Constant access gateway and de-duplicated data cache server

An Constant Access Gateway provides secure access for remote mobile computing users to centrally stored data without requiring a VPN connection or a direct connection to the LAN in which the data resides. A Cache Server works alone or in conjunction with the Constant Access Gateway to provide distributed access to the centrally stored data. The Cache Server performs local storage of de-duplicated versions of the centrally stored data, and may interact with the Constant Access Gateway to maintain cache coherency with the central data store.

FIELD OF THE DISCLOSURE

This disclosure relates to providing data access, and specifically for providing secure and efficient access to centrally-stored data.

BACKGROUND

Traditional data storage systems are designed to be centrally stored, managed and searched. Examples of such systems include backup servers, file servers, document repositories like SharePoint, Documentum etc. These systems typically reside in a corporate data center, behind a firewall, and are available only to those users who are connected to the corporate network, either via a LAN (local area network), or via a VPN (virtual private network) usually over a WAN (wide area network) such as the Internet.

There are several considerations that make it harder to maintain data centrally, including (1) the proliferation of remote sites, (2) the presence of mobile users, and (3) the proliferation of smart phones and other mobile devices. First, there are many remote sites in a company from which there is a need to access data that may be stored centrally. These sites may be connected to the central site either via a dedicated WAN connection or via a VPN over the Internet. However, given the latency of WAN connections, it may be difficult or slow to access data over the WAN from the central site. Second, there may be mobile and remote users in a corporation, who, while connected to the Internet, are not necessarily connected to the central site via a VPN connection. Third, many of these remote users may utilize mobile devices such as smart phones and tablets that may not have the ability to connect via a VPN, or for whom such connections are intermittent.

SUMMARY

The methods and systems described here can be used to provide secure, reliable, efficient, and ubiquitous access to centrally-stored data behind one or more firewalls, e.g., in a corporate data center from devices which are not directly connected to the corporate network via VPN or LAN.

Some embodiments described herein have two main components: a Constant Access Gateway and a De-duplicated Data Cache Server.

Constant Access Gateway

The Constant Access Gateway (CAG) can provide the following benefits:1. Ubiquitous, secure access to corporate data without requiring a VPN connection or opening any incoming firewall ports2. Multi-level and multi-factor authentication with existing authentication mechanisms3. Built-in encryption4. A scalable system supporting multiple simultaneous connections5. Configurable access to logical data flow direction, supporting either just inflow or outflow or both6. Configurable access based on user, location or other identifiable metadata.

De-Duplicated Data Cache Server

The De-duplicated Data Cache Server (hereinafter, “the Cache Server”) includes a de-duplicated repository of data stored in the form of unique objects or blocks of data. The data is a cache that is intelligently built and managed based on the access needs of the site which is served by the Cache Server. Some of the features of the Cache Server are:1. Distributed cache: the Cache Server may be distributed across one or more remote sites, in addition to the central site, enabling faster and more reliable access to data.2. De-duplicated data: All data is stored in a de-duplicated form, ensuring that only unique objects or blocks are stored at each site. This makes data storage more efficient, and increases the amount of useful data that can be stored at each site of the Cache Server.3. WAN efficiency: Only unique blocks or objects are transferred to the Cache Server.4. Intelligent handling of cache misses: The system keeps a map of various potential sources of data. In the event that data is requested that is not in the cache (a “cache miss”), the Cache Server can intelligently retrieve the missing data from the best available source based on cost, latency, and/or other factors.5. Pre-population of data blocks: the system supports pushing out blocks of data before they are needed in order to expedite an anticipated future access at a remote site.6. Flushing of data blocks: the system supports flushing out data from a remote cache server based custom security policies, the age of the data blocks in the cache, and/or other factors.

DETAILED DESCRIPTION

Constant Access Gateway

As shown inFIG. 1, Constant Access Gateway (CAG)100enables secure, authenticated and policy-based transmission of data to and from a data store104behind a firewall102. The CAG may be software- and/or hardware-based, and has access to one or more processors and memory operable to implement the capabilities described in this disclosure. CAG100may be placed in the DMZ (de-militarized zone) between firewall102and the Internet108. Alternatively it may be placed anywhere on the Internet where it is reachable via a public IP address.

