Remote Replication Appliance for Encrypted VM Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data protection systems face challenges in maintaining continuous data protection, as they struggle to keep pace with high data transaction rates at production sites without slowing down the production site, leading to potential shutdowns due to backlog of un-logged transactions at backup sites.
Innovation Solution
The method involves intercepting communication between a virtual machine and encrypted replication data, redirecting it to a remote replication appliance, and using a key stored on the appliance to enable the virtual machine to interact with the data as unencrypted, allowing dynamic adaptation to changing transaction rates and facilitating recovery without requiring keys to be present at the backup site throughout the replication process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If continuous data protection uses journaling to enable rollback to any point in time, then recovery capability is improved, but the backup site cannot keep pace with high data transaction rates at the production site, causing backlog and potential shutdown
Solution Approach 1:
The patent introduces a replication appliance as an intermediary component between the production storage system and the backup storage system. This appliance handles the journaling and data replication processes, allowing the backup site to receive and process data transactions asynchronously without forcing the production site to slow down. The intermediary absorbs the overhead of continuous journaling while maintaining high transaction rates at the production site.
Solution Approach 2:
The system dynamically adjusts replication methods based on data transaction rates and storage conditions. It can switch between different replication modes (full replication, incremental replication, or direct write) depending on the current workload and backup site capacity, enabling the system to adapt to changing transaction rates without causing production site shutdowns.
2Loss of time
If keys are stored at the backup site for encrypted virtual machine recovery, then recovery speed is improved, but security is compromised since keys must remain accessible throughout the replication process
Solution Approach 1:
The system performs preliminary encryption of data at the production site before replication occurs. Encryption keys are established and stored securely at the production site, and data is encrypted using these keys before being sent to the backup site. This preliminary action ensures that data remains encrypted during replication, eliminating the need to store decryption keys at the backup site while still enabling fast recovery when needed.
Solution Approach 2:
The patent uses a splitter component that creates a copy of the data access path. Instead of storing decryption keys at the backup site, the system copies the encrypted data to the backup site and maintains a separate access mechanism where the virtual machine can read its own encrypted data using keys stored at the production site. This copying approach preserves security while enabling recovery.
3Reliability
If the backup site processes every data transaction for continuous protection, then recovery to any point in time is enabled, but the overhead of journaling slows down the production site
Solution Approach 1:
The replication appliance serves as an intermediary that handles the journaling overhead. It receives data transactions from the production storage system, processes them through journaling mechanisms, and forwards them to the backup storage system. This intermediary absorbs the performance penalty of continuous journaling, allowing the production site to maintain high transaction speeds while still achieving continuous protection.
Solution Approach 2:
The system implements partial replication strategies where not all data transactions need to be fully processed and logged at the backup site in real-time. The replication appliance can selectively replicate data based on change detection mechanisms, replicating only modified blocks or pages rather than every individual transaction, thereby reducing the overhead impact on production while maintaining sufficient protection for recovery.
Data Source
AI summary
A method, system, and computer program product for intercepting communication between a virtual machine and an encrypted replication data stored on a storage medium and redirecting the communication to a remote replication appliance and using a key stored on the remote replication appliance to enable the virtual machine to facilitate communication with the encrypted replication data stored on the storage medium, wherein facilitating communication enables the virtual machine to interact with the encrypted replication data as unencrypted data.