Storage Controller End-to-End Data Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional distributed storage systems face challenges in data reduction due to encryption methods that generate random data, making it difficult to identify and store duplicate portions effectively, leading to exponential growth in storage needs and reduced cost savings.
Innovation Solution
Implementing end-to-end secure data reduction by providing decryption key information to the storage system, decrypting data upon write requests, performing reduction operations, and re-encrypting with a storage array key, allowing for data reduction across the array while maintaining secure storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted using conventional encryption methods, then data security is improved, but data reduction effectiveness deteriorates due to random data generation
Solution Approach 1:
The patent applies preliminary action by decrypting data before storage operations. The storage system receives encrypted data, decrypts it using stored decryption keys, performs data reduction operations on the decrypted data, then re-encrypts and stores the reduced data. This preliminary decryption enables effective data reduction while maintaining security through subsequent re-encryption.
Solution Approach 2:
The patent uses an intermediary approach by introducing a key management component that mediates between client encryption and storage system operations. The system stores both encryption and decryption keys, acting as an intermediary that can decrypt incoming data for reduction operations while maintaining the original encryption scheme for security.
2Reliability
If data is encrypted before storage, then data security is improved, but data reduction operations become less effective
Solution Approach 1:
The system performs preliminary decryption of incoming encrypted data using stored decryption keys before performing data reduction operations. This allows deduplication and compression to work effectively on the actual data content rather than encrypted random-looking data, significantly improving data reduction efficiency while maintaining security through re-encryption of the reduced data.
3Reliability
If different encryption keys are used by clients, then data security is improved, but data reduction across the array is hindered
Solution Approach 1:
The patent uses an intermediary approach by introducing a key management component that mediates between client encryption and storage system operations. The system stores both encryption and decryption keys for multiple clients, acting as an intermediary that can decrypt incoming data from any client using the appropriate decryption key, perform data reduction operations, then re-encrypt with the client's original encryption key. This enables data reduction across the array while maintaining compatibility with different client encryption keys.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A storage controller coupled to a storage array comprising one or more storage devices receives a request to write encrypted data to a volume resident on a storage array, where the encrypted data comprises data encrypted by a first encryption key that is associated with at least one property of the data. The storage controller determines a decryption key to decrypt the encrypted data, decrypts the encrypted data using the decryption key, performs at least one data reduction operation on the decrypted data, encrypts the reduced data using a second encryption key to generate a second encrypted data, and storing the second encrypted data on the storage array.