Client-side encryption in a deduplication backup system

1. A method for client-side encryption in a deduplication backup system, the method comprising:

a backup phase in which the following steps are performed for each allocated plain text block stored in a client-side source storage at a point in time:

hashing, using a first cryptographic hash function, the plain text block to generate a first hash;

hashing, using a second cryptographic hash function, the first hash to generate a second hash;

searching a key-value table of a deduplication storage to determine whether the second hash matches any key in the key-value table, each key-value pair in the key-value table including a key that is a hash and a value that is an encrypted block;

upon determining that the second hash does not match any key in the key-value table, encrypting, using an encrypt/decrypt function, the plain text block using the first hash as an encryption password and inserting a key-value pair into the key-value table with the key being the second hash and the value being the encrypted block; and

inserting an entry into an image map corresponding to the client-side source storage that includes the first hash and a position of the plain text block as stored in the client-side source storage to be subsequently used in a restore phase to restore the plain text block to the position, the entry in the image map not including the second hash, the image map being stored in a separate location from the key-value table; and

encrypting the image map; and

a restore phase in which each block that was stored in the client-side source storage at the point in time is restored from the deduplication storage to a restore storage, thereby recreating the state of the client-side source storage at the point in time on the restore storage.

2. The method as recited in claim 1 , further comprising storing the encrypted image map in the deduplication storage.

3. The method as recited in claim 1 , wherein the image map is stored in the client-side source storage.

4. The method as recited in claim 1 , wherein the restore phase includes performing the following steps for each entry in the image map:

hashing, using the second cryptographic hash function, the first hash included in the entry to generate the second hash;

searching the key-value table to retrieve the encrypted block of the key-value pair having a key that matches the second hash;

decrypting, using the encrypt/decrypt function, the encrypted block using the first hash as a decryption password; and

storing the decrypted block in the restore storage at the position included in the entry.

5. The method as recited in claim 4 , further comprising decrypting the image map prior to the restore phase.

6. The method as recited in claim 1 , wherein each of the first cryptographic hash function and the second cryptographic hash function is one of a SHA-1, SHA-2, SHA-3, or MD5 cryptographic hash function.

7. The method as recited in claim 1 , wherein the first cryptographic hash function is different from the second cryptographic hash function.

8. The method as recited in claim 1 , further comprising:

a second backup phase in which the following steps are performed for each allocated plain text block stored in a second source storage at a second point in time:

hashing, using the first cryptographic hash function, the plain text block to generate a fourth hash;

hashing, using the second cryptographic hash function, the fourth hash to generate a fifth hash;

searching the key-value table to determine whether the fifth hash matches any key in the key-value table;

upon determining that the fifth hash does not match any key in the key-value table, encrypting, using the encrypt/decrypt function, the plain text block using the fourth hash as an encryption password and inserting a key-value pair into the key-value table with the key being the fifth hash and the value being the encrypted block; and

inserting an entry into a second image map corresponding to the second source storage that includes the fourth hash and a position of the plain text block in the second source storage and that does not include the fifth hash.

9. The method as recited in claim 8 , further comprising a second restore phase in which the following steps are performed for each entry in the second image map:

hashing, using the second cryptographic hash function, the fourth hash included in the entry to generate the fifth hash;

searching the key-value table to retrieve the encrypted block of the key-value pair having a key that matches the fifth hash;

decrypting, using the encrypt/decrypt function, the encrypted block using the fourth hash as a decryption password; and

storing the decrypted block in a second restore storage at the position included in the entry.

10. The method of claim 1 , wherein instructions to perform the method are stored on one or more non-transitory computer-readable media that cause one or more processors to execute the method.

11. A method for client-side encryption in a deduplication backup system, the method comprising:

a backup phase in which the following steps are performed for each allocated plain text block stored in a client-side source storage at a point in time:

hashing, using a first cryptographic hash function, the plain text block to generate a first hash;

encrypting, using an encrypt/decrypt function, the plain text block using the first hash as an encryption password;

hashing, using a second cryptographic hash function, the encrypted block to generate a third hash;

searching a key-value table of a deduplication storage to determine whether the third hash matches any key in the key-value table, each key-value pair in the key-value table including a key that is a hash and a value that is an encrypted block;

upon determining that the third hash does not match any key in the key-value table, inserting a key-value pair into the key-value table with the key being the third hash and the value being the encrypted block; and

inserting an entry into an image map corresponding to the client-side source storage that includes the first hash, the third hash, and a position of the plain text block as stored in the client-side source storage to be subsequently used in a restore phase to restore the plain text block to the position, the image map being stored in a separate location from the key-value table; and

encrypting the image map; and

a restore phase in which each block that was stored in the client-side source storage at the point in time is restored from the deduplication storage to a restore storage, thereby recreating the state of the client-side source storage at the point in time on the restore storage.

12. The method as recited in claim 11 , further comprising storing the encrypted image map in the deduplication storage.

13. The method as recited in claim 11 , wherein the image map is stored in the client-side source storage.

14. The method as recited in claim 11 , wherein the restore phase includes performing the following steps for each entry in the image map:

searching the key-value table to retrieve the encrypted block of the key-value pair having a key that matches the third hash included in the entry;

decrypting, using the encrypt/decrypt function, the encrypted block using the first hash as a decryption password; and

storing the decrypted block in the restore storage at the position included in the entry.

15. The method as recited in claim 14 , further comprising decrypting the image map prior to the restore phase.

16. The method as recited in claim 11 , wherein each of the first cryptographic hash function and the second cryptographic hash function is one of a SHA-1, SHA-2, SHA-3, or MD5 cryptographic hash function.

17. The method as recited in claim 11 , wherein the first cryptographic hash function is the same as the second cryptographic hash function.

18. The method as recited in claim 11 , further comprising:

a second backup phase in which the following steps are performed for each allocated plain text block stored in a second source storage at a second point in time:

hashing, using the first cryptographic hash function, the plain text block to generate a fourth hash;

encrypting, using the encrypt/decrypt function, the plain text block using the fourth hash as an encryption password;

hashing, using the second cryptographic hash function, the encrypted block to generate a sixth hash;

searching a key-value table of the deduplication storage to determine whether the sixth hash matches any key in the key-value table;

upon determining that the sixth hash does not match any key in the key-value table, inserting a key-value pair into the key-value table with the key being the sixth hash and the value being the encrypted block; and

inserting an entry into a second image map corresponding to the second source storage that includes the fourth hash, the sixth hash, and a position of the plain text block as stored in the second source storage.

19. The method as recited in claim 18 , further comprising a second restore phase in which the following steps are performed for each entry in the second image map:

searching the key-value table to retrieve the encrypted block of the key-value pair having a key that matches the sixth hash included in the entry;

decrypting, using the encrypt/decrypt function, the encrypted block using the fourth hash as a decryption password; and

storing the decrypted block in a second restore storage at the position included in the entry.

20. The method of claim 11 , wherein instructions to perform the method are stored on one or more non-transitory computer-readable media that cause one or more processors to execute the method.