Auto encrypt chunks of content for backup, best practice?

Question

I'm just curious and it's more like a mind game, I'm not into cryptography.

How would one encrypt data that's constantly generated? Put the data automaticly into chunks encrypt the chunk and send it to a backup server which would store it. My first idea was to encrypt the first chunk with a user input like a password, and then store the hash somewhere, then the next chunk would be encrypted by the hash and i would store just the next one.

So I could decrypt the chunks after that by just applying one password on the beginning and then auto decrypt by the hashes. So where are the pitfalls?

How would a specialist do it? It needs to be a autonomous algorithm, how secure could it get?

[EDIT] Let's assume I want to store personal data:

Name: Bob
Job: Developer
Birthday: 12/12/12

I don't know this data before, but when the system is working it generates somehow this data, now i'll put like 5 persons into one chunk and want to backup it on to like 5 server around the world :). Without a user providing for each chunk a password. And obviously I can't store the password on the server and encrypt every chunk with it.

[EDIT2] And maybe backup is the wrong thing, let's assume we store the encrypted data somewhere and forget them on the server which was generating them. I would be, as I wrote, also interested in the pitfalls on my approach, if there are some? I know that a filesystem could work like this that every hash i would store could be recovered, but if I would store it just in the RAM?

Answer 1

It depends on the 'level' you're working at - are you dealing with data generated by an application you're implementing, or securing data being generated by some other bit of software? The suggested approach is going to be a little different.

For data generated by software you don't control: (Such as logfiles, etc.)
See if you can leverage the underlying filesystem, your SAN, or similar - in Windows this can be achieved by creating a user to run whatever task is generating the data, logging in as them and setting the output folder to 'encrypted'. You'll need this user to run your backup, but most backup applications will allow you to write out as encrypted data, so you'll have your data encrypted at rest, as it's generated, then decrypted and re-encrypted when you run your backup (but with a key that you can put in your DR plan).

For data generated in software you control that you want to encrypt:
If you're talking about implementing something yourself (i.e. have this happen in an application you're developing), have a look at any of the well understoond stream ciphers, such as RC4 (though RC4 is famously tricky to keep secure, it is well understood - Trivium or the like may be a better choice, bit you may need to hunt a bit to find a library for your language of choice). Stream cipers are designed to work with data of an unkown or unknowable length, which sounds like the sort of problem you're describing.