Secure deduplication of multiple keys using locked fingerprints

Abstract

The computer-implemented method includes computing a fingerprint for a data chunk, encrypting the fingerprint with a fingerprint key, and encrypting the data chunk with a base key and the encrypted fingerprint. The method also includes encrypting the encrypted fingerprint with a user key to generate a doubly encrypted fingerprint, and sending the encrypted data chunk and the doubly encrypted fingerprint to a storage system. The storage system does not have access to the base key, the fingerprint key, and the user key. The computer-implemented method includes computing a fingerprint for a data chunk, and encrypting the data chunk with the base key and the fingerprint. The method also includes encrypting the fingerprint with the user key, and sending the encrypted data chunk and the encrypted fingerprint to a storage system. The storage system does not have access to the base key and the user key.

Description

[Technical Field]

[0001] The present invention relates to secure deduplication, and more particularly, to multi-key secure deduplication using locked fingerprints in cloud storage systems and networks. [Background technology]

[0002] Traditional data reduction techniques, such as deduplication and / or compression, do not provide meaningful reductions when applied to encrypted data. Deduplication of multiple data sets, each encrypted with a unique encryption key, fails when different encryption algorithms prevent duplicate data chunks from being identified by traditional deduplication processes. Traditional data reduction techniques also do not provide sufficient data confidentiality between clients and storage systems.

[0003] For example, one known bring-your-own-key (BYOK) encryption technique involves a multi-party trust system. All data reduction functionality can be provided by the storage system, which has access to all the data. However, because the storage system has access to the client's key, traditional BYOK systems do not provide data confidentiality between the storage system and the client. A third-party key service also has access to the shared encryption key used to encrypt client data. With this form of BYOK encryption, data confidentiality exists only between the users.

[0004] Traditional encryption at rest encrypts incoming unencrypted data with a key known to the storage system, which can then decrypt all data and perform deduplication on all data in the system. However, encryption at rest does not provide data confidentiality.

[0005] Traditional fully client-side encryption encrypts data using a key unknown to the storage system. The storage system deduplicates only the data encrypted with the common key. Fully client-side deduplication provides relatively high data confidentiality, but it hinders deduplication efficiency. Summary of the Invention

[0006] According to one approach, a computer-implemented method includes calculating a fingerprint for a data chunk, encrypting the fingerprint with a fingerprint key, and encrypting the data chunk with a base key and the encrypted fingerprint. The method also includes encrypting the encrypted fingerprint with a user key to generate a doubly encrypted fingerprint, and transmitting the encrypted data chunk and the doubly encrypted fingerprint to a storage system. The storage system does not have access to the base key, the fingerprint key, and the user key. The method provides data confidentiality between users while allowing users with different user keys to benefit from deduplication across a set of keys.

[0007] The computer-implemented method optionally includes the storage system being configured to perform a deduplication operation on the encrypted data chunks, this optional technique enabling secure deduplication of encrypted data using fingerprints that are encrypted with a unique user key.

[0008] According to another approach, a system includes a processor and logic integrated into, executable by, or integrated into and executable by the processor, the logic being configured to perform the method described above.

[0009] According to another approach, a computer program product includes one or more computer-readable storage media and program instructions collectively stored on the one or more computer-readable storage media, the program instructions including program instructions for performing the aforementioned method.

[0010] According to one approach, a computer-implemented method includes calculating a fingerprint of a data chunk and encrypting the data chunk with a base key and the fingerprint. The method also includes encrypting the fingerprint with a user key and transmitting the encrypted data chunk and the encrypted fingerprint to a storage system. The storage system does not have access to the base key and the user key. The foregoing method provides the ability to securely deduplicate encrypted data with enhanced protection from attacks.

[0011] The computer-implemented method optionally includes encrypting the data chunks with a base key, the fingerprint using AES encryption in XTS mode. This optional technique provides protection against an attacker moving the encrypted chunks from one location to another, and implicitly encrypts the initialization vector as part of encrypting the data chunks.

[0012] According to another approach, a computer program product includes one or more computer-readable storage media and program instructions collectively stored on the one or more computer-readable storage media, the program instructions including program instructions for performing the aforementioned method.

[0013] Other aspects and techniques of the present invention will become apparent from the following detailed description, which, taken in conjunction with the drawings, illustrate by way of example the principles of the invention. [Brief explanation of the drawings]

[0014] [Figure 1]FIG. 1 illustrates a cloud computing environment in accordance with one aspect of the present invention. [Figure 2] FIG. 2 illustrates an abstract model layer according to one aspect of the present invention. [Figure 3] FIG. 1 is a high-level architectural diagram in accordance with an aspect of the present invention. [Figure 4] FIG. 1 is a high-level architectural diagram in accordance with an aspect of the present invention. [Figure 5] 1 is a flowchart of a method according to an aspect of the present invention. [Figure 6] 1 is a flowchart of a method according to an aspect of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0015] The following description is made for the purpose of illustrating the general principles of the present invention and is not intended to limit the inventive concepts claimed herein. Moreover, particular features described herein can be used in combination with other described features in each of the various possible combinations and permutations.

[0016] In this specification, unless otherwise specifically defined, all terms are to be given their broadest possible interpretation, including the meanings indicated by this specification and the meanings understood by those skilled in the art and / or defined in dictionaries, treatises, etc.

[0017] It should also be noted that, as used in this specification and the appended claims, the singular forms "a," "an," and "the" include plural referents unless otherwise specified. It will be further understood that the terms "comprises" and / or "comprising," when used herein, indicate the presence of stated features, integers, steps, operations, elements, or components, or combinations thereof, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or groups thereof, or combinations thereof.

[0018] The following description discloses several aspects of secure multi-key deduplication using locked fingerprints.

[0019] In one general aspect, a computer-implemented method includes computing a fingerprint for a data chunk, encrypting the fingerprint with a fingerprint key, and encrypting the data chunk with a base key and the encrypted fingerprint. The method also includes encrypting the encrypted fingerprint with a user key to generate a doubly encrypted fingerprint, and transmitting the encrypted data chunk and the doubly encrypted fingerprint to a storage system. The storage system does not have access to the base key, the fingerprint key, and the user key.

[0020] In another general aspect, a system includes a processor and logic integrated with, executable by, or integrated with and executable by the processor, the logic configured to perform the method described above.

