Secure Enclave Deduplication for Encrypted Storage Blocks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing deduplication systems face challenges in performing data deduplication on sensitive data without compromising security, as supervisory programs need access to storage blocks to compare them, which can expose sensitive information.
Innovation Solution
A secure enclave is used to receive requests for storage blocks from a supervisory program, encrypt these blocks using an encryption key maintained in the secure enclave, and provide the encrypted blocks to the supervisory program, allowing deduplication to occur without exposing the underlying data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the supervisory program accesses storage blocks to perform deduplication comparison, then deduplication functionality is achieved, but sensitive information security is compromised
Solution Approach 1:
A secure enclave acts as an intermediary between the storage device and the supervisory program. The enclave receives storage blocks from the storage device, performs encryption using stored encryption keys, and provides the encrypted blocks to the supervisory program for deduplication comparison. This mediator approach allows deduplication to proceed while preventing direct access to sensitive plaintext data by the supervisory program.
Solution Approach 2:
The patent transforms storage blocks from their original plaintext state to an encrypted state before providing them to the supervisory program. By changing the parameter of data encryption, the system enables deduplication comparison of encrypted blocks while maintaining security. The encryption transformation allows the supervisory program to work with modified data parameters that preserve deduplication functionality without exposing sensitive information.
2Object-affected harmful factors
If the supervisory program cannot access storage blocks for security reasons, then sensitive information is protected, but deduplication cannot be performed
Solution Approach 1:
The secure enclave serves as a trusted intermediary that enables the supervisory program to perform deduplication operations without directly accessing sensitive storage blocks. The enclave handles the retrieval and encryption of blocks, presenting encrypted versions to the supervisory program that can be compared for deduplication purposes while maintaining security constraints.
Solution Approach 2:
The system creates encrypted copies of storage blocks that can be used for deduplication comparison without requiring access to the original plaintext blocks. The secure enclave generates these encrypted copies using stored encryption keys, allowing the supervisory program to perform deduplication on the copies while the originals remain protected.
3Object-affected harmful factors
If encryption is applied to storage blocks before deduplication, then data security is improved, but comparison complexity increases
Solution Approach 1:
The patent applies encryption as a parameter change to storage blocks, transforming them into encrypted form before deduplication comparison. The secure enclave manages the encryption process using stored keys, and the supervisory program performs comparison on the encrypted blocks. While encryption adds complexity to the comparison process, the enclave's pre-processing and key management simplify the overall system architecture.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This approach enables secure deduplication of sensitive data by ensuring that the supervisory program cannot access the raw content of the storage blocks, thereby protecting sensitive information while still allowing for effective deduplication.
Implementation Method 1
The secure enclave can obtain the storage blocks from a storage device, encrypt them using an encryption key to generate encrypted storage blocks
Data Source
AI summary
Deduplication can be performed based on encrypted storage blocks generated by a secure enclave. For example, a secure enclave can generate a first encrypted storage block and a second encrypted storage block using an encryption key. The first encrypted storage block can be an encrypted version of a first storage block and the second encrypted storage block can be an encrypted version of a second storage block. The secure enclave can then provide the first encrypted storage block and the second encrypted storage block to a supervisory program executable on a processor that is separate from the secure enclave. The supervisory program can be configured to initiate deduplication of the first storage block and the second storage block in response to determining that the first encrypted storage block matches the second encrypted storage block.