xBackup: Ransomware-Proof Backup

The Problem

Ransomware encrypts backups alongside primary data. Single-provider backups are a single point of failure. Cloud provider compromises, insider threats, and supply chain attacks expose all backup data at once.

Modern ransomware specifically targets backup infrastructure before encrypting production data. Attackers identify backup agents, compromise backup credentials, and encrypt or delete backups before the ransom demand. The 3-2-1 backup rule fails when all three copies are accessible from the same compromised network.

Cloud backups solve the offsite problem but create a new single point of failure: the cloud provider itself. A provider-side breach, rogue employee, or government subpoena exposes all backup data. Encryption-at-rest protects against disk theft but not against application-layer attacks.

The Old Way

The PRIVATE.ME Solution

xBackup splits backup files via XorIDA into K-of-N shares with streaming chunked processing, then distributes each share to an independent storage provider. No single provider holds reconstructable data. Any K providers can restore the complete original.

Ransomware cannot encrypt what does not exist in any one place. Each provider stores only one share -- a blob that is information-theoretically meaningless without K-1 additional shares from other providers. Compromising one provider yields exactly zero information.

DID-based identity replaces API keys for authentication between the backup client and storage nodes. Each storage node has a cryptographic identity verified via Ed25519 signatures. No shared secrets to steal, no config files to compromise.

The New Way

How It Works

Streaming chunked pipeline: files are read in chunks, each chunk XorIDA-split, and shares streamed to providers in parallel. Restore reverses the process, fetching K shares per chunk and reconstructing in order.

Use Cases

Integration

import { splitBackup, restoreBackup } from '@private.me/xbackup';

// Split file across 3 providers, 2 required to restore
const shares = await splitBackup(fileBuffer, [
  's3://my-bucket',
  'azure://my-container',
  'gcs://my-bucket',
], { n: 3, k: 2 });

// Restore from any 2 providers
const restored = await restoreBackup(
  [shares[0], shares[2]]  // any K shares
);

Security Properties

Verifiable Data Protection

Every operation in this ACI produces a verifiable audit trail via xProve. HMAC-chained integrity proofs let auditors confirm that data was split, stored, and reconstructed correctly — without accessing the data itself.

Ready to deploy xBackup?

Talk to Ren, our AI sales engineer, or book a live demo with our team.

Ship Proofs, Not Source

xBackup generates cryptographic proofs of correct execution without exposing proprietary algorithms. Verify integrity using zero-knowledge proofs — no source code required.

Use Cases