[0021] In another general aspect, a computer program product includes one or more computer-readable storage media and program instructions collectively stored on the one or more computer-readable storage media, the program instructions including program instructions for performing the aforementioned method.

[0022] In yet another general aspect, a computer-implemented method includes calculating a fingerprint of a data chunk and encrypting the data chunk with a base key and the fingerprint. The method also includes encrypting the fingerprint with a user key and transmitting the encrypted data chunk and the encrypted fingerprint to a storage system. The storage system does not have access to the base key and the user key.

[0023] In another general aspect, a computer program product includes one or more computer-readable storage media and program instructions collectively stored on the one or more computer-readable storage media, the program instructions including program instructions for performing the aforementioned method.

[0024] Although this disclosure includes detailed descriptions of cloud computing, it should be understood that implementation of the subject matter presented herein is not limited to cloud computing environments. Aspects of the present invention may be implemented in conjunction with any other type of computing environment now known or later developed.

[0025] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computational resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) and for rapidly provisioning and releasing these resources with minimal administrative effort or interaction with a service provider. This cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0026] The features are as follows: On-demand self-service: Cloud customers can automatically provision server time, network storage, and other computing power as needed, without any unilateral or human interaction with the service provider. Wide network access: Cloud capabilities are available over the network and can be accessed through standard mechanisms, facilitating usage by heterogeneous thin-client or thick-client platforms (e.g., mobile phones, laptops, and PDAs). Resource Pool: The provider's computing resources are pooled and offered to multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically allocated and reallocated according to demand. There is a sense of location independence, and consumers typically have no control over or knowledge of the exact location of the resources offered, although at a higher level of abstraction they may be able to specify a location (e.g., country, state, or data center). Rapid Elasticity: Capacity is quickly and elastically provisioned, sometimes automatically, and can be quickly scaled out and quickly released to quickly scale in. Capacity available for provisioning often appears to consumers as unlimited, available for purchase in any quantity at any time. Metered Services: Cloud systems leverage metering capabilities to automatically control and optimize resource usage at an abstraction level appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of utilized services.

[0027] The service model is as follows: SaaS (Software as a Service): The consumer is provided with the ability to use the provider's applications running on a cloud infrastructure. Those applications can be accessed from a variety of client devices through a thin-client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even individual application functionality, except for the possibility of setting limited user-specific application configuration settings. PaaS (Platform as a Service): The ability offered to a consumer is to deploy applications they create or acquire, written using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, or storage, but does have control over the deployed applications and, in some cases, the configuration of the application hosting environment. Infrastructure as a Service (IaaS): The capability provided to a customer is the provisioning of processing, storage, network, and other basic computing resources, over which the customer can deploy and run any software, which may include operating systems and applications. The customer does not manage or control the underlying cloud infrastructure, but does have control over the operating systems, storage, and deployed applications, and in some cases, limited control over selected network components (e.g., host firewalls).

[0028] The deployment model is as follows: Private Cloud: This cloud infrastructure is operated solely for one organization and can be managed by that organization or a third party, and can reside on-premise or off-premise. Community Cloud: This cloud infrastructure is shared by multiple organizations to support a specific community with shared interests (e.g., mission, security requirements, policy, and compliance considerations). It can be managed by these organizations or a third party and can reside on-premises or off-premises. Public Cloud: This cloud infrastructure is available for use by the general public or large industry organizations and is owned by an organization that sells cloud services. Hybrid cloud: This cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain distinct but are joined together by standardized or proprietary technologies that allow for data and application portability (e.g., cloud bursting to balance load between clouds).

[0029] A cloud computing environment is a service-oriented environment that emphasizes statelessness, loose coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure that contains a network of interconnected nodes.

[0030] Referring now to FIG. 1 , an exemplary cloud computing environment 50 is shown. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud consumers (e.g., a personal digital assistant (PDA) or mobile phone 54A, a desktop computer 54B, a laptop computer 54C, or an automobile computer system 54N, or combinations thereof) can communicate. The nodes 10 may communicate with each other. The nodes 10 may be physically or virtually grouped in one or more networks, such as a private cloud, a community cloud, a public cloud, or a hybrid cloud, or combinations thereof, as previously described herein (not shown). This enables the cloud computing environment 50 to provide an infrastructure, platform, or SaaS, or combinations thereof, that does not require the cloud consumer to maintain resources on their local computing devices. The types of computing devices 54A-N shown in FIG. 1 are intended to be illustrative only, and it is understood that computing node 10 and cloud computing environment 50 can communicate with any type of computer-controlled device via any type of network and / or network-addressable connection (e.g., a connection using a web browser).

[0031] Referring now to Figure 2, a set of functional abstraction layers provided by cloud computing environment 50 (Figure 1) is shown. It should be understood in advance that the components, layers, and functions shown in Figure 2 are intended to be illustrative only and that aspects of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0032] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include a mainframe 61, a reduced instruction set computer (RISC) architecture-based server 62, a server 63, a blade server 64, a storage device 65, and a network and network components 66. In some embodiments, the software components include network application server software 67 and database software 68.

[0033] The virtualization layer 70 comprises an abstraction layer capable of providing virtual entities such as virtual servers 71, virtual storage 72, virtual networks including virtual private networks 73, virtual applications and operating systems 74, and virtual clients 75.

[0034] By way of example, the management layer 80 may provide the following functions: Resource provisioning 81 dynamically procures computing and other resources used to execute tasks within the cloud computing environment; Metering and pricing 82 tracks costs as resources are utilized within the cloud computing environment and generates and sends bills for the use of those resources; by way of example, those resources may include application software licenses; Security verifies the identity of cloud users and tasks and protects data and other resources; User portal 83 provides users and system administrators with access to the cloud computing environment; Service level management 84 allocates and manages cloud computing resources to meet required service levels; and Service level agreement (SLA) planning and execution 85 proactively prepares and procures cloud computing resources in accordance with SLAs in anticipation of upcoming demand.

[0035] The Workload Layer 90 illustrates examples of functionality available in a cloud computing environment. Examples of workloads and functionality that may be provided from this layer include mapping and navigation 91, software development and lifecycle management 92, virtual classroom instruction delivery 93, data analytics processing 94, transaction processing 95, and secure deduplication of multiple keys using locked fingerprints 96.

