Systems and methods for securing data of volume mirrors
AssigneeSymantec Corporation
InventorRoshni Jaywantsingh Patil
Life of this patent
Estimating the term…
Abstract
Various computer-implemented methods for securing data of replicated volumes are disclosed. In one example, an exemplary method for performing such a task may include: 1) identifying a set of plexes of a replicated volume, 2) identifying, within the set of plexes, at least one non-trusted plex, 3) intercepting data to be replicated to the non-trusted plex, 4) encrypting the data to be replicated to the non-trusted plex, and then 5) writing the encrypted data to the non-trusted plex. Various other methods, systems, and computer-readable media are also disclosed.
Claims19
A computer-implemented method for securing data of volume mirrors, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
- identifying a set of plexes of a replicated volume;
- identifying, within the set of plexes, at least one non-trusted plex;
- intercepting data to be replicated to the non-trusted plex, the data to be replicated to the non-trusted plex originating from an attempt by an application to write the data to the replicated volume;
- simulating, before encrypting the data to be replicated to the non-trusted plex, successful synchronous replication of the data to the non-trusted plex so that the application is not slowed by encrypting the data to be replicated to the non-trusted plex during the attempt by the application to write the data to the replicated volume;
- encrypting the data to be replicated to the non-trusted plex;
- asynchronously replicating the encrypted data to the non-trusted plex;
- wherein the computer-implemented method avoids the performance of unnecessary decryption operations by:
- refraining from encrypting data to be replicated to trusted plexes;
- preferring to fulfill read requests for the replicated volume through trusted plexes instead of non-trusted plexes.
A system for securing data of replicated volumes, the system comprising:
- an identification module programmed to:
- identify a set of plexes of a replicated volume;
- identify, within the set of plexes, at least one non-trusted plex;
- an interception module programmed to intercept data to be replicated to the non-trusted plex, the data to be replicated to the non-trusted plex originating from an attempt by an application to write the data to the replicated volume;
- an encryption module programmed to encrypt the data to be replicated to the non-trusted plex;
- a writing module programmed to:
- simulate, before encrypting the data to be replicated to the non-trusted plex, successful synchronous replication of the data to the non-trusted plex so that the application is not slowed by encrypting the data to be replicated to the non-trusted plex during the attempt by the application to write the data to the replicated volume;
- asynchronously replicate the encrypted data to the non-trusted plex;
- wherein the system avoids the performance of unnecessary decryption operations due to:
- the encryption module being programmed to refrain from encrypting data to be replicated to trusted plexes;
- a request module programmed to prefer fulfilling read requests for the replicated volume through trusted plexes instead of non-trusted plexes;
- at least one processor configured to execute the identification module, the interception module, the encryption module, the writing module, and the request module.
A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
- identify a set of plexes of a replicated volume;
- identify, within the set of plexes, at least one non-trusted plex;
- intercept data to be replicated to the non-trusted plex, the data to be replicated to the non-trusted plex originating from an attempt by an application to write the data to the replicated volume;
- simulate, before encrypting the data to be replicated to the non-trusted plex, successful synchronous replication of the data to the non-trusted plex so that the application is not slowed by encrypting the data to be replicated to the non-trusted plex during the attempt by the application to write the data to the replicated volume;
- encrypt the data to be replicated to the non-trusted plex;
- asynchronously replicate the encrypted data to the non-trusted plex;
- wherein the computer-executable instructions cause the computing device to avoid the performance of unnecessary decryption operations by:
- refraining from encrypting data to be replicated to trusted plexes;
- preferring to fulfill read requests for the replicated volume through trusted plexes instead of non-trusted plexes.
Dependencies are inferred from the claim text.