System for automatically shadowing encrypted data and file directory structures for a plurality of network-connected computers using a network-attached memory with single instance storage

Abstract

The Secure Networked Data Shadowing System is connected to a plurality of monitored computer systems via an existing communication medium to store the shadowed data. The data is encrypted by the monitored computer system using a cryptokey, and the data file is processed using a hash function prior to encryption, so the contents of this file are uniquely identified. Thus, the encrypted file is stored in its encrypted form and the hash index is used to identify the encrypted file. A “data de-duplication” process avoids storing multiple copies of the same files by identifying instances of duplication via the hash index. Files that have the same hash index can be reduced to a single copy without any loss of data as long as the file structure information for each instance of the file is maintained.

1 . A data shadowing system for the automatic backup storage of data that is written in the memories of a plurality of monitored computer systems and the selective retrieval of this data for restoration to said memories, comprising:
 memory module means, connected to a plurality of monitored computer systems via a communication medium, for storing a shadow copy of the data which is written in the memories of the plurality of monitored computer systems;   customer data file management means, resident in each of said plurality of monitored computer systems, comprising:
 customer data file mapping means for mapping file directory structures associated with the customer data written in the memory of the monitored computer system into file tree information which identifies original names of customer data files as stored on said monitored computer system, and a location in said memory module means which stores said customer data; 
 customer data file hash means for processing each of said customer data files to generate an associated hash value of each of said customer data files; 
 customer data encryption means for encrypting each of said customer data files using a cryptokey having public and private components; 
 encrypted customer data file transmission means for transmitting said encrypted customer file, said hash value and a public encryption key to said memory module means; and 
 customer data file storage means, located at said memory module means, for storing each of said encrypted customer data files, said associated hash value, and said public encryption key received from each of said monitored computer systems via said communication medium, in said memory module means. 
   
     
     
         2 . The data shadowing system of  claim 1 , further comprising:
 duplication means, responsive to a plurality of said encrypted customer data files having the same hash value, for storing a single instance of said encrypted customer data file in said memory module means.   
     
     
         3 . The data shadowing system of  claim 2  wherein said customer data file storage means additionally stores said file tree information as well as said associated hash value and public cryptokey for each of said plurality of encrypted customer data files having the same hash value with said single instance of said customer data file in said memory module means. 
     
     
         4 . The data shadowing system of  claim 2 , further comprising:
 system file management means for automatically mapping system files written in the memory of the monitored computer system into file tree information which identifies original names of system files as stored on said monitored computer system and a location in said memory module means which stores said system files.   
     
     
         5 . The data shadowing system of  claim 4  wherein said system files comprise:
 computer files, exclusive of customer provided data, including at least one of: master boot record, partition table, and programs.   
     
     
         6 . The data shadowing system of  claim 4 , further comprising:
 system file hash means for processing each of said system files to generate an associated hash value of each of said system files;   wherein said memory module means further comprises:
 system file storage means for storing each of said system files and said associated hash value in said memory module means; and 
 wherein said mapping database means stores said hash value of each of said customer data files in said database. 
   
     
     
         7 . The data shadowing system of  claim 6 , further comprising:
 duplication means, responsive to a plurality of said system files having the same hash value, for storing a single instance of said system file in said memory module means.   
     
     
         8 . The data shadowing system of  claim 7  wherein said system file storage means additionally stores said file tree information for each of said plurality of system files having the same hash value and said associated hash value with said single instance of said system file in said memory module means. 
     
     
         9 . The data shadowing system of  claim 1  wherein said customer data file management means comprises:
 change journal means for automatically tracking changes to said customer data files, including: customer data file creation, customer data file movement, customer data file content changes, and customer data file renaming.   
     
     
         10 . The data shadowing system of  claim 9 , further comprising:
 file history means, responsive to a modification of a customer data file, for generating file change data indicative of a difference between said customer data file and said modified customer data file;   file tracking means for storing said file change data in said memory module means; and   wherein said customer data file management means stores said file change data in said memory module means and substitutes said modified customer data file for said customer data file in said memory module means.   
     
     
         11 . A method for the autonomous encrypted backup storage of data that is written in the memories of a plurality of monitored computer systems and the selective retrieval of this encrypted data for restoration to said memories, comprising:
 storing, in a memory module which is connected to a plurality of monitored computer systems via a communication medium, a shadow copy of the data which is written in the memories of the plurality of monitored computer systems;   managing customer data files, resident in each of said plurality of monitored computer systems, comprising:
 mapping file directory structures associated with the customer data written in the memory of the monitored computer system into file tree information which identifies original names of customer data files as stored on said monitored computer system and a location in said memory module means which stores said customer data; 
 processing each of said customer data files to generate an associated hash value of each of said customer data files; 
 encrypting each of said customer data files using a cryptokey having public and private components; 
 transmitting said encrypted customer file, said hash value and a public encryption key to said memory module; and 
 storing customer data files, located at said memory module, each of said encrypted customer data files, said associated hash value, and said public encryption key received from each of said monitored computer systems via said communication medium, in said memory module. 
   
     
     
         12 . The method for the autonomous encrypted backup storage of data of  claim 11 , further comprising:
 storing, in response to a plurality of said encrypted customer data files having the same hash value, a single instance of said encrypted customer data file in said memory module.   
     
     
         13 . The method for the autonomous encrypted backup storage of data of  claim 12  wherein said step of storing customer data files additionally stores said file tree information as well as said associated hash value and public cryptokey for each of said plurality of encrypted customer data files having the same hash value with said single instance of said customer data file in said memory module. 
     
     
         14 . The method for the autonomous encrypted backup storage of data of  claim 12 , further comprising:
 automatically mapping system files written in the memory of the monitored computer system into file tree information which identifies original names of system files as stored on said monitored computer system and a location in said memory module which stores said system files.   
     
     
         15 . The method for the autonomous encrypted backup storage of data of  claim 14  wherein said system files comprise:
 computer files, exclusive of customer provided data, including at least one of: master boot record, partition table, and programs.   
     
     
         16 . The method for the autonomous encrypted backup storage of data of  claim 14 , further comprising:
 processing each of said system files to generate an associated hash value of each of said system files;   wherein said step of storing a shadow copy of data files further comprises:
 storing each of said system files and said associated hash value in said memory module; and 
 wherein said step of mapping customer data files stores said hash value of each of said customer data files in said database. 
   
     
     
         17 . The method for the autonomous encrypted backup storage of data of  claim 16 , further comprising:
 storing, in response to a plurality of said system files having the same hash value, a single instance of said system file in said memory module.   
     
     
         18 . The method for the autonomous encrypted backup storage of data of  claim 17  wherein said system file storage means additionally stores said file tree information for each of said plurality of system files having the same hash value and said associated hash value with said single instance of said system file in said memory module means. 
     
     
         19 . The method for the autonomous encrypted backup storage of data of claim  21  wherein said customer data file management means comprises:
 change journal means for automatically tracking changes to said customer data files, including: customer data file creation, customer data file movement, customer data file content changes, and customer data file renaming.   
     
     
         20 . The method for the autonomous encrypted backup storage of data of  claim 19 , further comprising:
 file history means, responsive to a modification of a customer data file, for generating file change data indicative of a difference between said customer data file and said modified customer data file;   file tracking means for storing said file change data in said memory module means; and   wherein said customer data file management means stores said file change data in said memory module means and substitutes said modified customer data file for said customer data file in said memory module means.