Partially encrypted snapshots
Generally described, one or more aspects of the present application correspond to techniques for managing snapshots in a partially encrypted state and providing access to partially encrypted snapshots. These snapshot management techniques allow a snapshot that is being encrypted to be accessed prior to the encryption being completed. Such a snapshot may have some blocks that have been encrypted, and other blocks that have not yet been encrypted. In order to provide access to such a snapshot in a partially encrypted state, a system may allow the encryption status of the blocks in the snapshot to be checked at the block level instead of at the snapshot level (or at some other intermediary level therebetween), according to some embodiments. By doing so, the system can reduce the delays resulting from snapshots that are locked during the encryption process.
1. A cloud provider system comprising:
a first set of servers having stored thereon a volume of data, wherein the volume includes a plurality of data blocks;
a second set of servers having stored thereon a snapshot of the volume of data, wherein the snapshot represents a copy of the volume at a point in time and includes copies of the plurality of data blocks present on the volume at the point in time; and
a third set of servers in communication with the first set of servers and the second set of servers, wherein the third set of servers is configured to:
determine that the snapshot stored on the second set of servers is to be encrypted, wherein the snapshot is associated with a snapshot-level encryption status having a first value indicating that the snapshot is in an unencrypted state;
set the snapshot-level encryption status associated with the snapshot to a second value indicating that the snapshot is in a partially encrypted state;
initiate encryption of at least one of the plurality of data blocks included in the snapshot;
prior to all of the plurality of data blocks being encrypted, receive a read request to access a first data block of the plurality of data blocks;
in response to the read request, determine a block-level encryption status associated with the first data block, wherein the block-level encryption status indicates that the first data block is in a state other than a partially encrypted state;
output the first data block based on the block-level encryption status associated with the first data block;
determine that all of the plurality of data blocks included in the snapshot have been encrypted; and
set the snapshot-level encryption status associated with the snapshot to a third value indicating that the snapshot is in an encrypted state.
2. The cloud provider system of claim 1 , wherein the third set of servers is configured to (i) determine that the read request is originating from an encrypted volume stored on the first set of servers and that the block-level encryption status indicates that the first data block is unencrypted, (ii) encrypt the first data block, and (iii) output the encrypted first data block to the encrypted volume.
3. The cloud provider system of claim 1 , wherein the third set of servers is configured to (i) determine that the read request is originating from an unencrypted volume stored on the first set of servers and that the block-level encryption status indicates that the first data block is encrypted, (ii) decrypt the first data block, and (iii) output the decrypted first data block to the unencrypted volume.
4. The cloud provider system of claim 1 , wherein the third set of servers is configured to set the snapshot-level encryption status associated with the snapshot to the third value based on determining that all of the plurality of data blocks have been encrypted and that all parent snapshots associated with the snapshot are in an encrypted state.
5. A computer-implemented method comprising:
determining that a snapshot representative of a volume of data is to be encrypted, wherein the snapshot is associated with a first encryption status having a first value indicating that the snapshot is in an unencrypted state;
setting the first encryption status associated with the snapshot to a second value indicating that the snapshot is in a partially encrypted state;
initiating encryption of at least one of a plurality of data blocks included in the snapshot;
prior to all of the plurality of data blocks being encrypted, receiving a read request to access a first data block of the plurality of data blocks;
in response to the read request, determining a second encryption status associated with the first data block, wherein the second encryption status indicates that the first data block is in a state other than a partially encrypted state; and
outputting the first data block based on the second encryption status associated with the first data block.
6. The computer-implemented method of claim 5 , further comprising (i) determining that the read request is originating from an encrypted volume and that the first data block is unencrypted, (ii) encrypting the first data block, and (iii) outputting the encrypted first data block to the encrypted volume.
7. The computer-implemented method of claim 6 , further comprising receiving, prior to all of the plurality of data blocks of the snapshot being encrypted, another read request to access a second data block from the encrypted volume, determining that the second data block is encrypted, and outputting the second data block to the encrypted volume without performing any additional encryption on the second data block.
