Backup and recovery under group-level encryption
Computer-readable media, methods, and systems are disclosed for processing backup and recovery of pages in an in-memory database system employing tenant-based, group-level encryption for a plurality of tenants. Page metadata for a page may be collected. The page may comprise a header and a set of page contents. The page metadata may be stored with the page header. When a backup request is received, the page may be loaded into a backup stream. The page may be loaded with the header unencrypted and the page contents encrypted. When a recovery request is received, the data page may be retrieved from the backup stream. A converter may be rebuilt using the page metadata. The data page may then be written to the main memory of the database system. The page contents may be decrypted by the converter.
1. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by a processor, perform a method for processing backup and recovery of pages in an in-memory database system employing tenant-based, group-level encryption for a plurality of tenants, the method comprising:
retrieving page metadata for a data page, the data page comprising a header and a set of page contents;
storing the page metadata with the header;
responsive to receiving a backup request, loading the data page into one or more backup media;
responsive to receiving a recovery request for recovering the data page:
retrieving the data page and the page metadata from the one or more backup media;
rebuilding a converter using the page metadata, the converter configured to map logical page numbers from the data page to physical block numbers,
wherein the physical block numbers correspond to a physical address;
writing the data page into a main memory of the database system; and
decrypting the set of page contents using the converter to restore the data page.
2. The non-transitory computer-readable media of claim 1 , wherein the page metadata comprises an encryption group identifier, an initialization vector, and a savepoint version.
3. The non-transitory computer-readable media of claim 1 ,
wherein the set of page contents is group-level encrypted and the header is data volume encrypted, and
wherein the method further comprises:
prior to loading the data page into the one or more backup media, decrypting the header.
4. The non-transitory computer-readable media of claim 1 , the method further comprising:
verifying the data page, the verifying comprising a first checksum and a second checksum.
5. The non-transitory computer-readable media of claim 4 , the method further comprising:
calculating the first checksum on the set of page contents, the first checksum performed during a page flush prior to encryption of the header.
6. The non-transitory computer-readable media of claim 4 , the method further comprising:
calculating the second checksum on the data page, the second checksum performed after encryption of the set of page contents and before encryption of the header.
7. The non-transitory computer-readable media of claim 1 , wherein the data page is written to the main memory of the database system using a savepoint version associated with the one or more backup media.
8. A method for processing backup and recovery of pages in an in-memory database system employing tenant-based, group-level encryption for a plurality of tenants, the method comprising:
retrieving page metadata for a data page, the data page comprising a header and a set of page contents;
storing the page metadata with the header;
responsive to receiving a backup request, loading the data page into one or more backup media;
responsive to receiving a recovery request for recovering the data page:
retrieving the data page and the page metadata from the one or more backup media;
rebuilding a converter using the page metadata, the converter configured to map logical page numbers from the data page to physical block numbers,
wherein the physical block numbers correspond to a physical address;
writing the data page into a main memory of the database system; and
decrypting the set of page contents using the converter to restore the data page.
9. The method of claim 8 , wherein the set of page metadata comprises an encryption group identifier, an initialization vector, and a savepoint version.
10. The method of claim 8 ,
wherein the data page is group-level encrypted, and
wherein the method further comprises:
prior to loading the data page into the one or more backup media, decrypting the header.
11. The method of claim 8 further comprising verifying the data page, the verifying comprising a first checksum and a second checksum.
12. The method of claim 11 , the method further comprising:
calculating the first checksum on the set of page contents, the first checksum performed during a page flush prior to encryption of the header; and
calculating the second checksum on the data page, the second checksum performed after encryption of the set of page contents and before encryption of the header.
13. The method of claim 8 , further comprising:
retrieving the page metadata and the set of page contents substantially in parallel; and
storing the page metadata in a temporary converter.
14. The method of claim 8 , wherein the data page is written to the main memory of the database system using a savepoint version associated with the one or more backup media.
15. A system for processing backup and recovery of pages in an in-memory database system employing tenant-based, group-level encryption for a plurality of tenants, the system comprising:
at least one processor; and
at least one non-transitory memory storing computer executable instructions that when executed by the at least one processor cause the system to carry out actions comprising:
retrieving page metadata for a data page, the data page comprising a header and a set of page contents;
storing the page metadata with the header;
responsive to receiving a backup request, loading the data page into one or more backup media;
responsive to receiving a recovery request for recovering the data page:
retrieving the data page and the page metadata from the one or more backup media;
rebuilding a converter using the page metadata, the converter configured to map logical page numbers from the data page to physical block numbers,
wherein the physical block numbers correspond to a physical address;
writing the data page into a main memory of the database system; and
decrypting the set of page contents using the converter to restore the data page.
16. The system of claim 15 , wherein the page metadata comprises an encryption group identifier, an initialization vector, and a savepoint version.
17. The system of claim 15 ,
wherein the data page is group-level encrypted, and
wherein the actions further comprise:
prior to loading the data page into the one or more backup media, decrypting the header.
18. The system of claim 17 , the actions further comprising verifying the data page, the verifying comprising a first checksum and a second checksum.
19. The system of claim 18 , the actions further comprising:
calculating the first checksum on the set of page contents, the first checksum performed during a page flush prior to encryption of the header; and
calculating the second checksum on the data page, the second checksum performed after encryption of the set of page contents and before encryption of the header.
20. The system of claim 17 , wherein the data page is written to the main memory of the database system using a savepoint version associated with the one or more backup media.