Multi-Tenant Storage Encryption for Deduplication and Keyless Maintenance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional multi-tenant storage systems face challenges in maintaining data integrity and efficiency due to the requirement for access to cryptographic keys during maintenance activities, which can be unavailable, hindering data deduplication, compression, and error detection processes.
Innovation Solution
The implementation of a multi-tenant storage system that uses cryptographic checksums separate from clear text checksums, allowing for data maintenance and error detection without accessing tenant keys, and employs deduplication and compression techniques that operate with multi-tenant encryption, using a system cryptographic key and tweak values for encryption and decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted with tenant cryptographic keys before storage, then data security is improved, but maintenance activities require key access which may be unavailable
Solution Approach 1:
The patent segments the checksum function into two parts: a cryptographic checksum computed from encrypted data that can be verified without decryption, and the original clear text checksum. This segmentation allows maintenance operations to proceed using only the cryptographic checksum while the tenant key remains inaccessible, resolving the contradiction between security and maintenance accessibility.
Solution Approach 2:
The cryptographic checksum acts as an intermediary that bridges the gap between encrypted data and verification needs. It enables error detection and maintenance operations without requiring access to the tenant cryptographic key, thus maintaining security while enabling operational access during maintenance.
2Quantity of substance
If data deduplication is performed on encrypted data, then storage efficiency is improved, but deduplication accuracy deteriorates due to encryption
Solution Approach 1:
The patent performs deduplication on clear text data before encryption occurs. By conducting the deduplication comparison in plaintext form, the system maintains high deduplication accuracy while still achieving storage efficiency. The deduplicated data is then encrypted and stored, combining the benefits of both approaches.
3Quantity of substance
If compression is applied to encrypted data, then storage efficiency is improved, but compression effectiveness deteriorates
Solution Approach 1:
The patent applies compression to clear text data before encryption, not to encrypted data. This preliminary compression action maintains high compression effectiveness since the data is still in plaintext form with recognizable patterns. The compressed data is then encrypted and stored, achieving both storage efficiency and compression effectiveness.
4Reliability
If cryptographic keys are managed centrally, then security control is improved, but maintenance operations are hindered by key availability
Solution Approach 1:
The cryptographic checksum serves as an intermediary that enables maintenance operations without requiring access to the centrally managed cryptographic keys. The key management server continues to maintain security control by safeguarding the keys, while maintenance operations proceed independently using only the cryptographic checksum, thus resolving the contradiction between security control and maintenance throughput.
Data Source
AI summary
A tenant's clear text data in a multi-tenant storage system can be encrypted using the tenant's cryptographic key to produce encrypted yet compressible data (“cryptographic data”). The cryptographic data can be encrypted using a system cryptographic key that is managed by the multi-tenant storage system and then stored. Use of the system cryptographic key allows for subsequent maintenance activities such as deduplication and compression to be performed on data stored in the multi-tenant storage system without having to access any of the tenants' cryptographic keys.