Two-Tier Storage Encryption Using LBA and PBA Tweaks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed storage systems like vSAN, data encryption and decryption processes become complex and CPU-intensive due to the need for multiple encryption cycles, especially with fault tolerance mechanisms like RAID and erasure coding, leading to increased CPU costs and inefficiencies.
Innovation Solution
Implementing a data encryption mechanism that uses a fixed random tweak or object ID associated with each data block, stored in the SCSI data integrity field, to reduce the number of encryption and decryption cycles, allowing for efficient encryption and decryption without additional cycles during data movements or deduplication processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data encryption is implemented in a two-tier datastore with fault tolerance mechanisms, then data security and reliability are improved, but CPU cost and operational complexity increase due to multiple encryption/decryption cycles
Solution Approach 1:
The patent applies preliminary action by performing encryption only once at the time of initial data write to the performance tier, rather than encrypting multiple times during subsequent operations. The tweak value is predetermined and stored with the data, eliminating the need for repeated encryption/decryption cycles during data movement between tiers or during fault tolerance operations.
Solution Approach 2:
The patent changes the encryption parameter approach by using a fixed tweak value that is predetermined and stored with the data, rather than generating new tweak values for each encryption operation. This parameter change allows the same encryption key to be used consistently across multiple operations, reducing CPU overhead while maintaining security.
2Reliability
If multiple encryption cycles are performed for data movement between storage tiers, then data integrity is maintained, but operational efficiency deteriorates due to increased encryption/decryption operations
Solution Approach 1:
The patent performs the encryption action preliminarily at the time of initial data write to the performance tier, storing the encrypted data with the tweak value. This preliminary encryption eliminates the need for subsequent encryption/decryption operations during data movement between tiers, significantly improving operational efficiency while maintaining data integrity through the stored tweak value.
Solution Approach 2:
The patent introduces the tweak value as an intermediary element that is stored with the encrypted data. This intermediary allows the encryption key to be reused across multiple operations without compromising security, as the tweak value serves as a mediator that maintains data integrity while enabling efficient subsequent operations.
3Reliability
If fault tolerance mechanisms like RAID and erasure coding are implemented, then data reliability is improved, but the number of encryption operations increases leading to higher CPU consumption
Solution Approach 1:
The patent applies preliminary action by encrypting data only once at initial write to the performance tier, before fault tolerance operations are performed. The encrypted data with stored tweak values can then be efficiently replicated and distributed across multiple storage devices for fault tolerance without requiring additional encryption operations, significantly reducing CPU consumption while maintaining reliability.
Solution Approach 2:
The patent merges the encryption operation with the initial data write operation to the performance tier, combining these two operations into a single step. This merging eliminates the need for separate encryption operations during fault tolerance processing, reducing overall CPU consumption while maintaining data reliability through the combined operation.
Data Source
AI summary
A method for encrypting data blocks is provided. The method receives a plurality of data blocks and encrypts each data block using an LBA of the data block as a tweak. The method writes the plurality of encrypted data blocks to physical blocks of the plurality of physical disks. The method then performs deduplication on the physical disks by determining that first and second physical blocks in the physical disks are duplicates, decrypting encrypted data in the first physical block using a first LBA associated with the first physical block as the tweak, and re-encrypting decrypted data in the first physical block using a PBA associated with the first physical block as the tweak. When reading the data back, either the LBA or PBA is used as the tweak, depending on whether the data was encrypted using LBA or re-encrypted using PBA during the deduplication process.