AU701007B2 - Device and process for remotely protecting digital data - Google Patents

Abstract

The present invention relates to a device for the remote backup of numerical data organised into files contained in a local mass memory (19) of a computer system (5, 6, 7, 8). It includes a means (11) of reading numerical data in the said mass memory, a means (12) for recognising files modified since the previous backup, a means (15) of enciphering data, a means (31) of compressing enciphered data and a local means (16) of transmitting enciphered and compressed data to an integrated services digital network (1). Where receiving these data, it includes, connected to the said network, a transmitted-data processing means (30) associated with global mass memories (26, 27) preserving the transmitted data and with an automatic numbering means (35), the said data processing means controlling the operation of the automatic numbering means, the operation of the electronic circuit and the operation of the global mass memories (26, 27).

Description

DEVICE AND PROCESS FOR REMOTELY PROTECTING DIGITAL DATA The present invention is related to a device and method for the remote backup of digital information. Information has become an integral part of the services of a company or of a government organization. Besides, this information is increasingly dispersed by the use of numerous computer systems, espacially mini and micro-computers. It has therefore become essential that this information be protected against accidental or deliberate destruction. In addition, some professions have an ethical responsibility to keep information confidential.

Information backup devices known up until now, of the computer diskette type on which the user can copy his computer files, offers very little security against spying because diskettes can generally be used on a variety of computer systems. Also such backup is cumbersome because of the number of diskettes required and is very painstaking for the user. Due to these disadvantages this backup means is rarely properly applied.

Other devices for recording on magnetic tapes, on magnetooptical or optical discs are expensive and do not improve either said security or ease of use. In addition, both these types of backup mean that the information is neither readily available to a travelling user, nor very confidential.

Finally, decentralizing information, which is a requirement for the safety of digital data, becomes very complex to implement.

US patent 5 133 065 describes a computer network used for backing up data from a workstation to a central storage unit and saving said data. The network allows for selecting which files will be backed up from the workstation.

The device that is the object of the present invention intends to overcome these disadvantages by presenting a set of means adapted for all types of computer systems and by guaranteeing perfect security, perfect availability, perfect integrity and perfect confidentiality for computer backups.

It gets integrated into existing computer systems. It comprises two sets of means, one being distributed in as \r~Z9 many copies as there are machines and sites to be protected, and the other being unique or limited to just a few copies.

Thus, the device includes a first electronic assembly enabling the linkage of a computer system to a transmission network and a backup centre including a second electronic and computer assembly, which is itself connected to the transmission network.

The device that is the aim of the present invention is therefore a device for remotely backing up digital data organized in files contained in a local mass storage device of a computer system characterized in that it includes, for each 1 0 site requiring a backup, an electronic circuit connected to said computer system including a means for reading digital data from said local mass storage device, a means for recognizing files modified since the previous backup and adapted to select the files that have been modified since the previous backup, a computer virus detection means adapted to detect computer viruses in said data, a data encrypting means, a means for compressing encrypted data and a local means for transmitting encrypted and compressed data over an integrated services digital network from local means and wherein it includes, connected to said network, a means for processing transmitted data which one means is associated and linked with global mass storage devices where are preserved and stored the transmitted data; data processing means is also associated with an automatic dialling means, said data processing means driving the operation of the automatic dialling means, the operation of the electronic circuit and the :operation of the global mass storage devices.

The method that is the object of the present invention is a method for the remote .0*0 25 backup of digital data organized into files contained in a local mass storage ooC 0* device of a computer system connected to an integrated services digital network, characterized in that it automatically performs a dialling on said network, a reading of digital data from said local mass storage device, a recognition of files modified since the previous backup adapted to select the S 3 0 files that have been modified since the previous backup, a computer virus detection adapted to detect the computer viruses in said data, an encryption of data, a compression of the encrypted data, a transmission of the encrypted and compressed data over an integrated services digital network, a processing of Rthe transmitted data, an archiving of the transmitted data.

-2 The following description, made with reference to the annexed drawings in an explanatory and non-limiting manner, enables a better understanding of the advantages, aims and characteristics of the invention.

Fig. 1 represents a block diagram of the device that is the object of the present invention, inserted in an existing computer system and communication network.

Fig. 2 represents a block diagram of an electronic circuit incorporated into the device represented in Fig. 1.

Fig. 3 represents a block diagram of an information archiving means 1 0 incorporated into the device represented in Fig. 1.

Fig. 4 represents a sequence of functional operations of the device of Fig. 1.

Fig. 1 represents a communication network 1, an archiving means 2, three electronic panels, 3, 9 and 10 comprising three electronic circuits, 4, a micro-computer 5, a local network server 6, two local network terminals 7, a mini-computer 8 and an archiving means 2.

