Backup Retention Lock Certification for Tamper-Proof Audits
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing backup systems lack a secure method to maintain and audit the retention lock status of files, making them vulnerable to malicious corruption and alteration, which is crucial for compliance with regulatory standards like SEC 17a-4(f).
Innovation Solution
Implement cryptographic methods to certify retention lock status by encrypting the lock status using a private key, generating a token that is signed by the storage target, and storing it in the backup software catalog, allowing for secure audit verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If retention lock status is stored in plain text in the backup catalog, then audit verification is simple and direct, but the catalog becomes vulnerable to malicious corruption and alteration
Solution Approach 1:
The patent applies preliminary action by encrypting the retention lock status with the storage target's private key before storing it in the backup catalog. This pre-encryption ensures that when the status is later retrieved for audit purposes, its integrity can be verified without requiring complex real-time verification mechanisms. The encryption is performed in advance, making the catalog inherently more secure and trustworthy.
2Reliability
If cryptographic certification is implemented for retention lock status, then audit reliability is improved, but the complexity of the backup system increases
Solution Approach 1:
The patent uses the encrypted retention lock status as an intermediary that bridges the storage target and the audit process. The encrypted status, signed with the storage target's private key, serves as a trusted mediator that proves the retention state without requiring direct complex verification between the auditor and the storage system. This intermediary approach simplifies the audit process while maintaining high reliability.
3Object-affected harmful factors
If the backup catalog stores encrypted retention lock status signed by the storage target, then protection against malicious corruption is enhanced, but storage and processing overhead increases
Solution Approach 1:
The patent changes the parameter of the retention lock status from plain text to encrypted form using the storage target's private key. This parameter transformation significantly enhances protection against malicious corruption while the actual increase in data size is minimal - only the cryptographic signature overhead, which is negligible compared to the protection gained. The encrypted status maintains the same fundamental structure as the original status but adds cryptographic security.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
Ensures the integrity of retention lock status by preventing tampering and enabling reliable audit of file retention, ensuring compliance with regulatory requirements.
Implementation Method 1
encrypting the lock status in the storage target to sign the retention lock status by an entity storing the backup file
Data Source
AI summary
The retention lock status for a backup file stored in a storage target of a deduplication backup is certified by obtaining the retention lock status and encrypting, in the storage target, the retention lock status information using an encryption key process to create a certified retention lock status. This signs retention lock status by the entity storing the backup file, rather than an application setting the retention lock. The certified retention lock status is provided as a token to a backup software of the deduplication backup system, wherein the retention lock status information is made available for inspection and audit. It is then returned, in response to an audit request, for comparison against a cleartext representation of changes to retention lock status.