[0036] Traditional data reduction techniques, such as deduplication and / or compression, do not provide meaningful reductions when applied to encrypted data. Deduplication of multiple data sets, each encrypted with a unique encryption key, fails when different encryption algorithms prevent duplicate data chunks from being identified by traditional deduplication processes. Traditional data reduction techniques also do not provide sufficient data confidentiality between clients and storage systems.

[0037] The KYOK (keep your own key) approach to secure deduplication achieves deduplication of encrypted data without having access to any other client's encryption keys. Data from one client's key can be deduplicated against other data under that key. Various aspects of the present disclosure provide users with different user keys with the benefits of deduplication across a set of keys while providing data confidentiality between users. The present disclosure enables secure deduplication of encrypted data using fingerprints encrypted with unique user keys without the storage system having access to a shared key or user keys and without sharing user keys between users.

[0038] At least some aspects of the present disclosure provide additional capabilities for secure deduplication with KYOK, enabling clients to encrypt data with multiple keys. Various aspects improve KYOK deduplication by increasing the set of data on which deduplication can operate. Various techniques described herein maintain data confidentiality and improve data confidentiality compared to traditional encryption and / or deduplication techniques. Various operations of multi-key encrypted data deduplication using locked fingerprints achieve relatively better data reduction than traditional fully client-side encryption and less client overhead than client-side deduplication.

[0039] Various aspects of the present disclosure enable data deduplication for encrypted data without the deduplication layer having access to the encryption key. When data is encrypted at the host, data security is enhanced and the data encryption key is not shared with the storage. In conventional systems, the ability to deduplicate data, compress data, or both, is significantly reduced after the data is encrypted. In stark contrast, at least some aspects of the present disclosure enable data deduplication for encrypted data that utilizes locked fingerprints created with different keys to provide cryptographic separation. An advantage provided by various aspects described herein is that substantially no information is leaked to data owners during deduplication, while improving data confidentiality and data integrity.

[0040] Deduplication of encrypted data has been a problem for the storage industry for at least the reasons described herein. Conventional techniques for deduplication of encrypted data include convergent or deterministic encryption, in which identical plaintext data is encrypted to produce identical ciphertext. Furthermore, conventional convergent encryption does not provide the ability to deduplicate data encrypted with different keys because identical plaintext encrypted with different keys does not produce identical ciphertext. In conventional deduplication processes, when a host system sends encrypted data to a storage system, deduplication using identical plaintext data encrypted with different keys fails (e.g., no deduplication occurs) because these conventional processes do not create identical ciphertext for identical plaintext inputs. Conventional convergent encryption is a form of encryption that creates identical ciphertext for identical plaintext inputs but does not allow for different keys to provide cryptographic isolation between users. The present disclosure enables deduplication of encrypted data with this convergent property while requiring different keys for decryption.

[0041] At least some of the operations described herein may be used in conjunction with symmetric key encryption or asymmetric encryption (e.g., public key infrastructure (PKI)), or both. It should be understood by those skilled in the art that PKI encryption may be performed according to any arrangement known in the art. For example, public keys in a PKI are not private keys; encrypting data with a public key requires the corresponding private key for decryption.

[0042] Throughout various aspects of this disclosure, a client may refer to a process, user, or other entity having distinct data access privileges. As one skilled in the art will appreciate, a host system may include any number of users who write / read data to a storage system through the host system. In various aspects, it is assumed that all communication between disparate components occurs over mutually authenticated, secure (e.g., encrypted) sessions.

[0043] Figure 3 is a diagram of a high-level architecture according to various configurations. Architecture 300 may be implemented in accordance with the present invention in a variety of configurations, particularly in any of the environments shown in Figures 1-2 and 4-6. Of course, architecture 300 may include more or fewer elements than those specifically illustrated in Figure 3, as one of ordinary skill in the art will understand upon reading this description.

[0044] Architecture 300 illustrates an exemplary technique for secure deduplication of encrypted data using fingerprints encrypted with a unique user key. Architecture 300 illustrates an exemplary write operation for secure deduplication. Architecture 300 includes a host system 302 and a storage system 304. Storage system 304 may be any type of storage system known in the art. It should be understood by those skilled in the art that storage system 304 may include more or fewer components than those illustrated herein. Storage system 304 preferably performs the various deduplication operations described herein.

[0045] In various aspects, storage system 304 is configured to perform data deduplication using any data deduplication technique known in the art. Storage system 304 preferably performs deduplication on input data chunks by computing a fingerprint for the data and checking whether the fingerprint of one data chunk matches the fingerprint of another data chunk, as described in further detail below. In response to determining that the fingerprints of the data chunks match, the data chunk may be deduplicated (e.g., only one copy of the data chunk is stored, and all other data chunks with matching fingerprints point to the stored data chunk, in a manner known in the art).

[0046] Host system 302 includes key group 306 (e.g., a set of keys). Key group 306 includes base key kb 308, fingerprint key kf 310, and user keys k0 312, k1 314, and k2 316. Deduplication is allowed between data written by owners of user keys k0 312, k1 314, and k2 316 that belong to key group 306. Deduplication is not allowed between data written with keys that do not belong to key group 306. In various aspects, the fingerprint key and base key are shared among users in the key group. User keys are not shared among users in the key group. In various aspects, deduplication is not allowed for data written as plaintext.

[0047] For write operation 318, write data 320 is passed to chunker 322. Chunker 322 divides write data 320 into data chunks. In a preferred embodiment, chunker 322 divides write data 320 into fixed-length data chunks. In other embodiments, chunker 322 divides write data 320 into variable-sized length data chunks in a manner known in the art, taking into account the intended application and / or design. The output data chunks are passed to fingerprint generator 326 in operation 324 and then sent to first fingerprint encrypter / decrypter 330 in operation 328. Fingerprint generator 326 generates a fingerprint for the data chunk in a manner known in the art. In a preferred embodiment, fingerprint generator 326 calculates the fingerprint using any cryptographic hash algorithm known in the art, including MD5, SHA-1, SHA-256, etc. First fingerprint encryptor / decryptor 330 encrypts and / or decrypts the fingerprint using fingerprint key kf 310 in a manner known in the art. In a preferred embodiment, first fingerprint encryptor / decryptor 330 encrypts and / or decrypts the fingerprint using fingerprint key kf 310 to generate an encrypted fingerprint.