Connection Process

Mobile or remote devices106are connected to the Internet108. These may include portable digital assistants (PDAs), laptop computers, cellular telephones, tablets, servers at remote sites and other computing devices. The mobile or remote devices are outside firewall102, and hence cannot directly access the data store104without opening incoming ports on the firewall102, which would pose a security risk. Instead, CAG100acts as a broker between mobile devices106and data store104. CAG100has a private interface to data store104, and also has an interface to the Internet108. This setup allows the CAG to create a “virtual connection” between a mobile device and data store104as follows:1. The data store104establishes an outbound connection with CAG100that is initiated from behind the firewall. This connection is called the control channel and is used for message transmission between the CAG100and the data store104. Some or all of the communication between CAG100and data store104is encrypted via an initial secure key exchange.2. CAG100authenticates the data store104connection to validate that the data store104is authorized to connect to CAG100. This authentication may be performed using a pre-assigned token, a certificate, a username/password combination or another authentication mechanism.3. The mobile or remote device initiates a connection to CAG100, requesting a connection to data store104. The mobile device may connect using either a standard internet browser or other software that is specifically configured to enable this connection.4. CAG100authenticates the request to verify the sender's identity, and determines whether the requested connection is authorized. Authentication/authorization is described in more detail below.5. If the connection request is authorized, CAG100first adds the connection request to an internal queue, assigning it a unique identifier. The CAG then forwards a connection request to data store104on the secure control channel, identifying the request using at least the assigned unique identifier.6. Data store104, upon receiving a request on the control channel, first authorizes and authenticates the request based on a variety of factors:a. Is the device requesting a connection authorized to connect over the CAGb. Has the device requesting a connection provided the necessary authentication information, for example: user name/password, device access token or other similar authentication mechanisms.7. Data store104, upon authentication, determines the resources available for the mobile or remote device requesting the connection, publishes only those resources to the device and then initiates an outbound connection request to CAG100, identifying the request with the unique identifier.8. CAG100, upon receiving the outbound connection request from the data store, finds a match in its internal queue of pending connections using the unique identifier. Upon finding the match, CAG100“joins” the connection between the CAG and the mobile device together with the connection between the CAG and the data store. Gateway100then informs mobile device106that a virtual connection to data store104is available.9. Once the virtual connection has been established, CAG100routes all data from the mobile device to data store104, and routes all data from the data store to the mobile device. Thus, the mobile device and the data store can communicate with each other as if they were directly connected via a socket connection.

FIG. 3shows the process by which a virtual connection is established between Mobile Device300and Data Center301. First, the Data Center establishes an outbound connection302to CAG303, using the connection parameters specified as part of the configuration. This establishes a secure Control Channel between Data Center301and CAG303. Then, when Mobile Device300connects to CAG303, the CAG communicates with Data Center301via the secure Control Channel already established. If the user of Mobile Device300is an authorized user and is permitted by the policy settings to be able to connect remotely via the CAG, the connection is accepted. Otherwise, the connection is rejected. If the user of Mobile Device300is an authorized user, Data Center301establishes a dedicated connection304to CAG303for that user, effectively establishing a secure channel between Mobile Device300and Data Center301.

Authentication and Authorization

When a mobile device initiates a connection, Constant Access Gateway100performs authentication and authorization operations. Initially, while the mobile device is connected to the corporate network via a LAN or a VPN, the mobile device is given a secure token. The mobile device includes this secure token when making a connection request to CAG100to “prove” the mobile device's identity.

CAG100validates the token with a token authority to ensure that it is still valid. A variety of token management schemes may be used to determine when secure tokens become invalid. For example, secure tokens may automatically expire after a specified amount of time. A secure token may also be explicitly invalidated by the system for a variety of reasons. Token management may be handled by the CAG100, or by an entity behind the firewall102(e.g. data store104or some other server).

After it has been determined that the token included in the device is valid, CAG100determines whether the mobile device is authorized to access the requested data service.

