Welcome to Boliven.com, the leading portal for R&D, business development and IP professionals

Free & easy searching » Analyze & Download search results » Work collaboratively with colleagues » We keep you updated »

Click here to Sign Up. It's Free To Join.

Filing Information

Inventor(s)	Gavin David Cohen · Donald Alvin Trimmer · Rico Blaser ·
Assignee(s)	NETAPP, Inc. ·  View assignee updates
Attorney/Agent(s)	Perkins Coie LLP ·
Primary Examiner	Brandon S Hoffman ·
Application Number	US11051952
Filing date	02/04/2005
Issue date	07/07/2009
Prior Publication Data	US20060143443 - 06/29/2006
Predicted expiration date	04/10/2027
Patent term adjustment	795
U.S. Classifications	726/26  · 726/1  ·
International Classifications	H04L900 ·
Related U.S. Application Data	CROSS REFERENCE TO RELATED APPLICATIONS This application claims priority from U.S. provisional application nos. 60/541,626 filed Feb. 4, 2004 and 60/542,011 filed Feb. 5, 2004, which are incorporated by reference as if fully set forth herein.

Patent Family

Abstract

A method and apparatus for efficiently deleting data including backup or snapshots upon expiration are disclosed. The data can be deleted even without physical access to the data. A data generation unit generates a data. Each data has an expiration time and should be deleted upon expiration. An encryption unit encrypts the data, and the encrypted data is stored in data storage. A controller monitors whether there is an expired data, and if there is an expired data, the controller deletes a key necessary for decrypting the expired data.

Independent Claims | See all claims (9)

1. 1. A method for managing expiration operations of a backup management system to render expired backup data inaccessible, the method comprising: generating backup data from original data contained in a primary data volume as indicated by a data backup policy, wherein the data backup policy governs generation, storage, and expiration of the backup data; storing the backup data in a backup storage unit and encrypting the backup data, wherein the backup data but not the original data is encrypted; storing a decryption key and an associated expiration time in an encryption storage unit for each of a plurality of backup data, wherein: the decryption key is for decrypting the encrypted data; the expiration time is indicated by the data backup policy and indicates the time at which each of the plurality of backup data should be rendered inaccessible; a first backup data and a second backup data of the plurality of backup data are assigned an identical decryption key when the first backup data and the second backup data have an identical expiration time; the first backup data and the second backup data are assigned distinct decryption keys when the first backup data and the second backup data have different expiration times; and deleting the decryption key at a time indicated by the expiration time for each of the plurality of backup data, such that an expired backup data becomes inaccessible even if the expired backup data is not deleted from the backup storage unit.
2. 5. An apparatus for managing expiration operations of a backup management system to render expired backup data inaccessible, the apparatus comprising: a data generation unit to generate backup data from original data contained in a primary data volume, wherein a data backup policy governs generation, storage, and expiration of the backup data; an encryption unit to encrypt the backup data, wherein the encryption unit encrypts the backup data but not the original data; a backup storage unit to store the encrypted backup data; an encryption storage unit to store a decryption key and an expiration time for each of a plurality of backup data, wherein: the decryption key is for decrypting the encrypted data; the expiration time is indicated by the data backup policy and indicates the time and which each of the plurality of backup data should be rendered inaccessible; a first backup data and a second backup data of the plurality of backup data are assigned an identical decryption key when the first backup data and the second backup data have an identical expiration time; the first backup data and the second backup data are assigned distinct decryption keys when the first backup data and the second backup data have different expiration times; and a controller to delete the decryption key at a time indicated by the expiration time for each of the plurality of backup data, such that an expired backup data becomes inaccessible even if the expired backup data is not deleted from the backup storage unit.