[0048] In various embodiments, the fingerprint is calculated using a keyed hash message authentication code (HMAC). HMAC is defined in RFC 2104 and is a function of a key, a message, and a cryptographic hash. The HMAC effectively calculates a fingerprint of a message encrypted by a key. As shown in FIG. 3, the HMAC may combine a fingerprint generated by a fingerprint generator 326 and a cryptographic element (e.g., an encrypted fingerprint) encrypted by a first fingerprint encryptor / decryptor 330. The HMAC message is the plaintext of the data chunk (e.g., as the data chunk is passed in operation 324), and the key is the fingerprint key kf 310.

[0049] At operation 332, the encrypted fingerprint is sent to a second fingerprint encryptor / decryptor 334 for further encryption with a user key, which is preferably a key that is not shared with other users in the key group. As shown, the user (e.g., performing the write operation) is associated with user key k1 314, and second fingerprint encryptor / decryptor 334 encrypts the encrypted fingerprint with user key k1 314 in a manner known in the art to generate a doubly encrypted fingerprint. In various aspects, the doubly encrypted fingerprint may be referred to interchangeably as a "locked fingerprint."

[0050] In at least some approaches, in the case of fixed block storage, the logical block address of a plaintext block (e.g., of write data 320) is used as an initialization vector (IV) (or, e.g., a “tweak” in a tunable cipher mode) for user key encryption of the encrypted fingerprint. As shown in FIG. 3, in operation 333, the logical block address may be sent to a second fingerprint encryptor / decryptor 334 to be used as the IV. In at least some aspects, AES-XTS style encryption may be used. AES-XTS encryption provides protection against an attacker moving encrypted chunks from one location to another.

[0051] As shown in Figure 3, in operation 336, the doubly encrypted fingerprint (e.g., the locked fingerprint, which is a fingerprint of the data chunk encrypted with a fingerprint key and then encrypted with a user key) is sent to metadata storage 338. As shown in Figure 3, in one approach, metadata storage 338 is stored on a separate storage device, separate from data storage 340. In another approach, metadata storage 338 may be combined with data storage 340.

[0052] In some approaches, in operation 342, data chunks of write data 320 are sent to a compression unit 344. Compression unit 344 compresses the data in a manner known in the art to produce identical compressed outputs for identical inputs. In operation 346, the compressed data chunks are sent to a data encryptor / decryptor 348. Data encryptor / decryptor 348 may be of the AES-XTS type. In an alternative approach, the data encryption performed by the data encryptor / decryptor 348 can be nested, where an input data chunk of write data 320 is first encrypted using the base key kb 308 or the encrypted fingerprint (output by the first fingerprint encryptor / decryptor 330 and sent to the data encryptor / decryptor 348 in operation 350) as a fingerprint key, and then the data chunk is further encrypted using the other of the base key kb 308 or the encrypted fingerprint as an encryption key. In one approach, the base key kb 308 is used as the encryption key, and the encrypted fingerprint sent in operation 350 is used as the IV, in a manner known in the art. The output ciphertext data chunk is sent to the data storage 340 in operation 352.

[0053] As previously mentioned, in a preferred embodiment, the data encryptor / decryptor 348 operates in a manner in which both the base key kb 308 and the encrypted fingerprint are required to decrypt a data chunk and recover the plaintext data chunk. The data encryptor / decryptor 348 has the property that an input data chunk generates an identical encrypted data chunk (e.g., this encrypted data chunk is output at operation 352 and sent to the data storage 340 as described herein). This property allows the storage system 304 to identify data for deduplication purposes (e.g., the storage system 304 can identify "matching" encrypted data chunks for deduplication purposes in a manner known in the art, without the storage system 304 needing to examine the plaintext data (e.g., unencrypted data)).

[0054] The result of writing the input data is that the storage system 304 stores both the encrypted data chunk and the associated doubly encrypted fingerprint (e.g., encrypted with fingerprint key kf 310 in a first fingerprint encryptor / decryptor 330 and then further encrypted with user key kl 314 in a second fingerprint encryptor / decryptor 334). The storage system 304 may store the encrypted data chunk and the associated doubly encrypted fingerprint in a manner that maintains this relationship. For example, the encrypted fingerprint (e.g., the doubly encrypted fingerprint) may be stored in metadata storage 338 that associates the doubly encrypted fingerprint with the encrypted data chunk.

[0055] In another approach, the storage system includes encrypted data chunks and doubly encrypted fingerprints, where "doubly encrypted" refers to the fingerprints being encrypted by a first fingerprint encryptor / decryptor 330 with fingerprint key kf 310 and then by a second fingerprint encryptor / decryptor 334 using AES-XTS style encryption as described herein. In one approach, the storage system 304 is a block store, and the metadata may include the logical block addresses of the data chunks as associated information, in a manner that will be apparent to one of ordinary skill in the art upon reading this disclosure.

[0056] In some approaches, the storage system applies at-rest encryption to the data and / or metadata without affecting the operation of multi-key secure deduplication, in a manner that will be apparent to those skilled in the art upon reading this disclosure. At-rest encryption advantageously provides an additional level of security to the data and / or metadata. For example, an attacker who has gained physical data access (e.g., by stealing a storage device from the storage system) would need to possess the client encryption key, client shared key, client non-shared key, and storage encryption key to circumvent the additional at-rest encryption, as would be understood by those skilled in the art.

[0057] Figure 4 is a diagram of a high-level architecture according to various configurations. Architecture 400 may be implemented in accordance with the present invention in a variety of configurations, particularly in any of the environments shown in Figures 1-3 and 5-6. Of course, architecture 400 may include more or fewer elements than those specifically illustrated in Figure 4, as one of ordinary skill in the art will understand upon reading this description.

[0058] Architecture 400 illustrates an exemplary technique for secure deduplication of encrypted data using fingerprints that are encrypted with a unique user key. Architecture 400 illustrates an exemplary read operation for secure deduplication. Architecture 400 includes a host system 302 and a storage system 304. Storage system 304 may be any type of storage system known in the art. It should be understood by those skilled in the art that storage system 304 may include more or fewer components than those illustrated herein. Storage system 304 preferably performs the various deduplication operations described herein.

