Map-based rapid data encryption policy compliance

Patent metadata

Field	Value
Publication number	US-9740639-B2
Application number	US-201615266591-A
Country	US
Kind code	B2
Filing date	Sep 15, 2016
Priority date	Aug 30, 2011
Publication date	Aug 22, 2017
Grant date	Aug 22, 2017

Abstract

To comply with a policy for a computing device indicating that data written by the computing device to the storage volume after activation of the policy be encrypted, a sector map is accessed. The sector map identifies one or more sectors of a storage volume and also identifies, for each of the one or more sectors of the storage volume, a signature of the content of the sector. In response to a request to read the content of a sector, the content of the sector is returned without decrypting the content if the sector is one of the one or more sectors and the signature of the content of the sector matches the signature of the sector identified in the sector map. Otherwise, the content of the sector is decrypted and the decrypted content is returned.

First claim

What is claimed is:

1. A method implemented in a computing device, the method comprising:
accessing an encrypted chunks map of a storage volume to comply with a policy for the computing device, the encrypted chunks map grouping sectors of the storage volume into one or more chunks and indicating for each chunk whether sectors in the chunk are unencrypted or encrypted, the policy indicating that data written by the computing device to the storage volume after activation of the policy be encrypted;
in response to a request to write data to a sector of the storage volume:
identifying a chunk that includes the sector of the storage volume to which the data is requested to be written; and
determining, using the encrypted chunks map, whether the identified chunk is unencrypted;
in response to determining the identified chunk is not unencrypted:
encrypting the data to be written; and
writing the encrypted data to the sector of the storage volume to which the data is requested to be written; and
in response to determining the identified chunk is unencrypted:
encrypting sectors included in the identified chunk;
updating the encrypted chunks map;
encrypting the data to be written; and
writing the encrypted data to the sector of the storage volume to which the data is requested to be written.

2. The method as recited in claim 1 , the encrypting the sectors included in the identified chunk comprising encrypting all sectors included in the identified chunk.

3. The method as recited in claim 1 , the encrypting the sectors included in the identified chunk comprising encrypting sectors included in the identified chunk other than the sector to which the data is requested to be written.

4. The method as recited in claim 1 , wherein the one or more chunks have different numbers of sectors.

5. The method as recited in claim 1 , wherein the sectors included in each chunk are grouped by sector number in numeric order.

6. The method as recited in claim 1 , wherein the encrypted chunks map comprises a bitmap, each chunk corresponding to a bit of the bitmap, each bit being set to indicate that sectors in the corresponding chunk are encrypted or each bit being not set to indicate that sectors in the corresponding chunk are unencrypted.

7. The method as recited in claim 1 , wherein the encrypted chunks map comprises a most recent version of the encrypted chunks map and a next most recent version of the encrypted chunks map.

8. The method as recited in claim 1 , wherein the updating the encrypted chunks map comprises replacing a previous version of the encrypted chunks map with a most recent version of the encrypted chunks map and changing the most recent version of the encrypted chunks map.

9. The method as recited in claim 1 , further comprising, responsive to receiving a request from a requestor to read content from a sector of the storage volume:
determining, using the encrypted chunks map, whether a chunk including the sector from which the content is requested to be read is unencrypted;
responsive to determining the chunk is unencrypted, returning the content from the sector to the requestor; and
responsive to determining the chunk is not unencrypted:
decrypting the content from the sector; and
returning the decrypted content to the requestor.

10. The method as recited in claim 1 , further comprising maintaining a conversion log including identifiers of sectors that have been encrypted and signatures of sectors storing encrypted content.

11. A computing device comprising:
one or more hardware processors; and
one or more computer storage media devices having stored thereon multiple instructions that, when executed by the one or more processors to, cause the one or more processors to:
access an encrypted chunks map of a storage volume to comply with a policy for the computing device, the encrypted chunks map grouping sectors of the storage volume into one or more chunks and indicating for each chunk whether sectors in the chunk are unencrypted or encrypted, the policy indicating that data written by the computing device to the storage volume after activation of the policy be encrypted;
in response to a request to write data to a sector of the storage volume:
identify a chunk that includes the sector of the storage volume to which the data is requested to be written; and
determine, using the encrypted chunks map, whether the identified chunk is unencrypted;
in response to determining the identified chunk is not unencrypted:
encrypt the data to be written; and
write the encrypted data to the sector of the storage volume to which the data is requested to be written; and
in response to determining the identified chunk is unencrypted:
read the sectors included in the identified chunk;
replace, from the read sectors, the content of the sector being written to with the data begin written to the sector;
encrypt the sectors included in the identified chunk, including the replaced sector;
write the encrypted content of the sectors included in the identified chunk to the storage volume.

12. The computing device as recited in claim 11 , wherein the encrypted chunks map initially indicates that all chunks are unencrypted.

13. The computing device as recited in claim 11 , wherein the multiple instructions further cause the one or more hardware processors to, responsive to receiving a request from a requestor to read content from a sector of the storage volume:
determine, using the encrypted chunks map, whether a chunk including the sector from which the content is requested to be read is unencrypted;
responsive to determining the chunk is unencrypted, return the content from the sector to the requestor; and
responsive to determining the chunk is not unencrypted:
decrypt the content from the sector; and
return the decrypted content to the requestor.

14. The computing device as recited in claim 11 , wherein the multiple instructions further cause the one or more hardware processors to:
identify one or more chunks that includes sectors of the storage volume that are not in use; and
update the encrypted chunks map to indicate the identified one or more chunks are encrypted.

15. A method comprising:
receiving, by a computing device, a request to activate a policy for the computing device, the policy indicating that data written by the computing device to a storage volume after activation of the policy be encrypted;
activating, in response to the request, the policy for the computing device, including:
encrypting data written to the storage volume after returning an indication of compliance with the policy,
using a map to identify one or more collections of content on the storage volume that are not encrypted, the map identifying one or more collections of content written to prior to the map being locked to prohibit changes to the map and the map including signatures of collections of content that were written to the storage volume prior to the map being locked, data written to the storage volume after the map is locked being encrypted but at least some data written to the storage volume before the map is locked not being encrypted, and
using the map to determine whether to decrypt a collection of content in response to a request to read the collection of content; and
returning, in response to the request to activate the policy, the indication of compliance with the policy despite at least part of the storage volume being unencrypted.

16. The method as recited in claim 15 , the returning comprising returning the response without waiting for the storage volume to be encrypted.

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Basmov Innokentiy
• Nyström Magnus Bo Gustaf
• Semenko Alex M
• Maciver Douglas M
• Li Donghui

Classifications

• G06F21/602 Primary

  Providing cryptographic facilities or services · CPC title

• G06F12/14

  Protection against unauthorised use of memory {or access to memory} · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F16/2237

  Vectors, bitmaps or matrices · CPC title

• G06F3/0659

  Command handling arrangements, e.g. command buffers, queues, command scheduling · CPC title