Focused Sanitization for Deduplicated Storage Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deduplicated storage systems face challenges in efficiently sanitizing data due to their log-structured nature, which requires copying and overwriting entire file systems, leading to resource-intensive processes that affect ingest performance and compliance with data security regulations.
Innovation Solution
A focused sanitization process is implemented by identifying and sanitizing only specific ranges of data containers based on the initial storage date of sensitive files, reducing the amount of data to be overwritten and improving efficiency by leveraging metadata and bit vectors to determine live and dead segments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a complete file system sanitization is performed on a deduplicated storage system, then data security compliance is achieved, but system resource consumption increases and ingest performance deteriorates
Solution Approach 1:
The patent segments the sanitization process by dividing the file system into different container ranges (first range and second range). Only the first range containing potential sensitive data is sanitized, while the second range is preserved. This segmentation allows compliant sanitization without the need to sanitize the entire file system, thus maintaining ingest performance.
Solution Approach 2:
The patent applies local quality by targeting sanitization operations specifically to the first container range where sensitive data may exist, rather than applying uniform sanitization across the entire file system. This localized approach ensures data security compliance in critical areas while preserving system performance in non-critical areas.
2Reliability
If entire file system sanitization is performed, then all sensitive data is eradicated, but processing time and resource requirements increase significantly
Solution Approach 1:
The patent extracts and isolates the first container range that contains potential sensitive data from the rest of the file system. By taking out only the relevant portion for sanitization, the processing time is significantly reduced compared to sanitizing the entire file system, while still ensuring complete eradication of sensitive data where it may exist.
Solution Approach 2:
The patent applies partial action by sanitizing only the necessary first container range rather than the excessive action of sanitizing the entire file system. This partial approach is sufficient to meet data security requirements while minimizing processing time and resource consumption.
3Measurement precision
If deduplicated storage systems sanitize individual files, then precision in removing specific sensitive data is achieved, but the log-structured nature prevents in-place erasure requiring full system copying
Solution Approach 1:
The patent segments the file system into container ranges and further segments the sanitization process into targeted operations on the first range. This segmentation enables precise targeting of sensitive data without requiring complex full-system copying operations, simplifying the overall process while maintaining precision.
Data Source
AI summary
Described is a deduplicated storage system that may perform a focused sanitization process by reducing the number of data storage containers that must be sanitized. The system leverages additional characteristics of the files that need to be sanitized such as an initial storage date (e.g. data breach date) of when a sensitive file (e.g. file to be sanitization) was actually stored on the deduplicated storage system. By maintaining a creation date of data containers, the system may limit sanitization to those containers having a creation date on or after the initial storage date of the sensitive file. Accordingly, the system is capable of performing a more focused overwriting of data thereby improving the overall efficiency of the sanitization process.