Cross-Region Database Restoration via Forward Access Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributed database systems face challenges in securely restoring data across regions due to insulation of regional systems, which restricts service calls from outside regions, making cross-region data restoration complex and insecure.
Innovation Solution
A system and method for cross-region database restoration that uses a forward access session token to authorize service calls, enabling the retrieval of backups from one region to another by generating and using a credential that bypasses initial access restrictions, allowing secure data transfer and restoration across regions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If regional systems are insulated to maintain security, then security is improved, but cross-region data restoration becomes difficult
Solution Approach 1:
The patent introduces a credential as an intermediary that mediates between the source region and destination region. The credential is generated by the source region's backup restore manager service and used by the destination region's backup restore manager service to access backup data, enabling secure cross-region restoration without direct exposure between regions.
Solution Approach 2:
The system segments the cross-region restoration process into distinct phases: credential generation in the source region, credential validation at the destination region, and controlled data access. This segmentation allows each region to maintain its security boundaries while enabling coordinated restoration operations.
2Reliability
If service calls are restricted from outside regions, then security is improved, but backup restoration functionality deteriorates
Solution Approach 1:
The system dynamically adjusts access control based on the presence of valid credentials. During normal operations, regional systems maintain restricted access. During restoration operations, the system dynamically permits service calls from outside regions when properly authenticated with a credential, and then returns to restricted mode afterward.
Solution Approach 2:
The access control parameters change based on credential validation. The system transitions from a state where service calls are blocked to a state where service calls are permitted, based on the validation of the credential parameter. This allows the system to adapt its security posture to the specific operational context.
Data Source
AI summary
A system for database restoration across service regions. The system includes data storage and backup data storage in the first region. The system includes a frontend for the database service configured to receive, from a client, a request to restore a database to the first region from backups stored in another backup data storage in a second region and to receive an authentication token for the request from the client. The system also includes a backup restore manager service for the first region configured to send, to another backup restore manager service implemented in the second region, a credential request for a second region credential authorizing retrieval of the one or more other backups from the second region. The backup restore manager service sends a backup restore request to retrieve the backups from the other backup data storage and loads the backups to restore the database in the first region.