Zero-knowledge protection for side channels in data protection to the cloud
Masking a data rate of transmitted data is disclosed. As data is transmitted from a production site to a secondary site, the data rate is masked. Masking the data rate can include transmitting at a fixed rate, a random rate, or an adaptive rate. Each mode of data transmission masks or obscures the actual data rate and thus prevents others from gaining information about the data or the data owner from the data transfer rate.
1. A method for protecting a side channel associated with data, the method comprising:
determining a rate for transferring data between a production site and a secondary site;
transferring the data at the determined rate, wherein the transferred data is padded with extra data when there is insufficient data to achieve the determined rate and wherein the transferred data is queued when the data cannot be transmitted at the determined rate, wherein the determined rate is a fixed rate; and
tuning the determined rate based on a recovery point objective.
2. The method of claim 1 , wherein the discretization process dimensionally reduces a time series of n points to N points where N <n.
3. The method of claim 2 , further comprising:
to achieve the new rate, performing one or more of:
adding padding data to the transmitted data;
generating dummy data even if no data is available to transmit;
buffer excess data for later transmission;
compressing the data and controlling a compression ratio; or deduplicating the data to be transmitted.
4. The method of claim 1 , further comprising changing the allowed frequency.
5. The method of claim 1 , wherein the new rate is aligned with a frequency that is less than the allowed frequency.
6. A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform the method of claim 1 .
7. A method for protecting a side channel associated with data, the method comprising
determining a rate for transferring data between a production site and a secondary site;
transferring the data at the determined rate, wherein the transferred data is padded with extra data when there is insufficient data to achieve the determined rate and wherein the transferred data is queued when the data cannot be transmitted at the determined rate, wherein the determined rate is a random rate;
setting the random rate for a specific time period and changing the rate for a next specific time period, wherein the random rate for the next specific time period is different from the random rate for the specific time period, wherein the random rate is configured to appear as normal system behavior.
8. A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform the method of claim 7 .
9. A method for protecting a side channel associated with data, the method comprising:
determining a rate for transferring data between a production site and a secondary site;
transferring the data at the determined rate, wherein the transferred data is padded with extra data when there is insufficient data to achieve the determined rate and wherein the transferred data is queued when the data cannot be transmitted at the determined rate, wherein the determined rate is an adaptive rate; and
repeatedly:
sending raw metric data from a cloud storage driver to a discretization engine;
performing a discretization process by the discretization engine based on the raw metric data and an allowed frequency;
predicting a new rate; and
transmitting the data at the new rate.
10. A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform the method of claim 9 .