Communication network 1 is of the digital type and intended for the remote transfer of digital information. It preferably has high information thruput, for integration of services, using a semaphore channel signalling 2 0 system of the International Telephone and Telegraphs Consulting Committee (CCITT nx7) type. Archiving means 2 is adapted to receive, S ee (P13114. SOl) process, save and transmit information that have been sent to it by communication network 1. It is presented with respect to Fig. 3. The three electronic panels 3, 9 and are presented with respect to Fig. 2. They-are mechanically protected against any opening and have an opening detection means intended to emit or modify a signal in case they are opened and an opening detection means adapted to memorize the opening signal. They each comprise an electronic circuit 4. Electronic panel 3 is electrically linked, on the one hand, to communication network 1, and on the other hand, to micro-computer 5. Micro-computer 5 is of a known type and is presented in Fig. 2. Electronic panel 9 is electrically linked, on the one hand, to communication network 1, and on the ot#er hand, to local network server 6.

Local network server 6 is of a known type and is linked to two local network terminals 7. In the description, microcomputer 5, local network server 6 linked to the two terminals 7 and micro-computer 8 have commonly been called "computer systems". Digital data are organized into files held in a mass storage device of the computer systems.

Electronic panel 10 is electrically linked, on the one hand, to communication network 1, and on the other hand, to minicomputer 8. Mini-computer 8 is of any type.

Each of the electronic circuits 4 allows the automatic transmission of encrypted data from the mass storage devices of the computer system to which it is linked towards archiving means 2, via communication network 1.

Fig. 2 represents communication network 1, microcomputer 5 comprising a monitor 17 and a key-board 18, a local mass storage device 19, a clock 28 and a central unit electronic panel 3, electronic circuit 4 comprising a data reading means 11, a storage means 21, a means for recognizing data 12 that has been modified since the last -4- (P13114. S01) backup, a means for detecting computer viruses 13, a disinfection means 32, an identification means 14, a data encoding means 15, a data compression means 31, a local network transmission means 16, an attribute modifying means 29 and a summary report emitting means 33.

Monitor 17 is of a known type, especially in personal computers. Key-board 18 is of a known type, especially in office automation. Local mass storage device 19 is adapted to save the programs and the files, for example, texts, tables, graphics, sounds or im'ages. This information is introduced into this memory by central unit 20, originating, either from a data transmission or a digitalizing peripheral, or a diskette reader, tapes or magneto-optical or optical supports, or by using key-board 18. These data are saved with an attribute describingtheir last modification. Clock 28 is of a known type, for example, having a lithium battery. The automatic functioning is described hereinbelow with respect to Fig. 2. Central unit is of a known type and is adapted to undertake the functional sequences described in the computer programs used.

Data-reading means 11 is adapted to read the data transmitted by micro-computer 5 and to transmit them to the storage means 21. Storage means 21 is adapted to save the information that is sent to it by data-reading means 11 andto transmit such information to the means for recognizing modified data 12. This storage means enables the bus of micro-computer 5 to only be used for a very short time, during the backup operations, which requires a relatively long processing and transfer time. The means for recognizing data 12 that has modified since the last backup is adapted to scrutinize the attributes of each file that it reads in storage means 21 and to compare such attributes to (P13114. S01) those corresponding to a modification undertaken since the last transmission of this file over communication network 1 to archiving means 2. Files that have been modified since the last date of data transmission are transmitted by the recognition means 12 to the virus detection means 13. Virus detection means 13 is adapted to detect all computer viruses that could be present in the files transmitted by recognition means 12 and to transmit the infected files to disinfection means 32. Disinfection means 32 is adapted to eliminate computer viruses and their consequences from the infected files. The computer virus detection means 13 and disinfection means 32 are updated regularly by remote loading so as to take into account the latest viruses that have been created.

Access identification means 14 is adapted to identify the computer system, to authenticate its identity and to accept or refuse to backup information, in accordance with the results of these two operations. As an example, identification means 14 verifies a code in the memory of micro-computer 5 and modifies it after each backup. Data encoding means 15 is of a known type and is adapted to encrypt the data transmitted to local transmission means 16 by recognition means 12. It consists of a code as per an algorithm parameterized by the client. Encoding consists of substituting a message or a set of data that one wants to protect by an unintelligible text for which no one knows the algorithm and the encoding parameters. This encoding preferably uses mathematical modifications of codes comprising permutations, substitutions, and/or shifting or factorials of very large numbers.

Data compression means 31 is adapted to reduce the size of the transmitted files without any information loss. It is of the type known by a person of the art.

-6- (P13114. SO1) The local network transmission means 16'is of a known type and adapted to communicate with the communication means of archiving means 2, as has been described in Fig. 3.

