Encryption Key Coordination for Deduplicated Storage Arrays
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing storage systems face challenges in efficiently compressing and deduplicating encrypted data due to encryption applied by the host system, leading to reduced storage efficiency and potential security breaches from transmitting plaintext data over networks.
Innovation Solution
Implementing a coordinated encryption/decryption mechanism between the host system and storage array, using encryption key management and SCSI commands to synchronize encryption/decryption processes, allowing the storage array to decrypt data before deduplication and compression.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the host system encrypts data before transmitting to the storage array, then data security is improved, but deduplication and compression efficiency deteriorates
Solution Approach 1:
The storage array performs deduplication and compression operations on plaintext data before encryption is applied. This preliminary processing of unencrypted data allows the storage system to achieve optimal deduplication and compression efficiency, while the subsequent encryption ensures data security during transmission and storage.
Solution Approach 2:
The patent introduces an intermediary mechanism where the storage array temporarily holds and processes plaintext data through deduplication and compression operations, then applies encryption. This intermediary processing step allows the system to benefit from both efficient data reduction and strong security, as the plaintext exposure is limited to the storage array's processing memory rather than being transmitted over the network.
2Productivity
If the host system transmits plaintext data to the storage array, then deduplication and compression efficiency is improved, but data security deteriorates
Solution Approach 1:
The storage array acts as a secure intermediary that receives plaintext data from the host system, performs deduplication and compression operations internally, then encrypts the processed data before storage. This intermediary approach allows efficient processing of plaintext while maintaining security through controlled encryption within the storage array's secure environment.
Solution Approach 2:
The encryption function is extracted from the host system and placed within the storage array. This allows the host system to transmit plaintext data for efficient processing, while the storage array independently handles encryption, ensuring that security operations occur within the storage system's controlled environment rather than requiring secure transmission channels.
3Reliability
If the storage array processes encrypted data directly, then data security is maintained, but storage efficiency deteriorates
Solution Approach 1:
The storage array performs deduplication and compression operations as preliminary actions on plaintext data before encryption is applied to the processed result. This sequence allows the storage array to achieve optimal storage efficiency by processing unencrypted data, then maintains security by encrypting the reduced-size data before writing to storage media.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for managing keys and encrypting data is provided. The method includes receiving data to be written to a logical disk, generating an encryption table indicating one or more locations on the logical disk for storing the data and indicating a key used for encrypting the data, encrypting the data to be written to the logical disk, and transmitting the encrypted data and the encryption table to a storage array.