Per-Tenant Encryption Keys for Multi-Tenant Storage Deduplication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant storage systems, efficient deduplication is challenging due to the use of different encryption keys for each tenant, leading to redundant data storage and increased system complexity and cost.
Innovation Solution
Implementing per-tenant encryption keys, where a data item is encrypted with a common data encryption key and associated with metadata that includes the key encrypted using each tenant's key, allowing for efficient deduplication across multiple tenants by storing only a single copy of the item with multiple tenant key references.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If per-tenant encryption keys are used to ensure data security and isolation, then data security and tenant isolation are improved, but storage efficiency deteriorates due to redundant data copies across tenants
Solution Approach 1:
The patent segments the encryption key into two parts: a common data encryption key (DEK) for encrypting the actual data, and a separate tenant key for encrypting the DEK. This segmentation allows different tenants to access the same encrypted data by decrypting the DEK with their respective tenant keys, eliminating redundant data copies while maintaining security isolation.
Solution Approach 2:
The common data encryption key (DEK) acts as an intermediary between the plaintext data and the tenant-specific encryption. The DEK is encrypted with each tenant's key and stored in metadata, allowing tenants to access the same encrypted data through their individual keys without requiring separate data copies.
2Quantity of substance
If deduplication is implemented across multiple tenants to improve storage efficiency, then storage resource waste is reduced, but data accessibility and security deteriorate due to key management complexity
Solution Approach 1:
By segmenting the key into a common DEK and tenant-specific keys, the system achieves deduplication at the data level while maintaining tenant isolation at the key level. The DEK is shared across tenants, enabling deduplication, while the tenant keys provide security isolation, managing complexity through structured key hierarchy.
Solution Approach 2:
The common data encryption key (DEK) serves multiple tenants universally. Once encrypted with the DEK, the same encrypted data can be accessed by any tenant who possesses the corresponding tenant key, making the system multi-functional and reducing storage requirements across the multi-tenant environment.
3Adaptability or versatility
If the same data item is stored for multiple tenants with different encryption keys, then data accessibility for all tenants is maintained, but storage resources are wasted due to redundant copies
Solution Approach 1:
The key segmentation into common DEK and tenant-specific keys enables a single encrypted data copy to serve multiple tenants. Each tenant can decrypt the data using their unique key after the DEK is decrypted, maintaining accessibility while eliminating redundant storage copies.
Solution Approach 2:
The patent merges the encryption keys for multiple tenants into a unified structure where the common DEK encrypts the data and the tenant keys encrypt the DEK. This merging allows multiple tenants to access the same data through a single encrypted copy, combining accessibility requirements with storage efficiency.
Data Source
AI summary
An apparatus comprises a storage system and a cryptographic module incorporated in or otherwise associated with the storage system. The cryptographic module is configured to obtain a plurality of data encryption keys used to encrypt respective ones of the data items for storage in the storage system and a plurality of tenant keys for respective ones of the tenants. A given one of the data items is encrypted using a particular one of the data encryption keys. The given data item as stored for a given one of the tenants has associated metadata that includes the particular data encryption key encrypted using the tenant key of the given tenant. Such an arrangement allows for efficient deduplication. For example, a single copy of the given data item can be stored for multiple ones of the tenants by appropriate configuration of the metadata associated with the given data item.