belongs to the implied circle of trust to which the originator edge device belongs by checking the certificate of the surrogate edge device using the common cryptographic key.
19. The system of claim 18 , wherein the implied circle of trust includes multiple surrogate edge devices.
20. The system of claim 17 ,
wherein the originator edge device, the surrogate edge device, and the target edge device are members of an implied circle of trust based on a common cryptographic key issued by a trusted certificate authority or knowledge of a certificate of the trusted certificate authority;
wherein the target edge device is provisioned with a certificate issued by the trusted certificate authority; and
wherein the surrogate edge device is configured to verify that the target edge device belongs to the implied circle of trust to which the originator edge device belongs by checking the certificate of the target edge device using the common cryptographic key.
21. The system of claim 17 wherein the originator edge device is configured to:
generate the export backup record by:
encrypting the critical data using the wrapping key;
hashing the wrapping key; and
creating the export backup record from the encrypted critical data and the hashed wrapping key; and
generate backup-response message by encrypting the export backup record with a cryptographic key of the surrogate edge device.
22. The system of claim 17 , wherein the originator edge device is configured to:
generate the export backup record by:
creating a wrapping key as a function of a backup-retrieval code;
encrypting the critical data using the wrapping key;
creating a hash value by hashing the wrapping key or the backup-retrieval code; and
creating the export backup record from the encrypted critical data and the hashed value; and
generate the backup-response message by encrypting the export backup record with a cryptographic key of the surrogate edge device.
23. The system of claim 22 , wherein the backup-retrieval code is entered by the user of the originator edge device.
24. The system of claim 22 , wherein the backup-retrieval code is a personal identification number, a biometric, a password, or a challenge-response dialog.
25. The system of claim 17 , wherein the wrapping key is generated and saved by the vault-broker server.
26. The system of claim 17 wherein to recover backed up private data onto the target edge device:
the target edge device is configured to generate a recovery-retrieval-code message and transmitting the recovery-retrieval-code message to the vault-broker server;
the vault-broker server is further configured to:
determine a surrogate edge device on which the export backup record of the originator edge device from which recovery is sought (the recovery surrogate edge device) has been saved;
forward the recovery-retrieval-code message to the recovery surrogate edge device;
the recovery surrogate edge device is configured to:
validate the recovery-retrieval-code message;
upon successful validation of the recovery-retrieval-code message, transmit a recovery-response message including the export backup record of the originator edge device to the vault-broker server; and
upon failure of the validation of the recovery-retrieval-code message, transmit a recovery-response message including an error code;
wherein the vault-broker server is further configured to forward the recovery-response message to the target edge device; and
wherein the target edge device is further configured to:
if the recovery-response message includes the export backup record, recover the export backup record; and
if the recovery-response message includes the error code, allow the user an additional attempt to provide a valid backup-retrieval code.
27. The system of claim 26 wherein the recovery-retrieval-code message includes a hash of an attempted backup-retrieval code or attempted wrapping key and an encryption key certificate of the target edge device.
28. The system of claim 26 ,
wherein the originator edge device, the surrogate edge device, and the target edge device are members of an implied circle of trust based on a common cryptographic key issued by a trusted certificate authority or knowledge of a certificate of the trusted certificate authority;
wherein the surrogate edge device is provisioned with a certificate issued by the trusted certificate authority;
wherein the vault-broker server is configured to select the surrogate edge device from the implied circle of trust to which the originator edge device belongs; and
wherein the originator edge device is configured to verify that the surrogate edge device belongs to the implied circle of trust to which the originator edge device belongs by checking the certificate of the surrogate edge device using the common cryptographic key.
29. The system of claim 28 , wherein the implied circle of trust includes multiple surrogate edge devices.
30. The system of claim 26 ,
wherein the originator edge device, the surrogate edge device, and the target edge device are members of an implied circle of trust based on a common cryptographic key issued by a trusted certificate authority or knowledge of a certificate of the trusted certificate authority;
wherein the target edge device is provisioned with a certificate issued by the trusted certificate authority; and
wherein the surrogate edge device is configured to verify that the target edge device belongs to the implied circle of trust to which the originator edge device belongs by checking the certificate of the target edge device using the common cryptographic key.
31. The system of claim 26 wherein the originator edge device is configured to:
generate the export backup record by:
encrypting the critical data using the wrapping key;
hashing the wrapping key; and
creating the export backup record from the encrypted critical data and the hashed wrapping key; and
generate the backup-response message by encrypting the export backup record with a cryptographic key of the surrogate edge device.
32. The system of claim 26 , wherein the originator edge device is configured to:
generate the export backup record by:
creating a wrapping key as a function of a backup-retrieval code;
encrypting the critical data using the wrapping key;
creating a hash value by hashing the wrapping key or the backup-retrieval code; and
creating the export backup record from the encrypted critical data and the hashed value; and
generate the backup-response message by encrypting the export backup record with a cryptographic key of the surrogate edge device.
33. The system of claim 32 , wherein the backup-retrieval code is entered by the user of the originator edge device.
34. The system of claim 32 , wherein the backup-retrieval code is a personal identification number, a biometric, a password, or a challenge-response dialog.
35. The system of claim 26 , wherein the wrapping key is generated and saved by the vault-broker server.