Downstream Decrypter for Encrypted Data Storage Efficiency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
End-to-end encryption limits storage efficiency functions, as encrypted data maximizes entropy, preventing compression and deduplication due to varying ciphertexts across different files or locations.
Innovation Solution
A decrypter is employed downstream in the data path to decrypt encrypted data blocks using associated encryption keys, allowing for storage efficiency functions like compression and deduplication, followed by re-encryption, all within a trusted environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If end-to-end encryption is applied to data before storage, then data security is improved, but storage efficiency deteriorates due to inability to perform compression and deduplication
Solution Approach 1:
A decrypter component is introduced as an intermediary in the data path between storage and the external environment. This decrypter receives encrypted data blocks, decrypts them using associated encryption keys, applies storage efficiency functions to the decrypted data, and stores the processed data. This intermediary enables storage efficiency operations on decrypted data while maintaining security through controlled decryption and re-encryption processes.
Solution Approach 2:
The system processes data in discrete data blocks rather than treating encrypted data as an indivisible unit. By segmenting the encrypted data stream into individual blocks, the decrypter can selectively decrypt and process specific blocks through storage efficiency functions while maintaining the overall encryption structure and security model.
2Reliability
If encryption is performed on data blocks from different files or locations, then data security is maintained, but deduplication capability is lost due to different ciphertexts
Solution Approach 1:
The decrypter serves as a mediator that intercepts encrypted data blocks before they are stored or processed further. It decrypts the blocks using associated encryption keys, allowing the system to identify and deduplicate identical plaintext data regardless of its original location or file, thereby improving storage capacity utilization while maintaining security through controlled decryption.
Solution Approach 2:
By decrypting data blocks before processing, the system transforms heterogeneous ciphertexts (which appear different due to encryption variations) into homogeneous plaintext forms. This allows identical data from different files or locations to be recognized as duplicates and consolidated, improving deduplication effectiveness while maintaining the security model.
Data Source
AI summary
Embodiments of the invention relate to efficiently storing encrypted data in persistent storage or passing to another data processing component. A downstream decrypter is utilized to act within the data path between a data generator and a storage server. The decrypter fetches an encryption key and any other necessary auxiliary information necessary to decrypt received data. Following decryption of the data, the decrypter has the ability to operate directly on plaintext and perform storage efficiency functions on the decrypted data. The decrypter re-encrypts the data prior to the data leaving the decrypter for persistent storage to maintain the security of the encrypted data.