Configurable Direction of Logical Data Flow

Constant Access Gateway100allows granular configuration of logical data flow between data store104and mobile devices106. For example, global, per-device, and per-user security policies may be configured to allow any of the following modes of data transmission:1. Logical data inflow only: In this option, CAG100does not permit any outbound flow of data from the data store. For example, while CAG100might allow mobile devices106to store data on the data store104, it may not allow them to retrieve data from the data store. This mode may be used to minimize the outflow of sensitive data across the internet, while still allowing data stored locally on mobile devices to be transferred to the data store for backup.2. Logical data outflow only: In this mode, CAG100does not permit any logical inbound flow of data to data store104, but permits retrieval of data for devices connecting via CAG100. This mode may be used to prevent mobile devices from tampering with the data in the data store and is useful for cases like publishing.3. Logical data inflow and outflow: In this mode, CAG100permits both logical inflow and outflow of data to the data store104.

Configurable Access Based on Data Type, User Profile, Location, and Other Factors

CAG100supports limiting access to data (e.g. preventing data access entirely, or imposing limits on logical data flow such as those described above) on a per-user and/or a per-device basis. Data access may be based on one or more of the following properties of the mobile device and its user:1. Device profile2. User profile3. Location of user4. Days since disconnected from the corporate network5. Data store location6. Data type7. Data classification8. Data contentThese properties may comprise configurable parameters, data types and other intrinsic properties of the data to be transmitted, and metadata, environmental and otherwise, which may be used to block or otherwise restrict access across the virtual communication channel between the mobile device and the data store.

This configurability of CAG100provides organizations full control over data access and flow based on a variety of traits of the accessing user, device and the data being accessed.

The systems and methods described here allow access without requiring VPN or LAN access. Providing secure access to corporate data stores behind one or more firewalls without requiring a VPN is a challenge for most organizations. For example, mobile users can have devices containing data that has been created while the users are disconnected from the corporate network. The mobile user copy might be the only copy of the data that has been created, so the data needs to be backed up. However, lack of a consistent VPN connection can results in backups happening infrequently. In another example, end users may want to access their corporate data using their mobile devices even when they are not connected via VPN. Accessing this corporate data—which may be behind a corporate firewall—can be challenging. This issue can lead users to resort to methods for accessing data that might not be approved by the corporation (or other data manager or owner). Such users may synchronize data to public cloud-based solutions to allow them to access their data from anywhere. This approach can be a security concern for corporations, as their confidential data exists on computing assets not owned by the corporation, and may even present concerns about corporate compliance with regulatory requirements.

Providing reliable and high performance access to centrally stored data can also be a problem. Because of network latency issues, companies may resort to storing data in multiple sites. This can cause several issues:1. Cost: maintaining infrastructure in multiple sites can lead to increased costs. The data in remote sites has to be backed up. This can lead to increased storage and administration costs. Part of this cost is due to maintaining data storage facilities in the multiple sites that are capable of mirroring a sufficiently large portion of the central data to provide efficient localized access to that data.2. Security: an additional cost is the cost of ensuring that the data stored in remote sites is secure.3. Complexity: maintaining infrastructure in multiple sites can lead to increased complexity.4. Reduced control: since the data is no longer stored in a central site, this can lead to reduced control.

De-Duplicated Data Cache Server

As shown inFIG. 2, a cache server with de-duplicated data enables secure, efficient, distributed, and disconnected access to corporate data that is stored centrally. Cache Server200contains a de-duplicated repository of data stored in the form of unique objects or blocks of data. Cache Server200also has one or more processors and memory configured to implement the capabilities described herein. Storage and management of the data on Cache Server200may be accomplished, for example, by a system such as that described in US Patent Publication Nos. US-2010-0161608 and US-2010-0161685, both of which are incorporated by reference herein in their entirety.