8. The computer-implemented method of claim 5 , further comprising (i) determining that the read request is originating from an unencrypted volume and that the first data block is encrypted, (ii) decrypting the first data block, and (iii) outputting the decrypted first data block to the unencrypted volume.
9. The computer-implemented method of claim 8 , further comprising receiving, prior to all of the plurality of data blocks of the snapshot being encrypted, another read request to access a second data block from the unencrypted volume, determining that the second data block is unencrypted, and outputting the second data block to the unencrypted volume without performing any additional decryption on the second data block.
10. The computer-implemented method of claim 5 , further comprising:
determining that all of the plurality of data blocks included in the snapshot have been encrypted; and
setting the first encryption status associated with the snapshot to a third value indicating that the snapshot is in an encrypted state.
11. The computer-implemented method of claim 10 , further comprising:
determining that at least one parent snapshot associated with the snapshot is not in an encrypted state; and
waiting until the at least one parent snapshot is in an encrypted state prior to setting the first encryption status to the third value.
12. The computer-implemented method of claim 5 , wherein the first encryption status is indicated by a snapshot encryption status flag stored as part of snapshot metadata associated with the snapshot, and the second encryption status is indicated by a block encryption status flag stored as part of block metadata associated with the first data block.
13. Non-transitory computer-readable media comprising computer-executable instructions that, when executed on a computing system, cause the computing system to perform operations comprising:
determining that a snapshot representative of a volume of data is to be encrypted, wherein the snapshot is associated with a snapshot-level encryption status having a first value indicating that the snapshot is in an unencrypted state;
initiating encryption of at least one of a plurality of data blocks included in the snapshot;
prior to all of the plurality of data blocks being encrypted, receiving a read request to access a first data block of the plurality of data blocks;
in response to the read request, determining a block-level encryption status associated with the first data block, wherein the block-level encryption status indicates that the first data block is in a state other than a partially encrypted state; and
outputting the first data block based on the block-level encryption status associated with the first data block.
14. The non-transitory computer-readable media of claim 13 , the operations further comprising (i) determining that the read request is originating from an encrypted volume and that the first data block is unencrypted, (ii) encrypting the first data block, and (iii) outputting the encrypted first data block to the encrypted volume.
15. The non-transitory computer-readable media of claim 14 , the operations further comprising receiving, prior to all of the plurality of data blocks of the snapshot being encrypted, another read request to access a second data block from the encrypted volume, determining that the second data block is encrypted, and outputting the second data block to the encrypted volume without performing any additional encryption on the second data block.
16. The non-transitory computer-readable media of claim 13 , the operations further comprising (i) determining that the read request is originating from an unencrypted volume and that the first data block is encrypted, (ii) decrypting the first data block, and (iii) outputting the decrypted first data block to the unencrypted volume.
17. The non-transitory computer-readable media of claim 16 , the operations further comprising receiving, prior to all of the plurality of data blocks of the snapshot being encrypted, another read request to access a second data block from the unencrypted volume, determining that the second data block is unencrypted, and outputting the second data block to the unencrypted volume without performing any additional decryption on the second data block.
18. The non-transitory computer-readable media of claim 13 , the operations further comprising:
determining that all of the plurality of data blocks included in the snapshot have been encrypted; and
setting the snapshot-level encryption status associated with the snapshot to a second value indicating that the snapshot is in an encrypted state.
19. The non-transitory computer-readable media of claim 18 , the operations further comprising:
determining that at least one parent snapshot associated with the snapshot is not in an encrypted state; and
waiting until the at least one parent snapshot is in an encrypted state prior to setting the snapshot-level encryption status to the second value indicating that the snapshot is in an encrypted state.
20. The non-transitory computer-readable media of claim 13 , wherein the block-level encryption status is indicated by a block encryption status flag stored as part of block metadata associated with the first data block.