Key Translator for Encrypted Data Deduplication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
End-to-end encryption and deduplication are mutually exclusive in storage systems, as encrypted data appears random and cannot be deduplicated across different encryption keys, leading to space inefficiencies and security challenges in multi-tenancy environments.
Innovation Solution
A data storage system with a key translator that creates translation keys to convert encrypted data between different encryption keys, allowing deduplication while maintaining data security by keeping the translation process external to the storage device, thus avoiding decryption and minimizing network bandwidth.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If end-to-end encryption is employed to protect data security, then data security is improved, but data deduplication becomes impossible leading to space inefficiency
Solution Approach 1:
The patent introduces a key translator as an intermediary component that enables translation between different encryption keys. This mediator allows deduplicated data encrypted with one key to be accessed by hosts using different keys, thereby maintaining both data security through encryption and storage efficiency through deduplication. The key translator sits between the storage system and hosts, translating encryption keys without requiring decryption of the underlying data.
2Reliability
If data is encrypted with different encryption keys for different hosts, then data security is improved, but deduplication across hosts becomes impossible
Solution Approach 1:
The patent changes the encryption key parameter dynamically based on the host's credentials. Instead of storing data in multiple encrypted copies for different hosts, the system stores a single encrypted version and uses the key translator to provide appropriate encryption keys to different hosts. This allows the same encrypted data to be adaptively accessed by multiple hosts with different security requirements while maintaining deduplication.
3Productivity
If decryption is performed to enable deduplication, then deduplication capability is improved, but security is compromised and network bandwidth is consumed
Solution Approach 1:
The patent performs preliminary encryption of data before storage, establishing a single encrypted copy that can serve multiple hosts. The key translator is pre-configured with the ability to translate between different encryption keys without requiring decryption. This preliminary setup enables both deduplication and security to coexist, as the encrypted data remains encrypted throughout the deduplication process while still being accessible to authorized hosts through key translation.
Data Source
AI summary
A data storage system configured to deduplicate and store sets of data is presented. The system comprises a computer readable storage device configured to store a plurality of sets of data for a plurality of hosts, wherein each sets of data of the plurality of sets of data corresponding to each host of the plurality of hosts is encrypted with one or more different encryption keys, and wherein at least one of the plurality of sets of data contains deduplicated data. The system also comprises a key translator configured to create at least one translation key based, at least in part, on the one or more different encryption keys and the deduplicated data, and wherein the at least one translation key is configured to translate from a first encryption key to a second encryption key of the one or more different encryption keys.