Trusted Execution Environment Deduplication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Public mass storage systems struggle to implement data deduplication efficiently due to encrypted data blocks, as existing fingerprinting algorithms cannot work with encrypted data, violating privacy and cybersecurity laws if decryption occurs on the server.
Innovation Solution
Implementing deduplication functions within a trusted execution environment (TEE) that runs securely inside a processor, allowing data blocks to be decrypted and fingerprinted without exposing tenant data, using collision-free hashing to generate digital fingerprints for comparison.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data blocks are encrypted to maintain privacy, then data confidentiality is improved, but deduplication capability deteriorates because fingerprinting algorithms cannot work with encrypted data
Solution Approach 1:
The system performs deduplication operations before final encryption and storage. Data blocks are fingerprinted and deduplicated in plaintext form, then encrypted only for storage. This preliminary deduplication action avoids the contradiction by operating on unencrypted data while still providing security during storage and transmission.
Solution Approach 2:
The patent introduces an intermediary deduplication layer that operates between the client and storage system. This intermediary performs fingerprinting and deduplication operations on plaintext data blocks before they are encrypted and stored, acting as a mediator that enables both confidentiality and deduplication capability without requiring the storage system to decrypt data.
2Productivity
If decryption is performed on the server to enable deduplication, then deduplication efficiency is improved, but cybersecurity compliance deteriorates due to potential information leaks
Solution Approach 1:
The patent extracts the deduplication function from the storage server and relocates it to the client side or an intermediary layer. By taking out the fingerprinting and deduplication operations from the server environment, the system eliminates the need for server-side decryption while maintaining deduplication efficiency, thus removing the source of information leak risk.
Solution Approach 2:
The client performs deduplication operations on its own data blocks before submission to the storage system. This self-service approach allows the client to maintain control over its encrypted data, performing necessary deduplication operations without requiring the server to access or decrypt the data, thereby eliminating information leak risks while maintaining efficiency.
3Reliability
If existing fingerprinting algorithms are used on encrypted data, then storage privacy is maintained, but deduplication functionality deteriorates completely
Solution Approach 1:
The system performs fingerprinting operations in advance, before encryption occurs. Data blocks are processed to generate fingerprints while still in plaintext form, enabling full deduplication functionality. Only after this preliminary fingerprinting action is complete does encryption occur, preserving both privacy and deduplication capability.
Solution Approach 2:
Instead of attempting to apply fingerprinting algorithms to encrypted data (the conventional approach), the patent inverts the sequence: it fingerprints plaintext data first, then encrypts the results. This inversion of the operation sequence enables deduplication functionality to work effectively while maintaining storage privacy through encryption.
Data Source
AI summary
Aspects and features of the present disclosure can provide a trusted, privacy-preserved deduplication process by executing deduplication functions in a trusted execution environment (TEE). In some examples, encrypted, incoming user data blocks are decrypted in the TEE to produce unencrypted user data blocks. An incoming digital fingerprint or each unencrypted user data block is produced. A processing device can compare the incoming digital fingerprint to existing digital fingerprints stored in the TEE to determine a presence of the incoming digital fingerprint and hence the presence of a copy of the data block in the storage platform, and writes the encrypted. Incoming data blocks are written to storage only when necessary. The technique allows public mass storage systems to meet cybersecurity objectives while achieving the storage space efficiency that deduplication provides.