Automatic file encryption
A method for automatically encrypting files is disclosed. In some cases, the method may be performed by computer hardware comprising one or more processors. The method can include detecting access to a first file, which may be stored in a primary storage system. Further, the method can include determining whether the access comprises a write access. In response to determining that the access comprises a write access, the method can include accessing file metadata associated with the first file and accessing a set of encryption rules. In addition, the method can include determining whether the file metadata satisfies the set of encryption rules. In response to determining that the file metadata satisfies the set of encryption rules, the method can include encrypting the first file to obtain a first encrypted file and modifying an extension of the first encrypted file to include an encryption extension.
1 . A computer-implemented method for backing up an encrypted file to secondary storage in an information management system, the computer-implemented method comprising:
by one or more computing devices comprising one or more hardware processors:
receiving an identification of a first data file to be backed up to secondary storage;
based on determining that the first data file is encrypted, accessing an encrypted private key;
transmitting the encrypted private key to a decryption module, wherein the decryption module comprises one or more hardware processors;
receiving a decrypted version of the encrypted private key;
extracting an encrypted data encryption key embedded with the first data file from the first data file;
decrypting the encrypted data encryption key using the decrypted version of the encrypted private key received from the decryption module, resulting in a decrypted version of the encrypted data encryption key;
decrypting the first data file using the decrypted version of the encrypted data encryption key, resulting in a decrypted first data file, wherein decrypting the first data file is performed to enable storage-side deduplication or single-instance storage at the secondary storage; and
making the decrypted first data file available to a secondary storage computing device for storage to the secondary storage, wherein the secondary storage computing device comprises one or more hardware processors and is communicatively coupled to the secondary storage.
2 . The computer-implemented method of claim 1 further comprising:
applying deduplication to the decrypted first data file before storing thereof to the secondary storage.
3 . The computer-implemented method of claim 1 further comprising:
encrypting the decrypted first data file after applying deduplication thereto, resulting in an encrypted deduplicated first data file; and
storing the encrypted deduplicated first data file to the secondary storage.
4 . The computer-implemented method of claim 1 , wherein the decrypting of the first data file enables deduplication to be applied thereto before storing the first data file, in deduplicated form, to the secondary storage.
5 . The computer-implemented method of claim 1 , wherein the decrypting of the first data file enables the information management system to make the first data file available to one or more of: multiple users of the information management system and multiple computing devices associated with the information management system.
6 . The computer-implemented method of claim 1 , wherein the identification of a first data file to be backed up to secondary storage is accompanied by a user permission to decrypt the first data file using the encrypted private key, which is associated with the user.
7 . The computer-implemented method of claim 1 , wherein a user permission to decrypt the first data file using the encrypted private key is given before the first data file is encrypted, wherein the encrypted private key is associated with the user.
8 . The computer-implemented method of claim 1 , wherein the encrypted private key is associated with the one or more computing devices.
9 . The computer-implemented method of claim 1 , wherein the identification of the first data file is based on a storage location of the first data file in a primary storage that is distinct from the secondary storage.
10 . A computer-implemented system for backing up an encrypted file to secondary storage in an information management system, the computer-implemented system comprising one or more computing devices comprising one or more hardware processors, wherein the one or more computing devices is configured to:
receive an identification of a first data file to be backed up to secondary storage;
based on determining that the first data file is encrypted, access an encrypted private key;
transmit the encrypted private key to a decryption module, wherein the decryption module comprises one or more hardware processors;
receive a decrypted version of the encrypted private key;
extract an encrypted data encryption key embedded with the first data file from the first data file;
decrypt the encrypted data encryption key using the decrypted version of the encrypted private key received from the decryption module, resulting in a decrypted version of the encrypted data encryption key;
decrypt the first data file using the decrypted version of the encrypted data encryption key, resulting in a decrypted first data file, wherein decrypting the first data file is performed to enable storage-side deduplication or single-instance storage at the secondary storage; and
make the decrypted first data file available to a secondary storage computing device for storage to the secondary storage,
wherein the secondary storage computing device comprises one or more hardware processors and is communicatively coupled to the secondary storage.
11 . The computer-implemented system of claim 10 , wherein the one or more computing devices is further configured to:
apply deduplication to the decrypted first data file before storing thereof to the secondary storage.
12 . The computer-implemented system of claim 10 , wherein the one or more computing devices is further configured to:
encrypt the decrypted first data file after applying deduplication thereto, resulting in an encrypted deduplicated first data file; and
store the encrypted deduplicated first data file to the secondary storage.
13 . The computer-implemented system of claim 10 , wherein the decrypting of the first data file enables deduplication to be applied thereto before storing the first data file, in deduplicated form, to the secondary storage.
14 . The computer-implemented system of claim 10 , wherein the decrypting of the first data file enables the information management system to make the first data file available to one or more of: multiple users of the information management system and multiple computing devices associated with the information management system.
15 . The computer-implemented system of claim 10 , wherein the identification of a first data file to be backed up to secondary storage is accompanied by a user permission to decrypt the first data file using the encrypted private key, which is associated with the user.
16 . The computer-implemented system of claim 10 , wherein a user permission to decrypt the first data file using the encrypted private key is given before the first data file is encrypted, wherein the encrypted private key is associated with the user.
17 . The computer-implemented system of claim 10 , wherein the encrypted private key is associated with the one or more computing devices.
18 . The computer-implemented system of claim 10 , wherein the identification of the first data file is based on a storage location of the first data file in a primary storage that is distinct from the secondary storage.