Adaptive metadata encryption for a data protection software
One example method includes obtaining hop information of a metadata path for backup metadata, obtaining content sensitivity information indicating a relative sensitivity of backup data to an attack, based on the hop information and the content sensitivity information, selecting an encryption to be applied to the backup metadata, and applying the encryption to the backup metadata. The backup data may be encrypted with the same encryption algorithm that was used to encrypt the backup metadata.
1. A method, comprising:
obtaining hop information of a metadata path for backup metadata, wherein the metadata path extends from a backup server to a target storage site, and the hop information is derived in part from data zone information and includes information indicating an extent to which the backup metadata is vulnerable to attack at each hop in the metadata path;
obtaining content sensitivity information indicating a relative sensitivity of backup data to an attack;
based on the information indicating the extent to which the backup metadata is vulnerable to attack at each hop in the metadata path, an efficiency of an encrypting processing resource, a performance penalty, and the content sensitivity information, selecting an encryption to be applied to the backup metadata, wherein the performance penalty is imposed on a host by performance of the encryption by the host; and
applying, by the encrypting processing resource, the encryption to the backup metadata.
2. The method as recited in claim 1 , wherein the hop information identifies a number of hops taken by the backup metadata as the backup metadata travels the metadata path.
3. The method as recited in claim 1 , further comprising applying the same encryption to the backup data as was applied to the backup metadata.
4. The method as recited in claim 1 , wherein the attack comprises a ransomware attack.
5. The method as recited in claim 1 , wherein when the hop information meets or exceeds a threshold, the encryption is relatively stronger than encryption used when the hop information is below the threshold.
6. The method as recited in claim 1 , wherein when the hop information is below a threshold, the encryption is selected in accordance with the content sensitivity information.
7. The method as recited in claim 1 , wherein the data zone information includes one or more data zones through which the backup metadata passes and/or host information regarding a host that performs the encryption.
8. The method as recited in claim 1 , wherein the method is performed by a backup server.
9. A non-transitory computer readable storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
obtaining hop information of a metadata path for backup metadata, wherein the metadata path extends from a backup server to a target storage site, and the hop information is derived in part from data zone information and includes information indicating an extent to which the backup metadata is vulnerable to attack at each hop in the metadata path;
obtaining content sensitivity information indicating a relative sensitivity of backup data to an attack;
based on the information indicating the extent to which the backup metadata is vulnerable to attack at each hop in the metadata path, an efficiency of an encrypting processing resource, a performance penalty, and the content sensitivity information, selecting an encryption to be applied to the backup metadata, wherein the performance penalty is imposed on a host by performance of the encryption by the host; and
applying, by the encrypting processing resource, the encryption to the backup metadata.
10. The non-transitory computer readable storage medium as recited in claim 9 , wherein the hop information identifies a number of hops taken by the backup metadata as the backup metadata travels the metadata path.
11. The non-transitory computer readable storage medium as recited in claim 9 , wherein the operations further comprise applying the same encryption to the backup data as was applied to the backup metadata.
12. The non-transitory computer readable storage medium as recited in claim 9 , wherein the attack comprises a ransomware attack.
13. The non-transitory computer readable storage medium as recited in claim 9 , wherein when the hop information meets or exceeds a threshold, the encryption is relatively stronger than encryption used when the hop information is below the threshold.
14. The non-transitory computer readable storage medium as recited in claim 9 , wherein when the hop information is below a threshold, the encryption is selected in accordance with the content sensitivity information.
15. The non-transitory computer readable storage medium as recited in claim 9 , wherein the data zone information includes one or more data zones through which the backup metadata passes and/or host information regarding a host that performs the encryption.
16. The non-transitory computer readable storage medium as recited in claim 9 , wherein the operations are performed by a backup server.