Encrypted Image Backup Consolidation Without Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current image backup solutions face challenges in consolidating encrypted backups without decrypting the data, as this requires access to encryption keys, posing security risks and leading to storage space inefficiencies due to the proliferation of image backups.
Innovation Solution
Individual blocks in a source storage are encrypted using a single encryption key, allowing for consolidation of encrypted image backups without decrypting any blocks, enabling third-party consolidation without access to the encryption key and reducing storage needs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Volume of stationary object
If image backups are consolidated without decryption, then storage space efficiency is improved, but this requires a new encryption methodology that prevents third-party access to decryption keys
Solution Approach 1:
The encryption key is segmented into two parts: a master encryption key stored with the backup data, and a separate consolidation key stored with the consolidation metadata. This segmentation allows the backup data to remain encrypted and secure while enabling consolidation through the metadata without exposing the master key to third parties.
Solution Approach 2:
Consolidation metadata acts as an intermediary between the encrypted backup data and the consolidation process. This metadata contains information about which blocks need to be consolidated and their corresponding encryption keys, allowing consolidation to occur without decrypting the actual backup data or exposing the master encryption key.
2Adaptability or versatility
If encryption keys are made accessible to third parties for consolidation, then consolidation capability is improved, but security vulnerabilities increase due to unauthorized access risk
Solution Approach 1:
Consolidation metadata serves as an intermediary that enables consolidation capability without requiring third-party access to the master encryption key. The metadata contains the necessary information to perform consolidation while the actual encryption keys remain protected with the backup data.
Solution Approach 2:
The key access rights are segmented: the master encryption key is accessible only to the backup data owner for decryption, while the consolidation key is accessible to third parties for consolidation operations. This segmentation allows consolidation capability without compromising security.
3Reliability
If all allocated blocks are backed up in image backup, then backup completeness is improved, but storage space consumption increases due to redundancy
Solution Approach 1:
Multiple image backups are merged into a single consolidated backup by identifying and consolidating duplicate blocks across the backups. The consolidation metadata tracks which blocks are duplicates and consolidates them, reducing storage space while maintaining the ability to restore any point in time.
Solution Approach 2:
Instead of storing complete copies of all allocated blocks in every image backup, the system creates consolidated backups that share common blocks across multiple time points. This reduces redundancy while maintaining backup completeness through the consolidation metadata that tracks block histories.
Data Source
AI summary
Consolidating encrypted image backups without decryption. In one example embodiment, a method for consolidating encrypted image backups without decryption may include individually encrypting, using a single encryption key, each block in a first set of blocks in a source storage, storing the first set of encrypted blocks in a first encrypted image backup, individually encrypting, using the single encryption key, each block in a second set of blocks in the source storage, storing the second set of encrypted blocks in a second encrypted image backup, and creating a consolidated encrypted image backup that includes a single encrypted block for each of multiple unique block positions represented by the first and second sets of encrypted blocks without decrypting any of the encrypted blocks.