Encryption Matrix

Overview

Portworx Backup supports two types of backup data encryption:

• Server-side encryption (SSE-S3): AWS S3 encrypts backup data when it is stored in the S3 bucket, using encryption keys managed by AWS S3.
• Encryption with a user-provided key: Portworx Backup encrypts backup data using the encryption key configured for the backup location before transferring it to the backup location. For information on how to configure the encryption key for the backup location, see [Configure Backup Location] (../use-px-backup/cloud-settings/configure-backup-location/index.md).
  The data remains encrypted during transfer and while stored in the backup location. Portworx Backup decrypts the data during restore.

You can enable either encryption type independently or use both together. The following topics provide more information on each type of encryption:

Server-side encryption (SSE-S3)

Prerequisites

• Portworx Backup 2.7.0 and above
• Portworx 3.1.0 and above
• Stork 24.1.0

AWS S3 encrypts the backup data at the destination using the applications or services that receive the data. By default, all AWS S3 buckets are configured with encryption. For more information, see AWS S3 SSE.

Portworx Backup currently supports the following type of encryption:

• SSE-S3 with AWS S3 managed keys

In this type of encryption, each object is encrypted with a unique key. To provide enhanced security, the SSE-S3 encrypts the unique encryption key itself using a root key with a regular rotational mechanism.

You can enable SSE-S3 for the following backup types of Portworx Backup:

• Backups based on Portworx volumes
• CSI backups
• CSI backup with offload to backup location (KDMP)
• KDMP backups

For more information on how to enable this encryption, see Add AWS/S3 backup location.

note

The default encryption key in the table below refers to the AWS S3-managed encryption key (SSE-S3). When SSE-S3 is enabled on a bucket, AWS automatically generates and manages a unique encryption key for each object. This key is not user-configurable and is separate from any user-provided encryption key passed through the Portworx Backup UI. To use a customer-managed key (SSE-KMS), configure this at the S3 bucket level before adding the backup location. For more information, see AWS Server-side encryption.

The following table describes the server-side encryption behavior of Portworx Backup with the bucket configuration and deny policy:

Bucket configuration	Deny policy configuration	SSE-S3 enabled	Portworx Backup behavior
SSE-S3	No	No	Backup location gets created Backup data is encrypted with default encryption key
SSE-S3	No	Yes	Backup location gets created Backup data is encrypted with default encryption key
SSE-S3	Yes	Yes	Backup location gets created Backup data is encrypted with default encryption key
SSE-S3	Yes	No	Creation of backup location fails with AccessDenied error

Transit and at-rest data encryption

When you specify an encryption key while adding a backup location, Portworx Backup encrypts supported backup files before transferring them to the backup location. The data remains encrypted during transfer and while stored in the backup location.

This encryption protects the confidentiality of backup data both in transit and at rest, regardless of whether server-side encryption is enabled on the backup location.

Prerequisites

• Portworx Backup 2.3.0 and above
• Portworx 2.11.2 and above
• Stork 23.9.1 and later

Encryption support matrix

The following table explains the encryption support for the backup types provided by Portworx Backup and their behavior:

Backup Type	Data Files	Encryption Support	Encryption Key
Backup to Portworx volumes	Data
		Yes	User-provided
	Resource files
		Yes	User-provided
KDMP Backup	Data
		Yes	Volume snapshots are encrypted with default encryption key and not with the user-provided encryption key
	Resource files
		Yes	User-provided
Backup to Cloud providers	Data
		No	-
	Resource files
		Yes	User-provided

note

Portworx Backup encrypts the supported backup files (data and resource files) with the user-provided key regardless of the backup location type (NFS or S3 compliant object store). These files remain encrypted both in transit and at rest in the backup location.

Pure1 telemetry data encryption

Telemetry data (metrics and logs) sent to Pure1 for diagnostics uses a separate encrypted data flow and is not part of the backup data path described in the table above.

Data flow	Data transferred	Encryption	Key
Portworx Backup to Pure1 (diagnostics)	Metrics and logs	Yes. Mutual TLS (mTLS) over TCP port 443	Pure Storage CA-issued certificates

For more information, see Configure Telemetry.