Deduplication-Aware Per-Tenant Encryption for Multi-Tenant Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant storage environments, deduplication of data encrypted with unique tenant keys is challenging, leading to inefficiencies in storage and processing due to the difficulty in identifying and managing duplicate data blocks across tenants.
Innovation Solution
Implementing deduplication-aware per-tenant encryption that uses hash functions to identify duplicate data blocks and allows for efficient storage and processing by replacing duplicate blocks with pointers, thereby increasing storage and processing efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If per-tenant encryption is implemented in a multi-tenant storage system, then data security and isolation between tenants are improved, but deduplication capability deteriorates because encrypted data with unique tenant keys cannot be efficiently compared for duplicates
Solution Approach 1:
The patent segments the deduplication process into two independent stages: (1) deduplication of plaintext data blocks before encryption, and (2) deduplication of ciphertext blocks using encryption-agnostic hashing. This segmentation allows each stage to operate independently without compromising security or efficiency
Solution Approach 2:
The patent performs deduplication operations on plaintext data blocks before encryption is applied. By conducting the comparison and duplicate identification in advance, the system eliminates redundant encrypted data without needing to compare encrypted blocks, thus preserving both security and deduplication capability
2Quantity of substance
If deduplication is performed on encrypted data, then storage efficiency is improved, but processing complexity increases due to the difficulty of identifying duplicate blocks with unique encryption keys
Solution Approach 1:
Instead of attempting to deduplicate encrypted data directly (the conventional approach), the patent inverts the process by deduplicating plaintext data before encryption. This inversion simplifies the processing complexity while achieving the same storage efficiency goals
Solution Approach 2:
The patent introduces plaintext data blocks as an intermediary between the original data and the encrypted storage. By performing deduplication on this intermediary form before encryption, the system avoids the complexity of comparing encrypted blocks while maintaining storage efficiency
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
Enhances storage efficiency by allowing deduplication of previously undeduplicable data, increasing storage capacity and processing efficiency by managing duplicate data blocks effectively across tenants.
Implementation Method 1
The deduplication map may include a hash value and an offset for each data block
Data Source
AI summary
A method includes receiving a request to write a data block to a volume resident on a multi-tenant storage array, wherein the request is associated with a first tenant of the multi-tenant storage array, and determining whether the data block matches an existing data block on the multi-tenant storage array, wherein the existing block corresponds to a second tenant. In response to determining that the decrypted data block matches the existing data block: encrypting the existing data block with a shared volume encryption key; encrypting the shared volume encryption key with a first tenant encryption key and providing the shared volume encryption key encrypted with the first tenant encryption key to the first tenant; and encrypting the shared volume encryption key with a second tenant encryption key and providing the shared volume encryption key encrypted with the second tenant encryption key to the second tenant.