I am developing software that will be used for data backup.
The server will run on Linux. Security in transportation is not an issue (HTTPS or SSH), but the data must be stored encrypted on the server.
The data is not tied to a single computer, so multiple computers should be able to access the same data, if given a key (shared key is acceptable).
The customer should be assured that the data cannot be viewed on the server, either by a curious employee or a hacker. This means that the server should not store the key used to decipher the encryption, but could use it in a transaction if needed.
Being a file server, the network will be saturated, so sending deltas is preferred over sending entire files. The files will also be managed (on the server) by a version control system; whereas the client may or may not have version control. Space is a consideration.
This is what I've come up with:
- Each user has his/her own mount point
- Each mount point will be encrypted
- Files will be decrypted, have the delta applied, then re-encrypted
This sounds a bit inefficient, so I've come here for guidance.
Can file deltas be applied to an encrypted file?
The most important requirements are:
- Data integrity (updates should never break a file)
- Minimize network/storage overhead (conserving CPU/ram would be nice, but not necessary)
- Must be able to be version controlled