In-Memory Database Page Backup Recovery Under Group Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data encryption methods in cloud-based, multi-tenant applications struggle with efficient and reliable backup and recovery of data pages, especially when group-level encryption is employed, as it complicates decryption during recovery processes without requiring application redesign.
Innovation Solution
A method is introduced that involves retrieving page metadata for data pages, storing it with the page header, and using this metadata to rebuild a converter that maps logical page numbers to physical block numbers, allowing for decryption and recovery of data pages without re-encrypting the page headers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data-volume-level encryption is used to protect persisted data, then security against physical access is improved, but group-level data privacy for multi-tenant applications deteriorates
Solution Approach 1:
The patent segments the encryption approach from data-volume-level to page-level encryption. Each data page is encrypted individually with encryption keys that can be assigned at the tenant group level, allowing separate encryption control for different customer groups while maintaining physical security of the persisted data.
2Adaptability or versatility
If group-level encryption is implemented for multi-tenant data privacy, then data privacy control is improved, but backup and recovery complexity increases
Solution Approach 1:
The patent performs preliminary action by storing encryption key information and metadata alongside each encrypted data page during the initial encryption and backup process. This pre-stored information enables straightforward decryption and recovery operations later without requiring complex key management or re-encryption procedures.
Solution Approach 2:
The patent introduces an intermediary decryption mechanism that uses stored encryption key information to bridge the encrypted data pages and the original plaintext during recovery. This intermediary approach simplifies the recovery process by eliminating the need for complex re-encryption or key derivation operations.
3Reliability
If all data pages are entirely encrypted for security, then security is improved, but decryption during recovery becomes difficult
Solution Approach 1:
The patent extracts the encryption key information and metadata from the encrypted data pages and stores them separately alongside each page. This extraction allows the main data pages to remain fully encrypted for security while the separated key information enables straightforward decryption during recovery operations without compromising security.
Data Source
AI summary
Computer-readable media, methods, and systems are disclosed for processing backup and recovery of pages in an in-memory database system employing tenant-based, group-level encryption for a plurality of tenants. Page metadata for a page may be collected. The page may comprise a header and a set of page contents. The page metadata may be stored with the page header. When a backup request is received, the page may be loaded into a backup stream. The page may be loaded with the header unencrypted and the page contents encrypted. When a recovery request is received, the data page may be retrieved from the backup stream. A converter may be rebuilt using the page metadata. The data page may then be written to the main memory of the database system. The page contents may be decrypted by the converter.