Encrypted Cross-Zone Replication for Block Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based block storage devices are vulnerable to wide-scale failures such as natural disasters due to lack of off-site replication, which can result in data loss and service interruptions, as traditional off-site backups are not immediately usable and may take hours or days to restore.
Innovation Solution
Implementing cross-zone replication across isolated availability zones, where data is synchronously replicated across multiple zones, allowing each volume to be independently functional and up-to-date, reducing the risk of data loss and performance impact.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional off-site backups are implemented, then data protection against wide-scale failures is improved, but restoration time increases significantly (hours or days)
Solution Approach 1:
The patent implements preliminary action by pre-replicating data synchronously to secondary volumes in different availability zones before failures occur. This ensures that restored data is immediately available without requiring time-consuming restoration processes, directly resolving the contradiction between data protection and restoration time.
Solution Approach 2:
The patent creates exact copies of primary volumes in secondary availability zones through synchronous replication. These copies are maintained in real-time and can immediately assume the primary role upon failure, eliminating the hours or days required by traditional backup restoration while ensuring data protection.
2Reliability
If synchronous replication across multiple zones is implemented, then data availability and resilience are improved, but system complexity increases
Solution Approach 1:
The patent segments the storage system into independent primary and secondary volumes located in different availability zones. Each volume operates independently with its own encryption keys and management, reducing overall system complexity while improving data availability through distributed architecture.
Solution Approach 2:
The patent introduces a volume replication service as an intermediary that manages the complex synchronous replication process between primary and secondary volumes. This mediator handles encryption, key management, and data synchronization, simplifying the overall system architecture while maintaining high data availability.
3Object-affected harmful factors
If each volume is encrypted with a different key for security, then security is improved, but data synchronization becomes more complex
Solution Approach 1:
The volume replication service acts as an intermediary that manages encryption key differences between primary and secondary volumes. It performs re-encryption of replicated data using the secondary volume's unique key, maintaining security while automating the synchronization process and reducing manual complexity.
Solution Approach 2:
The patent changes the encryption key parameter for secondary volumes while maintaining the same security level. Each volume has its own unique encryption key, and the replication service automatically adapts to these parameter differences through re-encryption, ensuring both security and simplified synchronization.
Data Source
AI summary
The present disclosure generally relates to creating virtualized block storage devices whose data is replicated across isolated computing systems to lower risk of data loss even in wide-scale events, such as natural disasters. The virtualized device can include at least two volumes, each of which is implemented in a distinct computing system. Each volume can be encrypted with a distinct key, and an encryption service can operate to transform data “in-flight” on the replication path between the volumes, reencrypting data according to the key appropriate for each volume.