Using INQ to optimize end-to-end encryption management with backup appliances
One example method includes receiving, by a backup appliance, a request concerning a dataset, performing, by the backup appliance, an inquiry to determine if end-to-end encryption is enabled for a volume of a target storage array, receiving, by the backup appliance, confirmation from the storage array that end-to-end encryption is enabled for the volume, and based on the confirmation that end-to-end encryption is enabled for the volume, storing the dataset in the volume without performing encryption, compression, or deduplication, of the dataset prior to storage of the dataset in the volume.
1. A method, comprising:
receiving, by a backup appliance, a dataset for backup from a volume of a storage array;
performing, by the backup appliance, an inquiry to determine if end-to-end encryption is enabled for the volume of the storage array;
receiving, by the backup appliance, confirmation from the storage array that end-to-end encryption is enabled for the volume; and
based on the confirmation that end-to-end encryption is enabled for the volume, storing the dataset in a backup volume without performing encryption, compression, or deduplication, of the dataset prior to storing the dataset in the backup volume.
2. The method as recited in claim 1 , wherein the inquiry is performed using an INQ command.
3. The method as recited in claim 1 , further comprising marking, by the backup appliance, data in the dataset as end-to-end encryption enabled after receipt of confirmation from the storage array that end-to-end encryption is enabled for the volume.
4. The method as recited in claim 1 , further comprising processing, by the backup appliance, the dataset,
wherein the processing is performed in response to a restore request, and
wherein the method further comprises restoring the dataset to a volume.
5. The method as recited in claim 1 , further comprising, in response to an access request, enabling, by the backup appliance, user access to a backup image of the dataset.
6. The method as recited in claim 1 , wherein the dataset is encrypted, and
wherein the method further comprises:
after the receiving of the confirmation, receiving, by the backup appliance from the storage array, an encryption/decryption key for the encrypted dataset; and
storing, at the backup appliance, the encrypted dataset.
7. The method as recited in claim 6 , further comprising storing the encryption/decryption key together with the encrypted dataset.
8. The method as recited in claim 1 , further comprising:
receiving, by the backup appliance, a restore request to restore a backup dataset to a target storage array;
notifying, by the backup appliance, the storage array that data in the backup dataset is marked as end-to-end encryption enabled; and
transmitting, by the backup appliance, an encrypted backup dataset and an encryption/decryption key to the storage array.
9. A non-transitory computer readable storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
receiving, by a backup appliance, a dataset for backup from a volume of a storage array;
performing, by the backup appliance, an inquiry to determine if end-to-end encryption is enabled for the volume of the storage array;
receiving, by the backup appliance, confirmation from the storage array that end-to-end encryption is enabled for the volume; and
based on the confirmation that end-to-end encryption is enabled for the volume, storing the dataset in a backup volume without performing encryption, compression, or deduplication, of the dataset prior to storing the dataset in the backup volume.
10. The non-transitory computer readable storage medium as recited in claim 9 , wherein the inquiry is performed using an INQ command.
11. The non-transitory computer readable storage medium as recited in claim 9 , wherein the operations further comprise marking, by the backup appliance, data in the dataset as end-to-end encryption enabled after receipt of confirmation from the storage array that end-to-end encryption is enabled for the volume.
12. The non-transitory computer readable storage medium as recited in claim 9 , wherein the operations further comprise processing, by the backup appliance, the dataset,
wherein the processing is performed in response to a restore request, and
wherein the operations further comprise restoring the dataset to a volume.
13. The non-transitory computer readable storage medium as recited in claim 9 , wherein the operations further comprise, in response to an access request, the backup appliance enabling user access to a backup image of the dataset.
14. The non-transitory computer readable storage medium as recited in claim 9 , wherein the dataset is encrypted, and
wherein the operations further comprise:
after the receiving of the confirmation, receiving, by the backup appliance from the storage array, an encryption/decryption key for the encrypted dataset; and
storing, at the backup appliance, the encrypted dataset.
15. The non-transitory computer readable storage medium as recited in claim 14 , wherein the operations further comprise storing the encryption/decryption key together with the encrypted dataset.
16. The non-transitory computer readable storage medium as recited in claim 9 , wherein the operations further comprise:
receiving, by the backup appliance, a restore request to restore a backup dataset to the storage array;
notifying, by the backup appliance, the storage array that data in the backup dataset is marked as end-to-end encryption enabled; and
transmitting, by the backup appliance, an encrypted backup dataset and an encryption/decryption key to the storage array.