Application Backup Key Isolation Using Passphrase-Derived Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional backup and disaster recovery solutions for cloud-native environments, such as Kubernetes, face scalability issues and data loss due to lack of visibility into application composition and dynamic nature of microservices, necessitating per-application backup repositories and enhanced security through unique encryption keys.
Innovation Solution
Implementing a system with per-application backup repositories and a multi-layered encryption approach using randomly generated primary keys, customer passphrases, and derived keys for each instance of an application, ensuring data integrity and security during backup and migration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional backup solutions are used in cloud-native environments, then existing infrastructure can be leveraged, but scalability issues and data loss occur due to lack of visibility into application composition
Solution Approach 1:
The patent divides the backup system into per-application backup repositories, where each application has its own dedicated backup storage and encryption keys. This segmentation provides visibility into application composition and isolates backup operations, enabling reliable data protection without overwhelming system complexity.
Solution Approach 2:
The patent introduces a backup management component that acts as an intermediary between the cloud-native application layer and the backup storage infrastructure. This intermediary manages encryption keys, monitors application composition, and coordinates backup operations, simplifying the overall system while enhancing reliability.
2Reliability
If per-application backup repositories are implemented, then data integrity and security are enhanced, but system complexity increases
Solution Approach 1:
The patent implements automated encryption key generation and management where each per-application backup repository automatically generates and manages its own encryption keys. This self-service approach ensures data integrity through unique encryption per application while reducing the operational complexity of manual key management.
Solution Approach 2:
The patent changes the encryption parameter from a single centralized key to multiple application-specific keys, each with unique cryptographic properties. This parameter change enhances data integrity by ensuring that compromise of one application's backup does not affect others, while the automated key management system handles the complexity.
3Reliability
If traditional backup solutions are used, then infrastructure costs are reduced, but data loss occurs due to inability to handle dynamic microservices
Solution Approach 1:
The patent implements dynamic backup repositories that automatically adapt to the lifecycle of cloud-native applications. When applications are deployed, scaled, or terminated in the cloud-native environment, the backup system dynamically creates, adjusts, or removes corresponding backup repositories, ensuring reliable data protection for dynamic microservices.
Solution Approach 2:
The patent creates a universal backup framework that works across diverse cloud-native application types and orchestration platforms. The per-application backup repository model provides a unified approach that adapts to different application compositions and dynamics, enhancing both reliability and adaptability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed herein are system, method, and computer program product embodiments for encryption key management. An embodiment operates by executing an initial non-backup instance of an application and generates a primary key using a cryptographic algorithm. The embodiment requests a customer to create a passphrase configured to encrypt and decrypt the primary key. The embodiment generates a derived key using a cryptographic algorithm and the customer passphrase as input. The embodiment then encrypts the primary key using the generated derived key and stores the encrypted primary key in a catalog.