Secure WORM Virtual Disk with Precomputed Keystream Cache
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for securing and deduplicating big data on write once read many media face performance bottlenecks due to processor contention between encryption and deduplication operations, leading to reduced write throughput.
Innovation Solution
The solution involves using a write once read many virtual disk that employs a block cipher as a stream cipher in counter mode to generate a precomputed keystream, which is stored on the virtual disk as a cache, allowing for concurrent operation of deduplication and encryption without significant processor load contention, thereby optimizing write performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is secured using symmetric-key algorithms such as AES and deduplicated concurrently, then data confidentiality and compression are achieved, but write throughput is reduced due to processor contention
Solution Approach 1:
The patent pre-generates and stores keystreams in the empty space of the virtual disk during a format operation, before actual data writing occurs. This preliminary action allows the keystream to be readily available during write operations, eliminating the need for real-time cryptographic computation and thus preventing processor contention between encryption and deduplication operations.
2Loss of substance
If cryptographic hash functions are used for deduplication at high data rates, then compression is achieved, but processor load increases significantly
Solution Approach 1:
The patent performs deduplication operations on plaintext data before encryption occurs in the write path. By preprocessing and identifying duplicates early, the system reduces the amount of data that needs to be encrypted, thereby reducing the overall cryptographic processing load and improving write throughput.
3Adaptability or versatility
If block cipher is operated as stream cipher using counter mode, then encryption flexibility is improved, but additional processing steps are required
Solution Approach 1:
The patent combines the keystream generation and data encryption operations by XORing the pre-generated keystream directly with the plaintext data blocks. This merging of operations simplifies the overall encryption process while maintaining the flexibility of counter mode, as the keystream is generated once during formatting and then reused efficiently during write operations.
Data Source
AI summary
A method and apparatus is provided for the operation of a secure and deduplicated write once read many virtual disk which exceeds the write performance of traditional cryptographic methods. This is achieved through the utilization of a time-memory tradeoff via the empty space on a virtual disk at format time. Traditionally empty space is zeroed to indicate that data is not present. When implementing the apparatus, the empty space is filled with the output of a symmetric-key algorithm uniquely keyed for that specific disk. From an information theoretic point of view, the format operation stores cryptographically structured data, rather than purely redundant data, enabling the write operation that encodes data to be stored on the disk to operate without additional cryptographic computation. This reduced computation requirement for encoding enables the computation required deduplication to operate as if encoding was not being performed, resulting in a net throughput increase.