Secure database backup and recovery

Patent metadata

Field	Value
Publication number	US-9916460-B2
Application number	US-201615338486-A
Country	US
Kind code	B2
Filing date	Oct 31, 2016
Priority date	Nov 6, 2014
Publication date	Mar 13, 2018
Grant date	Mar 13, 2018

Abstract

As disclosed herein a computer system for secure database backup and recovery in a secure database network has N distributed data nodes. The computer system includes program instructions that include instructions to receive a database backup file, fragment the file using a fragment engine, and associate each fragment with one node, where the fragment is not stored on the associated node. The program instructions further include instructions to encrypt each fragment using a first encryption key, and store, randomly, encrypted fragments on the distributed data nodes. The program instructions further include instructions to retrieve the encrypted fragments, decrypt the encrypted fragments using the first encryption key, re-encrypt the decrypted fragments using a different encryption key, and store, randomly, the re-encrypted fragments on the distributed data nodes. A computer program product and method corresponding to the above computer system are also disclosed herein.

First claim

What is claimed is:

1. A system for secure database backup and recovery in a secure database network having N distributed data nodes, wherein N is an integer greater than 2, the system comprising:
a processor;
a database system backup file;
a fragment engine for fragmenting, by the processor, the file into 3 or more fragments;
a coordination engine for associating, by the processor, each fragment with a data node such that the data node will not be used to store the fragment;
one or more database agents for communicating, by the processor, the fragments to the data nodes for storage and for retrieving, by the processor, the fragments a determined time later from the data nodes wherein no fragment is stored on its associated distinct data node; and
an encryption engine for encrypting fragments, by the processor and using a first key, before storing and decrypting the fragments, by the processor, on retrieval using the first key wherein the fragments are further encrypted with a different key before storing again on said data nodes and wherein fragments are not stored on their associated data node but only on data nodes that are not associated with them;
wherein after retrieving each fragment from a respective data node, said fragment is stored again on a different data node from the data node it was retrieved from, and
wherein determining fragment data node location is performed by a sensor in the data node:
that monitors communications traffic between data nodes and that listens for communications requests and sends back responses including stored fragments.

2. The system of claim 1 wherein storing and retrieval of fragments is performed by agents in the database system and sensors in the data nodes and wherein fragment node location is not stored in the database system.

3. The system of claim 2 further comprising a key generator and store for fragmenting the key,
encrypting each key fragment, and
storing each encrypted key fragment with a backup fragment.

4. The system of claim 3 wherein database metadata is added to the fragment and wherein database metadata is fragmented and distributed.

5. The system of claim 4 wherein such database metadata includes, but is not limited to, network configuration, database node locations and backup image expiration.

6. The system of claim 5 wherein the encryption is public and private key encryption.

Assignees

• IBM

Inventors

• Barbas Pedro M
• Duffy Joseph
• Maycock Ken
• Tilson David M

Classifications

• H04N21/2318

  using striping · CPC title

• G06F2221/2107

  File encryption · CPC title

• G06F2201/80

  Database-specific techniques · CPC title

• G06F3/067

  Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS] · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title