Network device with virtual private file system

Patent metadata

Field	Value
Publication number	US-10484348-B1
Application number	US-201615388548-A
Country	US
Kind code	B1
Filing date	Dec 22, 2016
Priority date	Dec 22, 2016
Publication date	Nov 19, 2019
Grant date	Nov 19, 2019

Abstract

A network device includes a processor coupled to network interface circuitry and cryptographic circuitry. The network interface circuitry is configured to couple the network device to a local computer communication network. The processor is configured to generate an encryption key based on a hardware specific value recorded in the network device, and apply the cryptographic circuitry and the encryption key to encrypt files for storage in an Internet storage system coupled to a remote computer communication network, and present the encrypted files stored, by the processor, in the Internet storage system, to a computing device coupled to the network device via the local computer communication network, as a storage system attached to the local computer communication network.

First claim

What is claimed is:

1. A network router, comprising:
cryptographic circuitry;
a first transceiver configured to provide communication via a local area network;
a second transceiver configured to provide communication via a wide area network;
a processor coupled to the cryptographic circuitry, the first transceiver, and the second transceiver, wherein the processor is configured to:
receive, via the local area network, a first plaintext file;
determine that the first plaintext file is to be stored in a cloud storage system accessible via the wide area network;
generate an encryption key based on a hardware specific value recorded in the network router;
encrypt the first plaintext file using the cryptographic circuitry and the encryption key to create an encrypted file;
send the encrypted file to the cloud storage system via the wide area network;
receive, via the local area network, a second plaintext file;
determine that the second plaintext file is to be stored locally;
store the second plaintext file in unencrypted form locally in a data store coupled to the network router;
maintain a list of files, the list including encrypted files stored on the cloud storage system and unencrypted files stored locally in the data store coupled to the network router; and
present the list of files to a computing device coupled to the local area network as a file system resident on the local area network.

2. The network router of claim 1 , wherein the processor is further configured to:
receive from the computing device a request to access the first plaintext file;
retrieve the encrypted file from the cloud storage system;
decrypt the encrypted file using the cryptographic circuitry to recreate the first plaintext file; and
send the first plaintext file to the computing device.

3. The network router of claim 1 , wherein generating the encryption key comprises:
receiving, via the local area network, user specified security information; and
combining the user specified security information with the hardware specific value to create the encryption key.

4. The network router of claim 1 , wherein determining that the first plaintext file is to be stored in the cloud storage system comprises examining a pathname for the first plaintext file, and wherein determining that the second plaintext file is to be store locally comprises examining a pathname for the second plaintext file.

5. A method, comprising:
receiving, by a network device coupled to a local computer communication network, a first plaintext file;
generating, by the network device, an encryption key based on a hardware specific value recorded in the network device;
responsive to determining that the first plaintext file is to be stored as ciphertext:
encrypting, by the network device, the first plaintext file with the encryption key to produce an encrypted file; and
transmitting, by the network device, the encrypted file to an Internet storage system;

receiving, by the network device, a second plaintext file;
responsive to determining that the second plaintext file is to be stored as plaintext, storing the second plaintext file in a local storage system;
maintaining, by the network device, a list of files, the list including a reference to the encrypted file stored on the Internet storage system and the second plaintext file stored in the local storage system; and
presenting, to a computing device coupled to the local computer communication network, the list of files as a file system resident on the local computer communication network.

6. The method of claim 5 , further comprising determining that the first plaintext file is to be stored as ciphertext based on metadata for the first plaintext file.

7. The method of claim 5 , further comprising:
receiving, by the network device, from the computing device, a request to access the first plaintext file;
retrieving, by the network device, the encrypted file from the Internet storage system;
decrypting, by the network device, the encrypted file to recreate the first plaintext file; and
transmitting, by the network device, the first plaintext file to the computing device.

8. The method of claim 5 , further comprising:
receiving, by the network device, user specified security information; and
generating, by the network device, the encryption key using the user specified security information and the hardware specific value of the network device.

9. The method of claim 8 , wherein generating the encryption key comprises applying, by the network device, a hash to the user specified security information and to the hardware specific value.

10. The method of claim 5 , further comprising:
storing, by the network device, metadata for the first plaintext file; and
comparing, by the network device, the metadata to a file identification provided to the network device in a request to access the first plaintext file to determine that the encrypted file is to be retrieved from the Internet storage system.

11. The method of claim 5 , further comprising configuring a different network device to access the encrypted file stored in the Internet storage system by:
providing the different network device with a hardware specific value provided to the network device;
providing the different network device with user specified security information provided to the network device; and
generating, by the different network device, the encryption key using the user specified security information and the hardware specific value.

12. The method of claim 11 , wherein providing the different network device with the hardware specific value comprises using the different network device to retrieve the hardware specific value from a database.

13. A network device, comprising:
a processor; and
a network interface coupled to the processor and configured to couple the network device to a computer communication network;
wherein the processor is configured to:
generate an encryption key based on a hardware specific value recorded in the network device;
determine whether a first plaintext file received for storage is to be stored as plaintext or ciphertext;
responsive to a determination that the first plaintext file is to be stored as ciphertext, encrypt the first plaintext file using the encryption key and send the encrypted file to an Internet storage system;
determine whether a second plaintext file received for storage is to be stored as plaintext or ciphertext;
responsive to a determination that the second plaintext file is to be stored as plaintext, store the second plaintext file in a local storage system;
maintain a list of files, the list including a reference to the encrypted file stored on the Internet storage system and the second plaintext file stored in the local storage system; and
present the list of files as a file system resident on the local storage system.

14. The network device of claim 13 , wherein each of the determinations is based on metadata for the respective plaintext file.

15. The network device of claim 13 , further comprising another network interface coupled to the processor, wherein the processor is further configured to:
transmit all files as plaintext via the network interface;
determine, for each file to be transmitted via the other network interface, whether to encrypt the file prior to transmission; and
encrypt at least some files prior to transmission via the other network interface.

16. The network device of claim 13 , wherein the processor is further configured to:
receive, from the computing device, a request to access the first

Assignees

• Amazon Tech Inc

Inventors

• Levin Alex
• Diamant Ron
• Bishara Ihab
• Fortin Michael Butler
• Szilagyi Gary Lee
• Machulsky Georgy

Classifications

• G06F16/188

  Virtual file systems · CPC title

• H04L9/0643

  Hash functions, e.g. MD5, SHA, HMAC or f9 MAC · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L9/0866

  involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title