Deduplication-Aware Per-Tenant Encryption for Multi-Tenant Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant storage environments, deduplication is challenging when each tenant requires unique encryption, as it complicates the deduplication process and reduces storage efficiency.
Innovation Solution
Implementing deduplication-aware per-tenant encryption, which uses a hash function to identify duplicate data blocks and allows for unique encryption keys per tenant, enabling efficient data deduplication while maintaining security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If per-tenant encryption is implemented with unique encryption keys for each tenant, then data security is improved, but deduplication capability deteriorates
Solution Approach 1:
The patent segments the encryption approach by using tenant-specific encryption keys only for metadata (such as hash values) while keeping data blocks unencrypted or using a different encryption scheme. This allows deduplication to function on the unencrypted data blocks while still providing security through encrypted metadata verification
Solution Approach 2:
Different encryption approaches are applied to different parts of the data structure: data blocks use one approach (or no encryption) while metadata uses tenant-specific encryption. This local differentiation allows deduplication to operate effectively on data blocks while security is maintained through encrypted metadata
2Quantity of substance
If deduplication is implemented across all tenants, then storage efficiency is improved, but tenant data isolation and security deteriorate
Solution Approach 1:
The patent segments the deduplication process into tenant-specific deduplication contexts where each tenant's data is deduplicated independently using their own encryption key for metadata verification. This prevents cross-tenant data exposure while maintaining storage efficiency within each tenant's data set
Solution Approach 2:
Tenant-specific encryption keys act as intermediaries that enable secure deduplication verification for each tenant without exposing other tenants' data. The encrypted metadata serves as a mediator that proves data uniqueness within a tenant's context without revealing the actual data content to other tenants
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This approach increases storage and processing efficiency by allowing deduplication of previously undeduplicable data, enhancing storage capacity and reducing redundant operations.
Implementation Method 1
uses a hash function to identify duplicate data blocks
Data Source
AI summary
A method includes receiving a request to write a data block to a volume resident on a multi-tenant storage array, wherein the request is associated with a first tenant of the multi-tenant storage array, and determining whether the data block matches an existing data block on the multi-tenant storage array, wherein the existing block corresponds to a second tenant. In response to determining that the decrypted data block matches the existing data block: encrypting the existing data block with a shared volume encryption key; encrypting the shared volume encryption key with a first tenant encryption key and providing the shared volume encryption key encrypted with the first tenant encryption key to the first tenant; and encrypting the shared volume encryption key with a second tenant encryption key and providing the shared volume encryption key encrypted with the second tenant encryption key to the second tenant.