The attribute modification means 29 is adapted to modify the attributes of files that have been saved such that these attributes correspond to the latest version of a transmitted file. These attributes are, by the very nature of the functioning of a computer system, modified at each modification of the contents of the file to which they are linked and the latest version of the transmitted information, the information used by the means for recognizing modified information 12, is thus deleted as soon as said file is modified. As per the user's requirements, the attribute modification means 29 can be activated or left inactivated. For example, it may only be activated after a complete backup of the files contained in local mass storage device 19.

The summary emitting means 33 is adapted to create in local mass storage device 19 a file that indicates to the user of micro-computer backup results; virus detection results; disinfection results; list of files backed up; backup start and finish times; deviation of clock 28 from universal time.

In addition, the summary report emitting means 33 is adapted to display this same information on monitor 17.

Fig. 3 represents communication network 1 and an archiving means 2 comprising, at a first site, a global network transmission means 23, a data processing means an enumerating means 35, an automatic triggering means 36, a message emission means 34, and at a second site, a storage -7- (P13 114.S01) means located in a strong room 22, two data buses 24 and and two global mass storage devices 26 and 27.

The information processing means 30 and the global mass storage devices 26 and 27 are at two different locations.

Strong room 22 is of a known type, especially in the banking sector. It is adapted to resist numerous types of aggressive entries and is equipped with a number of alarms and numerous known types of surveillance means. Aside from the installation operations, partialmemory changes or maintenance operations, no operator can enter strong room 22. The global network transmission means 23 is of a known type and preferably identical to local transmission means 16. The two data buses 24 and 25 are connected to global data transmission means Both these buses are parallel and comprise the same peripherals. Both global mass storage devices 26 and 27 are adapted to save the data transmitted by the two buses 24 and 25 respectively. They are of the so-called error correction type. The data processing means is connected to the two buses 24 and 25. It is adapted to compare the file names that are memorized in the global mass storage devices 26 and 27, and, as per the user's requirements, to delete some of the old versions of files that were transmitted during the last backup by recognizing the attributes of such files.

The enumerating means 35 is intended to create an electronic signal that is representative of the network 1 user's number.

The automatic triggering means 36 comprises, on the one hand, a list of numbers of the users of the device, and on the other hand, and for each number, an hourly, daily, monthly and annual backup schedule. It is adapted to emit a signal that is representative of the user's number to enumerating means 35 at the time scheduled by the backup -8- (P13114.SOl) schedule, then to re-emit such signal until an electronic connection with electronic circuit 4 of said user has been obtained.

The message emitting means 34 is adapted, on the one hand, to emit a message that is representative of the quality of the backup obtained to electronic circuit 4, and on the other hand, to emit error messages to the user's destination, if the backup was faulty, for example, if micro-computer 5 did not receive electric supply.

Fig. 4 represents, in columns A, B, C, D the functions undertaken successively and respectively in global mass storage devices 26 and 27, column A, in data processing means 30, column B, in electronic circuit 4, column C and in micro-computer 5, column, D.

Fig. 4 represents a schedule comparison function with respect to universal clock 40, an enumerating control function 41, a function for access to file attributes 42, a function for the creation of a backup table 43, a repatriation function 44, a computer virus detection function 45, a file disinfection function 46, an encoding function 47, a compression function 48, a transmission function 49, a processing functioning 50, an archiving function 51, a receiving signal emission 52, a summary report creation function 53, a summary display function 54 and an attribute modification function 55. The function for comparing the schedule with universal clock 40 is undertaken in data processing means 30. It consists of scrutinizing the universal clock and when such clock indicates a scheduled backup date, it sends the number of the computer system to be backed up towards the automatic enumerating means, then a backup triggering signal is sent to electronic circuit 4. The enumerating control function 41 triggers this enumeration. The access to file attributes -9- (P13114. S01) function 42 is undertaken in electronic circuit 4 as soon as said triggering signal is received. It reads the attributes of all the files present in micro-computer 5. The backup table creation function 43 consists of detecting those file attributes that correspond to a file that was modified since the last backup. For each of these files, a complete copy is undertaken in electronic circuit 4: this is the repatriation function 44. The computer virus detection function 45 is carried out on all repatriated files. As soon as a virus is detected, all the mass storage devices and all the files of the computer system are disinfected, and the computer system is neutralized by the device. The encoding function 47 consists of encoding disinfected files.

The compression function,48 compresses the encoded data.

The transmission function 49 transmits the encoded and compressed data from electronic circuit 4 towards data processing means 30. The processing function 50 is undertaken by data processing means 30 and consists of organizing the archiving of the transmitted data in accordance with user instructions. For example, the transmitted data are partitioned, i.e. divided as per the user relationships. The archiving function 51 consists of the final storage of the processed data. It can be undertaken by means of a robot or a magnetic cartridge management system, for example, or by a mechanical multidisk system, better known by its English name "juke-box".

