Storage Array Rekeying for Encryption and Compression Trade-offs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data encryption in storage systems can hinder data compression and deduplication processes, while providing unencrypted data to clients increases security risks, leading to resource and performance costs for storage systems.
Innovation Solution
A new rekey instruction is introduced that allows storage arrays to efficiently manage encryption by transforming encryption information and decrypting data using a source range of logical block addresses, proof of possession, and desired encryption information, enabling transparent decryption and re-encryption operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted in storage systems, then security is improved, but data compression and deduplication processes are hindered
Solution Approach 1:
The system performs preliminary decryption of encrypted data before compression and deduplication operations, then re-encrypts the processed data. This preliminary action allows standard data reduction techniques to work effectively on the decrypted data while maintaining security through re-encryption, resolving the contradiction between security and compression efficiency.
2Ease of operation
If unencrypted data is provided to clients, then ease of operation is improved, but security risks increase
Solution Approach 1:
The storage array controller acts as an intermediary that automatically decrypts data for client access and re-encrypts data before writing to storage. This intermediary function allows clients to operate with unencrypted data (improving ease of operation) while the controller maintains security by ensuring data is encrypted at rest and during transmission, thus resolving the security risk.
3Ease of operation
If encryption operations are performed transparently, then ease of operation is improved, but resource and performance costs increase
Solution Approach 1:
The storage array controller performs self-service by automatically managing encryption key storage, data decryption, and re-encryption operations without requiring client involvement. This self-service approach improves ease of operation by making encryption transparent while optimizing resource usage through efficient key management and batch processing of encryption operations.
Data Source
AI summary
A method of modifying encryption of a storage system includes: receiving an instruction to rekey data on a storage system, wherein the instruction identifies first encryption information and second encryption information; determining that the instruction is authorized; decrypting, by a processing device of a storage system controller, the data using a current key included in the first encryption information to generate decrypted data; and encrypting, by the processing device of the storage system controller, the decrypted data using the second encryption information to generate encrypted data.