Cache Server200may, for example, be deployed behind a firewall222to provide efficient access to users in a remote site212in order to back up data stored on the remote site to data store104. Another Cache Server201may be placed behind firewall221to provide read-only access to users within site211to de-duplicated copies of data stored centrally in data store104without introducing the additional network latency that would otherwise be involved in site211accessing that data through the internet. Users at main site210may, of course, access data store104directly through LAN211, including users with mobile devices106who have LAN access directly to data store104. Mobile devices106without direct LAN access to data store104may also access the data store through the Internet108using the Constant Access Gateway100as discussed above. Access to Cache Servers200or201, or to data store104through Gateway100may also be obtained through a web-based self-service recovery system230.

Data store104can include management and reporting systems240, metering and chargeback systems242, a key management system244, and one or more active directory systems246. Key management system244can create and manage tokens for users of Constant Access Gateway100. Storage within data store104may be accomplished using a private cloud254within which one or more servers254provide access to de-duplicated object repositories and associated catalogs252.

One or more servers254are responsible for maintaining a catalog, of de-duplicated objects. Without de-duplication, multiple copies of these objects would be stored in various places throughout the data store. In a de-duplicated data store, each of these objects is stored in the catalog only once and indexed according to a unique identifier. Other locations in the data store may include a reference to a de-duplicated object using that object's unique identifier. Servers254are also responsible for reconstructing and providing access to the original files (which may be reconstructed using the de-duplicated objects), including providing the files to an active directory service246.

The data in the Cache Server200is intelligently built and managed based on the local access needs of users or devices dependent on that instance of the Cache Server. There can be multiple Cache Servers in an overall system. Some of the features of the Cache Server200are:1. Distributed service: A Cache Server can be running on a device that can service requests from just that device or that can service multiple devices, e.g. one or more sites.2. Data retrieval and storage using Cache Server: All data storage and retrieval requests for devices configured to use Cache Server200have the option of to first service their request using the Cache Server instead of the central data store. This enables faster access and storage of data. Cache Server200can work in conjunction with Gateway100by having the Cache Server connect to a data store through the Gateway in the same manner as a mobile device.3. De-duplicated: Data on the Cache Server is stored in a de-duplicated form (i.e., only unique objects or blocks in the data are stored, ensuring significant storage savings).4. Automatic synchronization with central data store: The Cache Server ensures that new data it receives from the devices it is servicing is “synchronized” with the central data store. This synchronization can be synchronous or asynchronous. This synchronization may include the backup of local data to the central data store.5. De-duplicated transfer of data over the WAN: The Cache Server only transmits or receives unique objects or blocks to the devices it is servicing and to the central data store. In other embodiments, the Cache Server may reconstruct files or other data objects from the unique objects or blocks prior to passing the files/objects to the serviced device.6. Intelligent handling of cache miss: The Cache Server keeps a map of various potential sources of objects and blocks along with a measure of the cost of retrieval from those potential sources. In the case of a cache miss, the Cache Server can intelligently retrieve the missing block from the best available source based metrics such as cost or latency.7. Pre-population of objects or blocks: The Cache Server can “pull-down” required blocks to service an anticipated future access by devices it services. Such a pull-down can be manual or automated based on policy settings.8. Deletion of Cache Data: Cache Server200can delete objects or blocks from its cache or restrict access to them based on policies that define acceptable thresholds for multiple factors. These factors include:Age of dataNumber of days since a secure VPN or LAN connection was established with the corporate networkAccess profiles (e.g. if a lot of data is suddenly being accessed in an unusual mannerData type: sensitive data as defined by an organization's document classification properties

It will be appreciated that the scope of the present inventions is not limited to the above-described embodiments, but rather is defined by the appended claims, and that these claims will encompass modifications of and improvements to what has been described. For example, different types of processors and memory may be used to implement the Constant Access Gateway. There are many references to maintaining data in storage; this storage may be any suitable form of memory, such as digital disks, optical disks, or semiconductor memory. The processing acts that are described may be performed using any suitable hardware and/or software logic or combination thereof, and implemented using any suitable processor, such as a general-purpose processor or an application-specific processor. Many of the acts described above may be performed by software stored in computer-readable memory as instructions that, when executed, perform the described steps (e.g., establishing a connection, authentication, authorization, etc.).