US 12,244,603 B2
Encryption and decryption of data in a cloud storage based on indications in metadata
Matthew G. Borlick, Tucson, AZ (US); Lokesh M. Gupta, Tucson, AZ (US); and Micah Robison, Tucson, AZ (US)
Assigned to INTERNATIONAL BUSINESS MACHINES CORPORATION, Armonk, NY (US)
Filed by INTERNATIONAL BUSINESS MACHINES CORPORATION, Armonk, NY (US)
Filed on Mar. 23, 2016, as Appl. No. 15/078,187.
Prior Publication US 2017/0279812 A1, Sep. 28, 2017
Int. Cl. H04L 9/40 (2022.01); G06F 21/62 (2013.01)
CPC H04L 63/107 (2013.01) [G06F 21/6218 (2013.01); G06F 21/6236 (2013.01); H04L 63/0428 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A method, comprising:
storing encrypted data in a first cloud server of a plurality of cloud servers in a cloud computing environment;
configuring a controller having at least a first processor complex and a second processor complex that function redundantly of each other, wherein the first processor complex is able to take over operations performed by the second processor complex, wherein the controller includes a data distribution and security preservation application and a data structure that stores information on where a plurality of storage clouds are maintained, and wherein the plurality of storage clouds include the plurality of cloud servers;
maintaining metadata associated with the encrypted data in the controller in the cloud computing environment, wherein the controller is communicatively coupled via an interface to the first cloud server of the plurality of cloud servers, wherein the metadata indicates geographical restrictions and policies on the encrypted data, wherein the geographical restrictions and the policies indicate that the encrypted data is allowed to be stored in a first geographical location only until a predetermined date, wherein the first cloud server of the plurality of cloud servers is located in a second geographical location and is maintained by a first vendor and has a first operating system, wherein a second cloud server of the plurality of cloud servers is located in a third geographical location and is maintained by a second vendor and has a second operating system, wherein the second operating system is different from the first operating system, and wherein the geographical restrictions include first restrictions that require storing health related data of an individual in a country in which the individual resides, second restrictions that require storing employee data of a corporation within a firewall of the corporation, and third restrictions that require storing electronic mail data of residents of a group of countries in storage that is located in the group of countries;
sending a request from the first cloud server to the controller for a decryption code for the encrypted data;
in response to receiving, by the controller, the request from the first cloud server, determining by the data distribution and security preservation application and the data structure included in the controller from the metadata whether the metadata indicates that reading of information in the encrypted data is allowed in the second geographical location where the first cloud server that stores the encrypted data is located;
in response to determining, by the data distribution and security preservation application and the data structure included in the controller, that the metadata indicates that the reading of information in the encrypted data is allowed in the second geographical location where the first cloud server that stores the encrypted data is located, transmitting the decryption code from the controller to the first cloud server, wherein on receiving the decryption code the first cloud server decrypts the encrypted data; and
in response to determining, by the data distribution and security preservation application and the data structure included in the controller, that the metadata indicates that the reading of information in the encrypted data is not allowed in the second geographical location where the first cloud server that stores the encrypted data is located, declining to provide the decryption code to the first cloud server, wherein in response to the encrypted data being copied in an unauthorized manner to a third cloud server of the plurality of cloud servers the controller declines to provide the decryption code to the third cloud server, and wherein the controller allows a plurality of host computational devices to perform Input/Output (I/O) operations with logical storage maintained in the controller, wherein physical storage corresponding to the logical storage is maintained in the plurality of cloud servers.