[0059] In various aspects, storage system 304 is configured to perform data deduplication using any data deduplication technique known in the art. Storage system 304 preferably performs deduplication on input data chunks by computing a fingerprint for the data and checking whether the fingerprint of one data chunk matches the fingerprint of another data chunk, as described in further detail below. In response to determining that the fingerprints of the data chunks match, the data chunk may be deduplicated (e.g., only one copy of the data chunk is stored, and all other data chunks with matching fingerprints point to the stored data chunk, in a manner known in the art).

[0060] Host system 302 includes key group 306 (e.g., a set of keys). Key group 306 includes base key kb 308, fingerprint key kf 310, and user keys k0 312, k1 314, and k2 316. Deduplication is allowed between data written by owners of user keys k0 312, k1 314, and k2 316 that belong to key group 306. Deduplication is not allowed between data written with keys that do not belong to key group 306. In various aspects, the fingerprint key and base key are shared among users in the key group. User keys are not shared among users in the key group. In various aspects, deduplication is not allowed for data written as plaintext.

[0061] At operation 402, a read request is issued for data. In the case of fixed block storage, data at a set of logical block addresses is read. At operation 404, the read request is passed to data storage 340 to read the data (e.g., the encrypted data chunk associated with the read request), and at operation 406, the read request is passed to metadata storage 338 to read associated metadata (e.g., the doubly encrypted fingerprint associated with the data chunk associated with the read request). At operation 408, the encrypted data chunk is sent to data encryptor / decryptor 348, which decrypts the encrypted data chunk using base key kb 308 and the IV used for encryption / decryption, in a manner that will be understood by those skilled in the art upon reading this disclosure.

[0062] At operation 410, the associated metadata (e.g., the doubly encrypted fingerprint associated with the encrypted data chunk) is sent to the second fingerprint encryptor / decryptor 334, which decrypts the doubly encrypted fingerprint using the user key k1 314 in a manner that will be understood by those skilled in the art upon reading this disclosure to generate an encrypted fingerprint (e.g., a singly encrypted fingerprint encrypted with the fingerprint key kf 310). The second fingerprint encryptor / decryptor 334 may encrypt or decrypt the data fingerprint with the appropriate user key (e.g., the user associated with the data), as will be understood by those skilled in the art upon reading this disclosure. For example, if the user possesses user key k1 314, the second fingerprint encryptor / decryptor 334 decrypts the doubly encrypted fingerprint using user key k1 314 to retrieve the encrypted fingerprint. In various approaches, in operation 412, location information of the data chunk (e.g., a logical block address in fixed block storage) is sent to the second fingerprint encryptor / decryptor 334, and the location information is the IV used for encryption / decryption.

[0063] At operation 414, the encrypted fingerprint (e.g., the solely encrypted fingerprint) output by the second fingerprint encryptor / decryptor 334 is sent as an IV to the data encryptor / decryptor 348. The data encryptor / decryptor 348 uses the base key kb 308 as the decryption key and outputs the data chunk at operation 416.

[0064] Optionally, decompression techniques are used to decompress the data chunks using a decompression unit 418 to provide plaintext data chunks in a manner that would be understood by one of ordinary skill in the art upon reading this disclosure. At operation 420, the plaintext data chunks are sent to a dechunker 422.

[0065] At operation 424, end-to-end data integrity may be tested by sending the output data chunk to a fingerprint generator 326. The fingerprint generator 326 operates in conjunction with the first fingerprint encryptor / decryptor 330 as described above with reference to FIG. 3 for a write operation. The fingerprint generator 326 generates an encrypted fingerprint of the decrypted data chunk. At operation 428, this generated encrypted fingerprint is sent to a comparator 426. At operation 430, the other encrypted fingerprint (output by the second fingerprint encryptor / decryptor 334) is sent to the comparator 426. The comparator 426 compares the encrypted fingerprints in a manner known in the art. The two values ​​of the encrypted fingerprints should be identical in the absence of errors and / or tampering, as will be apparent to those skilled in the art upon reading this disclosure. At operation 432, the results of the comparison are sent to dechunker 422. If the comparison is successful (e.g., the encrypted fingerprints match), dechunker 422 may forward the read data 434 to the user in response to the read request, in a manner known in the art. If the comparison is unsuccessful, an error may be output, in a manner known in the art, and the data is not forwarded. The system may take appropriate action, including further determination techniques to identify whether the mismatch was the result of error, tampering, attack, etc. The system may attempt to recover the data by other means, such as replication, erasure coding, etc., if recovery techniques are available.

[0066] Referring now to Figure 5, a flowchart of a method 500 is shown according to one embodiment. Method 500 may be performed in accordance with the present invention in various embodiments, particularly in any of the environments shown in Figures 1-4 and 6. Of course, method 500 may include more or fewer operations than those specifically illustrated in Figure 5, as one of ordinary skill in the art will understand upon reading this description.

[0067] Each of the steps of method 500 may be performed by any suitable component of an operating environment. For example, in various aspects, method 500 may be performed, in part or in whole, by a computer or other device including one or more processors. A processor (e.g., a processing circuit, chip, or module, or a combination thereof) implemented in hardware or software, or both, and preferably including at least one hardware component, may be utilized within any device to perform one or more steps of method 500. Examples of processors include, but are not limited to, a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or the like, combinations thereof, or any other suitable computing device known in the art.

[0068] As shown in FIG. 5, method 500 includes operation 502. Operation 502 includes calculating a fingerprint of a data chunk. In various aspects, in response to a write request, write data may be divided into data chunks in any manner known in the art. The data chunks may be fixed length or variable length. A fingerprint is calculated for each data chunk according to any cryptographic hash algorithm known in the art, including MD5, SHA-1, SHA-256, etc. The fingerprint of the data chunk may be calculated in any manner known in the art.