The receiving signal 52 is emitted as soon as the archiving is complete and the signal is transmitted by the processing means to electronic circuit 4. The summary creation function 53 consists of building a data table described hereinabove, such data being representative of the backup undertaken. The summary display function 54 is done by electronic circuit 4 and consists, for example on the one (P13114.S01) hand, of creating a file in the local mass storage device 19, and on the other hand, of displaying such data table on a printer or monitor 17. Finally, as per the user's requirements, the attribute modification function 55 is undertaken by electronic circuit 4 and modifies the attributes of the files that were backed up, the new attributes representing non-modified information since the last backup.

It should be noted that panel 3 is auto-protected, and can be portable and used for travelling purposes. Its autoprotection comprises at least an opening detecting means, and a means for memorizing such opening such that at the first backup following said opening, the opening information is sent to archiving meaps 2. It should also be noted that micro-computer 5 can be constituted by a touch screen panel comprising a software that recognizes handwritten characters.

It must also be noted that electronic circuit 4 and the computer system to which it is linked are supplied electrically by a secured supply source, i.e. having its own autonomy, independent of the variations of the electrical network. For example, they are supplied via a current invertor. In addition, all the backup operations are entirely automated and preferably carried out at night for reasons of transmission unavailability and costs.

According to a first variation, as soon as the computer virus detection means 13 detects the presence of a virus in a file, the device ensures that the disinfection means disinfects all the files present in the computer system to which it is connected.

According to a second variation of the device and method that are the objects of the present invention, electronic circuit 4 is adapted to reset clock 28 of the -11computer system to which it is linked, at the end of each backup of the computer data.

It is to be understood that throughout the specification reference to a mass storage device is intended to include reference to bulk memory.

a e1 4: -12-

Claims (7)

1. Device for remotely backing up digital data organized in files contained in a local mass storage device (19) of a computer system (5,6,7,8) characterized in that it includes, for each site requiring a backup, an electronic circuit connected to said computer system including a means for reading digital data (11) from said local mass storage device, a means for recognizing files modified (12) since the previous backup and adapted to select the files that have been modified since the previous backup, a computer virus detection means (13) adapted to detect computer viruses in said data, a data 1 0 encrypting means a means for compressing encrypted data (31) and a local means (16) for transmitting encrypted and compressed data over an integrated services digital network from local means (16) and wherein it includes, connected to said network, a means for processing transmitted data which one means (30) is associated and linked with global mass storage 1 5 devices (26,27) where are preserved and stored the transmitted data; data processing means is also associated with an automatic dialling means said data processing means driving the operation of the automatic dialling means, the operation of the electronic circuit and the operation of the global mass storage devices (26,27).

2. Device according to claim 1, characterized in that it further includes in the electronic circuit, a means for identifying the computer system, adapted to verify that the computer system to which the electronic circuit is connected is °identical to that used during the previous backup.

3. Device according to any one of claims 1 or 2, characterized in that 2 5 the data processing means (30) is adapted to automatically activate the operation of the automatic dialling means, the operation of the electronic circuit and the operation of the global mass storage devices (26,27) according :to a backup schedule. o• Device according to any one of the preceding claims, characterized S 3 0 in that the electronic circuit further includes, a means for decontaminating (32) the files to be backed up. -13- Device according to any one of the preceding claims, characterized in that the electronic circuit is incorporated into a housing (3,9,10) further including, a means for detecting whether it has been opened.

6. Device according to any one of the preceding claims, characterized in that the data processing means (30) and the global mass storage devices (26,27) are in two different locations.

7. Device according to any one of the preceding claims, characterized in that the electronic circuit further includes, a storage means (21) adapted to preserve all the data to be backed up. 1 0 8. Method for the remote backup of digital data organized into files contained in a local mass storage device of a computer system connected to an integrated services digital network, characterized in that it automatically performs a dialling on said network, a reading of digital data from said local mass storage device, a recognition of files modified since the previous backup adapted to select the files that have been modified since the previous backup, a computer virus detection adapted to detect the computer viruses in said data, an encryption of data, a compression of the encrypted data, a transmission of the encrypted and compressed data over an integrated services digital network, a processing of the transmitted data, an archiving of the transmitted data.

9. Method according to claim 8 characterized in that it further performs the partitioning of data before its archiving. Method according to either claims 8 or 9 characterized in that it 2 performs an installation in the local mass storage device of the computer 25 system of a file including data representative of the progress of said method. •11. A remote backup device for digital data substantially as hereinbefore S.described and with reference to the drawings. -14-

12. A remote method for backing up digital data substantially as hereinbefore described and with reference to the drawings. Datedthis 17th day of June 1998 CHRISTIAN FERRAND and GERARD ROUZE By their Patent Attorneys, COLLISON CO. *r