Method and system for secure data replication data integrity verification
Example embodiments of the present invention relate to a method, a system, and a computer program product for verifying the integrity of replicated virtual machine data. The method includes reading data from a production volume at a production site. A representation of the data may be stored at a replica site with the integrity of the data stored in the replica volume being verified according to the representation of the data.
1. A system, comprising:
one or more processors; and
a non-transitory computer-readable storage medium having computer program code encoded thereon that is executable by the one or more processors to perform operations comprising:
receiving a hash of production data that resides at a production volume of a production site;
storing the hash to a replica site journal of a replica site;
receiving an encrypted copy of the production data;
storing the encrypted copy of the production data in a replica volume at the replica site; and
verifying integrity of the encrypted data stored in the replica volume by performing operations, at the replica site, comprising:
reading out, and decrypting, the encrypted copy of the production data;
hashing the decrypted production data;
comparing the hash of the decrypted production data with the hash stored in the replica site journal, and either:
marking the decrypted production data as compromised when the hash of the decrypted production data does not match the hash stored in the replica site journal; or,
providing access to the decrypted production data at the replica site when the hash of the decrypted production data matches the hash stored in the replica site journal.
2. The system of claim 1 , wherein decrypting the encrypted copy of the production data stored at the replica site is performed using a key that was used to encrypt the data at the production site.
3. The system of claim 1 , wherein verifying integrity of the encrypted data stored in the replica volume is performed at one of the following times: when the replica site is in an image access mode; while the replica site is performing replication; or, at a point in time specified by a user.
4. The system of claim 1 , wherein the production data comprises a portion of a virtual machine (VM).
5. The system of claim 1 , wherein the replica site is a public cloud site.
6. The system of claim 1 , wherein the operations further comprise preventing access to the decrypted production data at the replica site when the hash of the decrypted production data does not match the hash stored in the replica site journal.
7. The system of claim 1 , wherein the hashed portion of the decrypted production data comprises one or more chunks of data.
8. The system of claim 1 , wherein receiving a hash of production data comprises receiving a plurality of hashes, each of which corresponds to a respective portion of the production data.
9. The system of claim 1 , wherein the production data comprises a snapshot.
10. The system of claim 1 , wherein data integrity verification is performed while replication from the production site to the replica site is ongoing.