[0069] Operation 504 includes encrypting the fingerprint with a fingerprint key. In a preferred embodiment, the fingerprint key is part of a key group on the host system. The key group may include a fingerprint key, a base key, and at least one user key. In a preferred embodiment, the fingerprint key and the base key are shared among users of the key group to allow deduplication of data written with any of the keys in the key group. The user keys are not shared among users of the key group. As will be apparent to those skilled in the art upon reading this disclosure, deduplication is preferably allowed among data written by owners of user keys belonging to the key group. As will be apparent to those skilled in the art upon reading this disclosure, the fingerprint key encryptor may encrypt the fingerprint with the fingerprint key.

[0070] In some approaches, operations 502 and 504 may be substantially combined into one process. For example, calculating the fingerprint and encrypting the fingerprint may be part of an HMAC, where the HMAC message is the plaintext of the data chunk and the encryption key is the fingerprint key.

[0071] Operation 506 includes encrypting the data chunks using a base key and the encrypted fingerprint. The base key may belong to a key group, as described above. As one skilled in the art would understand upon reading this disclosure, encrypting the data chunks using the base key and the encrypted fingerprint preferably includes using the base key as an encryption key and using the encrypted fingerprint as a first initialization vector.

[0072] In one approach, the data chunks may be compressed using any data compression technique known in the art before encryption using the base key and the encrypted fingerprint. In some approaches, various compression techniques may be applied before or after chunking, or both. In one configuration, the pre-chunking compression may be a type of compression that improves chunking performance. In another configuration, the post-chunking compression may be tailored toward minimizing the resulting chunk size.

[0073] In a preferred embodiment, both the base key and the encrypted fingerprint are required to decrypt a data chunk (e.g., to recover a plaintext data chunk in response to a read request). Identical data chunks produce identical encrypted data chunks (e.g., data chunks encrypted using the base key and the encrypted fingerprint). This property allows a storage system to identify data for deduplication purposes, as will be apparent to those skilled in the art upon reading this disclosure.

[0074] Act 508 includes encrypting the encrypted fingerprint with a user key to generate a doubly encrypted fingerprint. In various aspects, a doubly encrypted fingerprint may be referred to interchangeably as a "locked fingerprint." In a preferred aspect, the user key is a member of a key group that enables deduplication of data written with a key belonging to the key group, as described above. The user key is preferably a key that is not shared with other users belonging to the key group (e.g., other users whose user keys are part of the key group). In various aspects, a doubly encrypted fingerprint refers to a fingerprint that is first encrypted with a fingerprint key (e.g., to generate an encrypted fingerprint, as in act 504) and then encrypted again (e.g., the encrypted fingerprint is encrypted) with the user key (e.g., to generate the doubly encrypted fingerprint).

[0075] In one optional approach, encrypting the encrypted fingerprint with a user key to generate a doubly encrypted fingerprint includes using a logical block address as a second initialization vector, in a manner that would be understood by one of ordinary skill in the art upon reading this disclosure. The logical block address is preferably the logical block address of a data chunk. In at least some approaches, the logical block address may include a set of logical block addresses associated with the data chunk. In various aspects, the logical block address may be used as an initialization vector to prevent a hardened criminal from reading data by substituting false or displaced data within the storage system. The logical block address as an initialization vector allows for additional validation of the location of the data being written / read. For example, if the storage system attempts to return data from an incorrect location in response to a read request, the substitution will not work because this location (e.g., the logical block address) is part of the encryption.

[0076] Operation 510 includes transmitting the encrypted data chunks and the doubly encrypted fingerprint to a storage system. The storage system does not have access to any of the base key, fingerprint key, or user key. The encrypted data chunks and the doubly encrypted fingerprint may be transmitted to the storage system in a manner known in the art. The storage system is configured to identify data for deduplication purposes. For example, the storage system can identify “matching” encrypted data chunks for deduplication in a manner known in the art, even though the storage system does not see cleartext data (e.g., unencrypted data) and does not have access to any of the keys in the key group.

[0077] The storage system may store the encrypted data chunks and the associated doubly encrypted fingerprint in a manner that maintains this relationship. For example, the encrypted fingerprint (e.g., the doubly encrypted fingerprint) may be stored in metadata storage that associates the doubly encrypted fingerprint with the data chunk. In one approach, the metadata storage for the doubly encrypted fingerprint is stored separately from the data storage for the encrypted data chunks (e.g., on a separate storage device). In another approach, the metadata storage may be combined with the data storage. If the storage system does not have access to any of the fingerprint keys, base keys, and user keys, there is little or no risk in combining the storage of the encrypted data chunks and the doubly encrypted fingerprint. Preferably, the storage system does not have access to any of the shared keys. The storage system does not have access to any of the non-shared keys (e.g., user keys).

[0078] In another approach, the storage system includes encrypted data chunks and doubly encrypted fingerprints, where "doubly encrypted" refers to fingerprints that are encrypted with a fingerprint key and then encrypted with AES-XTS style encryption as described herein. In one approach, the storage system is a block store, and the metadata may include logical block addresses of the data chunks as association information, in a manner that will be apparent to one of ordinary skill in the art upon reading this disclosure.

[0079] In an exemplary embodiment, a first user may store data using a first user key k0, and a second user may store the same data using a second user key k1. User keys k0 and k1 are part of the same key group. The fingerprints and data chunks are encrypted and stored as described in detail above. In this exemplary embodiment, the common encrypted data chunks are deduplicated within the storage system, and the first user and the second user each store a doubly encrypted fingerprint in the storage system (each doubly encrypted fingerprint is encrypted using the first user key k0 and the second user key k1, respectively). In response to read requests to the storage system, the first user and the second user may each retrieve the common encrypted data chunk and decrypt the encrypted data chunks and their doubly encrypted fingerprints using the user keys associated with those users. A third user using the third user key k2 will not be able to decrypt the encrypted data chunk (which is common between the first and second users), and the third user will not have access to the correct user key to decrypt either of the doubly encrypted fingerprints, even if the third user is part of a key group that shares the fingerprint key and the base key.

