Security First Corp.

Abstract:

The systems and methods disclosed herein transparently provide an improved scalable cloud-based dynamically adjustable or configurable storage volume. In one aspect, a gateway provides a dynamically or configurably adjustable storage volume, including a local cache. The storage volume may be transparently adjusted for the amount of data that needs to be stored using available local or cloud-based storage. The gateway may use caching techniques and block clustering to provide gains in access latency compared to existing gateway systems, while providing scalable off-premises storage.

Claim 1:

1.  A method for providing data recovery to a client computer system using cloud-based storage, the method comprising:

detecting a request to capture a snapshot of a local file system of the client computer system at a first timestamp, wherein one or more data files associated with the client computer system are transparently stored to a storage volume, the storage volume comprising a local cache memory communicatively coupled to the client computer system and a cloud library comprising one or more remote storage devices;

in response to detecting the request, sending a snapshot capture indicator including the first timestamp to a gateway manager associated with the storage volume;

generating, using the gateway manager, a first capture of a state of the local cache memory at the first timestamp;

requesting, using the gateway manger, a second capture of a state of one or more cluster blocks stored by the one or more remote storage devices at the first timestamp, the cluster blocks including the one or more data files;

generating a capture version number for the first and second capture based on the snapshot capture indicator;

causing the storage volume to store the first capture, the second capture and the capture version number; and

wherein causing the storage volume to store the first or the second capture comprises:

applying, at the local cache memory, a first cryptographic operation to the first or the second capture based on a first encryption key, and applying, at a cloud interface, a second cryptographic operation based on a second encryption key to the first or the second capture that is encrypted with the first encryption key.

Abstract:

A method for facilitating an authentication related to an electronic transaction between a first and a second user is provided. Authentication data is received from the first user along with transaction data defining the first user and the electronic transaction to be authenticated. This authentication data is compared to enrollment authentication data associated with the first user in order to verify the identity of the first user. When the user is properly verified, access to at least one private cryptographic key stored on a secure server is available for use in securing the electronic transaction. The particular private cryptographic key need not be released from the secure server. Data indicating the status of the authentication may then be sent to one of either the first or second user.

Claim 1: 

1. A method of implementing a cryptographic transaction related to an electronic transaction between a vendor device and a user device, the method comprising:

storing, by a secure server, one or more private keys of a user from a plurality of private cryptographic keys, first one or more authentication data of the user, and a first user identifier of the user, wherein the one or more private keys of the user is unknown to the user;

receiving, by the vendor device, a transaction request and a second user identifier from the user device;

generating, by the vendor device, a unique transaction identifier (TID) of the current transaction, wherein the TID uniquely identifies the current transaction between the vendor and the user;

sending from the vendor device a cryptographic transaction request, the TID, and a current authentication data request to the user device;

sending from the vendor device the TID and the second user identifier to the secure server;

querying the user for second one or more authentication data based on the current authentication data request using the user device;

receiving from the user the second one or more authentication data; and

sending from the user device the TID sent from the vendor device and the second one or more authentication data to the secure server;

retrieving, by the secure server, the first one or more authentication data using the first user identifier and the second user identifier;

comparing, by the secure server, the first one or more authentication data and the second one or more authentication data; and

retrieving, by the secure server, the one or more private keys of the user and performing, by the secure server, one or more cryptographic functions employing the one or more private keys based on the comparison.

Abstract

Systems
and methods are provided for securing data in virtual machine computing
environments. A request is received for a security operation from a first
virtual machine operating in a host operating system of a first device. In
response to receiving the request, a first security module executes the
security operation, the first security module implemented in a kernel of the
host operating system. The result of the security operation is provided to the
first virtual machine.

Claim 1:

1. A method for securing data, the method comprising:

receiving, using a hardware processor, a request for a security operation from a first virtual machine operating in a host operating system of a first device, wherein the security operation is to be performed by one or more of a plurality of security modules including a first security module implemented in a kernel of the host operating system and a second security module;

in response to receiving the request:

determining whether the second security module is available to execute the request;

selecting the first security module implemented in the kernel of the host operating system to execute the security operation in response to determining that the second security module is not available to execute the request; and

executing the security operation at the first security module implemented in the kernel of the host operating system and providing a result of the security operation to the first virtual machine.