Client-Side Encryption in Deduplication Backup Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deduplication backup systems face challenges in reducing redundancy and maintaining data security, as encrypted blocks from different clients may differ despite being identical in plain text form, leading to increased storage size and bandwidth overhead.
Innovation Solution
Implementing client-side encryption using cryptographic hash functions to encrypt blocks before transmission to a deduplication vault, ensuring only a single encrypted block is stored for each unique plain-text block across multiple clients, thus reducing redundancy and maintaining data security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If client-side encryption is implemented using unique encryption passwords for each client, then data security is improved, but storage size and bandwidth overhead increase due to redundant encrypted blocks
Solution Approach 1:
The patent segments the encryption process into two distinct phases: first, a common encryption is applied to all blocks using a shared key, creating a base encrypted layer; second, client-specific encryption is applied only to the encryption password (not the entire block), adding a client-specific layer. This segmentation allows deduplication to occur at the block level while maintaining client-specific security, reducing storage size compared to full client-specific encryption of all blocks.
Solution Approach 2:
The patent merges two encryption approaches (common encryption and client-specific encryption) into a hybrid model. The common encryption component allows for deduplication across clients, while the client-specific encryption password component maintains individual client security. This merging enables the system to achieve both security and storage efficiency simultaneously.
2Reliability
If client-side encryption is implemented using unique encryption passwords for each client, then data security is improved, but bandwidth overhead increases due to redundant encrypted blocks
Solution Approach 1:
The patent segments the encryption process into two distinct phases: first, a common encryption is applied to all blocks using a shared key, creating a base encrypted layer; second, client-specific encryption is applied only to the encryption password (not the entire block), adding a client-specific layer. This segmentation allows deduplication to occur at the block level while maintaining client-specific security, reducing storage size compared to full client-specific encryption of all blocks.
Solution Approach 2:
The patent merges two encryption approaches (common encryption and client-specific encryption) into a hybrid model. The common encryption component allows for deduplication across clients, while the client-specific encryption password component maintains individual client security. This merging enables the system to achieve both security and storage efficiency simultaneously.
3Productivity
If standard deduplication vault is used to store unencrypted blocks, then deduplication efficiency is improved, but security is compromised as blocks are accessible in unencrypted form
Solution Approach 1:
The patent applies preliminary encryption to all blocks using a common key before they are stored in the deduplication vault. This preliminary action ensures that blocks are encrypted before being made accessible for deduplication operations, maintaining security while allowing the vault to efficiently deduplicate blocks based on their encrypted forms. The common encryption layer enables the vault to recognize identical blocks across different clients.
4Reliability
If encrypted deduplication vault is used where each block is encrypted by the source system, then security is improved, but deduplication capability is lost across different clients
Solution Approach 1:
The patent merges two encryption approaches (common encryption and client-specific encryption) into a hybrid model. The common encryption component allows for deduplication across clients, while the client-specific encryption password component maintains individual client security. This merging enables the system to achieve both security and storage efficiency simultaneously.
Solution Approach 2:
The patent segments the encryption process into two distinct phases: first, a common encryption is applied to all blocks using a shared key, creating a base encrypted layer; second, client-specific encryption is applied only to the encryption password (not the entire block), adding a client-specific layer. This segmentation allows deduplication to occur at the block level while maintaining client-specific security, reducing storage size compared to full client-specific encryption of all blocks.
Data Source
AI summary
Client-side encryption in a deduplication backup system. In one example embodiment, a method includes a backup phase in which various steps are performed for each allocated plain text block stored in a source storage. One step includes hashing, using a first cryptographic hash function, the plain text block to generate a first hash. Another step includes hashing, using a second cryptographic hash function, the first hash to generate a second hash. Another step includes searching a key-value table of a deduplication storage to determine whether the second hash matches any key in the key-value table. Another step includes, upon determining that the second hash does not match any key in the key-value table, encrypting, using an encrypt/decrypt function, the plain text block using the first hash as an encryption password and inserting a key-value pair into the key-value table with the key being the second hash and the value being the encrypted block.