[0080] In various approaches, a storage system may receive a read request for data stored on the storage system. In response to the read request, the storage system may return the encrypted data chunk and the doubly encrypted fingerprint associated with the read request to the host system requesting the data. The host system decrypts the doubly encrypted fingerprint using a user key to generate an encrypted fingerprint (e.g., a singly encrypted fingerprint encrypted with a fingerprint key). The encrypted fingerprint is used as an IV by the host system, along with the base key as the decryption key, to output the decrypted data chunk. In optional aspects, the data chunk may be decompressed. In various approaches, a fingerprint may be calculated for the output data chunk in the manner described above, and the calculated fingerprint may be compared to the encrypted fingerprint (e.g., a singly encrypted fingerprint encrypted with a fingerprint key) to test end-to-end data integrity. In the absence of errors and tampering, the two encrypted fingerprints should be identical. If the encrypted fingerprints match, the data may be returned, as would be apparent to one of ordinary skill in the art upon reading this disclosure. The host system may take appropriate action, including further determination techniques to identify whether the mismatch was the result of error, tampering, attack, etc. The host system may attempt to recover the data by other means, such as replication, erasure coding, etc., if recovery techniques are available.

[0081] Referring now to Figure 6, a flowchart of a method 600 is shown according to one embodiment. Method 600 may be performed in accordance with the present invention in various embodiments, particularly in any of the environments shown in Figures 1-5. Of course, method 600 may include more or fewer operations than those specifically illustrated in Figure 6, as one of ordinary skill in the art will understand upon reading this description.

[0082] Each of the steps of method 600 may be performed by any suitable component of an operating environment. For example, in various aspects, method 600 may be performed, in part or in whole, by a computer or other device including one or more processors. A processor (e.g., a processing circuit, chip, or module, or a combination thereof) implemented in hardware or software, or both, and preferably including at least one hardware component, may be utilized within any device to perform one or more steps of method 600. Exemplary processors include, but are not limited to, a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or the like, combinations thereof, or any other suitable computing device known in the art.

[0083] As shown in FIG. 6 , method 600 includes operation 602. Operation 602 includes calculating a fingerprint of a data chunk. In various aspects, in response to a write request, write data may be divided into data chunks in any manner known in the art. The data chunks may be fixed length or variable length. A fingerprint is calculated for each data chunk according to any cryptographic hash algorithm known in the art, including MD5, SHA-1, SHA-256, etc. The fingerprint of the data chunk may be calculated in any manner known in the art.

[0084] Operation 604 includes encrypting the data chunks using the base key and the fingerprint. In a preferred embodiment, the base key is part of a key group on the host system. The key group may include the base key and at least one user key. In a preferred embodiment, the base key is shared among users of the key group to enable deduplication of data written with keys belonging to the key group. As one skilled in the art would understand upon reading this disclosure, encrypting the data chunks using the base key and the fingerprint preferably includes using the base key as an encryption key and using the fingerprint as a first initialization vector.

[0085] In various embodiments, encrypting the data using the base key and fingerprint as the IV uses AES encryption in XTS mode. Encrypting the data using the base key and fingerprint as the IV implicitly uses XTS mode to encrypt the IV as part of encrypting the data chunk. As will be apparent to those skilled in the art upon reading this disclosure, the fingerprint (e.g., the unencrypted fingerprint used as the input IV to encrypt the data chunk) remains unencrypted.

[0086] Operation 606 includes encrypting the fingerprint with a user key. In a preferred embodiment, the user key is a member of a key group that, as described above, enables deduplication of data written with a key belonging to the key group. The user key is preferably a key that is not shared with other users that belong to the key group (e.g., other users whose user keys are part of the key group). Encrypting the fingerprint with the user key, as in operation 606, preferably generates an encrypted fingerprint, which is encrypted (e.g., solely encrypted) with the user key. In these approaches, encrypting the fingerprint with the user key and generating the solely encrypted fingerprint may include using a logical block address associated with the data chunk as a second initialization vector for encryption of the fingerprint using the user key, in a manner that will be apparent to those skilled in the art upon reading this disclosure.

[0087] Operation 608 includes sending the encrypted data chunks and the encrypted fingerprint to a storage system. The storage system does not have access to either the base key or the user key. The encrypted data chunks and the encrypted fingerprint may be sent to the storage system in a manner known in the art. The storage system is configured to identify data for deduplication purposes. For example, the storage system can identify "matching" encrypted data chunks for deduplication in a manner known in the art, even though the storage system does not see the cleartext data (e.g., unencrypted data) and does not have access to any of the keys in the key group.

[0088] The storage system may store the encrypted data chunks and the associated encrypted fingerprints in a manner that maintains this relationship. For example, the encrypted fingerprints may be stored in metadata storage that associates the encrypted fingerprints with the data chunks. In one approach, the metadata storage for the encrypted fingerprints is stored separately from the data storage for the encrypted data chunks (e.g., on a separate storage device). In another approach, the metadata storage may be combined with the data storage. If the storage system does not have access to either the base key or the user keys, there is little or no risk in combining the storage of the encrypted data chunks and the encrypted fingerprints. Preferably, the storage system does not have access to any of the shared keys. The storage system does not have access to any of the non-shared keys (e.g., the user keys).

[0089] Advantages of the encryption methods described herein using locked fingerprints include the ability to securely deduplicate encrypted data with enhanced protection from attacks. For example, if a repeat offender attempts to access data in a storage system, even if the repeat offender has access to one of the shared keys (e.g., base key or fingerprint key) used to encrypt the data or fingerprint, the repeat offender cannot access the unencrypted data without access to the initialization vector (e.g., encrypted fingerprint, HMAC, logical block address, etc.) used in the encryption. Furthermore, if the repeat offender has access to a not-shared user key, they must also know the logical block address to decrypt the metadata (e.g., doubly encrypted fingerprint) to access the plaintext data. At least some of the embodiments described herein provide multiple levels of protection and data confidentiality while enabling deduplicating data encrypted with different user keys.

[0090] The present invention may be a system, method, or computer program product, or combination thereof, at any possible level of technical detail of integration. The computer program product may include a computer-readable storage medium containing computer-readable program instructions for causing a processor to perform aspects of the present invention.

[0091] A computer-readable storage medium may be a tangible device that can hold and store instructions for use by an instruction execution device, such as, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer-readable storage media includes portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM, or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge structures in grooves in which instructions are recorded, and any suitable combination of the foregoing. As used herein, computer-readable storage media should not itself be construed as being ephemeral signals such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted over wires.

[0092] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to each computing / processing device or to an external computer or storage device over a network (e.g., the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof). This network may include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface within each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage on a computer-readable storage medium within each computing / processing device.

[0093] Computer-readable program instructions for carrying out operations of the present invention may be source or object code written in any combination of one or more programming languages, including assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for integrated circuits, or object-oriented programming languages ​​such as Smalltalk®, C++, and procedural programming languages ​​such as the "C" programming language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer as a standalone software package, partially on the user's computer and on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, to carry out aspects of the present invention, electronic circuitry including, for example, programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), may execute computer-readable program instructions to customize the electronic circuitry by utilizing state information of the computer-readable program instructions.

[0094] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0095] These computer-readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus to create a machine, where the instructions, executed by the processor of the computer or other programmable data processing apparatus, create means for performing the functions / acts specified in the blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may be stored on a computer-readable storage medium and capable of directing a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner, such that the computer-readable storage medium on which the instructions are stored comprises an article of manufacture containing instructions for performing aspects of the functions / acts specified in the blocks of the flowcharts and / or block diagrams.

[0096] Computer-readable program instructions may be loaded into a computer, other programmable data processing apparatus, or other device such that the instructions, which execute on the computer, other programmable apparatus, or other device, perform the functions / acts specified in the blocks of the flowcharts and / or block diagrams, thereby causing a series of operable steps to be performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process.

[0097] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, comprising one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions shown in the blocks may occur out of the order shown in the figures. For example, two blocks shown in succession may actually be executed as a single step, executed concurrently, executed substantially concurrently in a partially or fully overlapping manner in time, or executed in the reverse order, depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowchart diagrams, and combinations of blocks included in the block diagrams and / or flowchart diagrams, may be implemented by a special-purpose hardware-based system that performs the specified functions or operations or executes a combination of special-purpose hardware and computer instructions.

[0098] Additionally, systems according to various embodiments may include a processor and logic integrated into and / or executable by the processor, configured to perform one or more of the processing steps enumerated herein. By integrated, we mean that the logic is embedded in the processor as hardware logic, such as an application-specific integrated circuit (ASIC), FPGA, etc. By executable by the processor, we mean that the logic is hardware logic accessible by the processor, software logic (such as firmware, part of an operating system, part of an application program, etc.), or some combination of hardware and software logic, configured to cause the processor to perform a function when executed by the processor. The software logic may be stored in any memory type known in the art, local or remote, or both. Any processor known in the art may be used, such as a software processor module and / or hardware processor, such as an ASIC, FPGA, central processing unit (CPU), integrated circuit (IC), or graphics processing unit (GPU).

[0099] It will be apparent from the description provided above that multiple combinations may be made and the various features of the above described systems and / or methods may be combined in any manner.

[0100] It will further be appreciated that embodiments of the present invention may be provided in the form of a service that is deployed for customers to provide the service on demand.

[0101] The description of various embodiments of the present invention is presented for illustrative purposes, but is not intended to be exhaustive and is limited to the disclosed embodiments. It will be apparent to those skilled in the art that many changes and modifications are possible without departing from the scope of the described embodiments. The terms used in this specification are selected to best explain the principles, practical applications, or technical improvements of the embodiments beyond those found in the market, or to enable other skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method executed by information processing on a computer, comprising: calculating a fingerprint of the data chunk; encrypting the fingerprint using a fingerprint key; encrypting the data chunks using a base key associated with a plurality of user keys and the encrypted fingerprint; encrypting the encrypted fingerprint with a user key of the plurality of user keys to generate a doubly encrypted fingerprint; sending the encrypted data chunk and the doubly encrypted fingerprint to a storage system; wherein the storage system does not have access to the base key, the fingerprint key, and the plurality of user keys.

2. 2. The method of claim 1, wherein computing the fingerprint and encrypting the fingerprint are performed using a keyed-hash message authentication code.

3. 3. The method of claim 1, wherein encrypting the data chunks with the base key and the encrypted fingerprint comprises encrypting the data chunks using the encrypted fingerprint as a first initialization vector.

4. 4. The method of claim 1, wherein encrypting the encrypted fingerprint with the one user key to generate the doubly encrypted fingerprint includes using a logical block address as a second initialization vector.

5. The method of any one of claims 1 to 4, wherein the storage system is configured to perform a deduplication operation on the encrypted data chunks.

6. A method executed by information processing on a computer, comprising: calculating a fingerprint of the data chunk; encrypting the data chunks using a base key associated with a plurality of user keys and the fingerprint; encrypting the fingerprint using a user key of the plurality of user keys; sending the encrypted data chunk and the encrypted fingerprint to a storage system; wherein the storage system does not have access to the base key and the plurality of user keys.

7. 7. The method of claim 6, wherein encrypting the data chunks with the base key and the fingerprint comprises encrypting the data chunks using the fingerprint as a first initialization vector.

8. 8. The method of claim 6 or 7, wherein encrypting the fingerprint with the one user key to generate an encrypted fingerprint includes using a logical block address as a second initialization vector.

9. The method of any one of claims 6 to 8, wherein the storage system is configured to perform a deduplication operation on the encrypted data chunks.

10. The method of any one of claims 6 to 9, wherein the base key is used to encrypt the data chunks, and the fingerprint uses AES encryption in XTS mode.

11. A computer program for causing a computer to execute the method according to any one of claims 1 to 10.

12. A computer-readable storage medium having recorded thereon the computer program of claim 11.

13. a processor; logic integrated with, executable by, or integrated with and executable by said processor; and wherein the logic comprises: calculating a fingerprint of the data chunk; encrypting the fingerprint using a fingerprint key; encrypting the data chunks using a base key associated with a plurality of user keys and the encrypted fingerprint; encrypting the encrypted fingerprint with a user key of the plurality of user keys to generate a doubly encrypted fingerprint; sending the encrypted data chunk and the doubly encrypted fingerprint to a storage system; wherein the storage system does not have access to the base key, the fingerprint key, and the plurality of user keys.

14. a processor; logic integrated with, executable by, or integrated with and executable by said processor; and wherein the logic comprises: calculating a fingerprint of the data chunk; encrypting the data chunks using a base key associated with a plurality of user keys and the fingerprint; encrypting the fingerprint using a user key of the plurality of user keys; sending the encrypted data chunk and the encrypted fingerprint to a storage system; wherein the storage system does not have access to the base key and the plurality of user keys.

Images