Enhanced data encryption in distributed datastores using a cluster-wide fixed random tweak

Patent metadata

Field	Value
Publication number	US-11061594-B1
Application number	US-202016827674-A
Country	US
Kind code	B1
Filing date	Mar 23, 2020
Priority date	Mar 23, 2020
Publication date	Jul 13, 2021
Grant date	Jul 13, 2021

Abstract

A method for encrypting data in one or more data blocks is provided. The method generates a fixed random tweak. The method receives first and second data blocks to write on at least one physical disk of a set of physical disks associated with a set of host machines. The method applies a fixed random tweak to data indicative of the first data block and data indicative of the second data block to generate, respectively, first and second encrypted data blocks. The method writes first and second entries to a data log in a cache, the first entry comprising a first header and the first encrypted data block and the second entry comprising a second header and the second encrypted data block. The method then writes the first and second encrypted data blocks to the at least one physical disk.

First claim

We claim:

1. A method for encrypting data in one or more data blocks, the method comprising:
generating a fixed random tweak;
receiving a first data block to write on at least one physical disk of a set of physical disks associated with a set of host machines;
applying the fixed random tweak to data indicative of the first data block to generate a first encrypted data block;
writing a first entry to a data log in a cache, the first entry comprising a first header and the first encrypted data block;
writing the first encrypted data block to the at least one physical disk;
receiving a second data block, different from the first data block, to write on the at least one physical disk;
applying the fixed random tweak to data indicative of the second data block to generate a second encrypted data block;
writing a second entry to the data log, the second entry comprising a second header and the second encrypted data block; and
writing the second encrypted data block to the at least one physical disk.

2. The method of claim 1 , further comprising, before applying the fixed random tweak to the data indicative of the first data block, compressing data in the received first data block to generate the data indicative of the first data block.

3. The method of claim 1 , wherein generating the fixed random tweak comprises generating the fixed random tweak when the set of physical disks associated with the set of host machines is initially formatted and associated with a storage cluster.

4. The method of claim 1 , wherein writing the first and second encrypted data blocks to the at least one physical disk comprises writing the first and second encrypted data blocks to the at least one physical disk as part of a stripe comprising a plurality of additional encrypted data blocks and the first and second encrypted data blocks.

5. The method of claim 4 , wherein writing the first and second encrypted data blocks to the at least one physical disk as part of the stripe comprises writing the first and second encrypted data blocks and the plurality of additional encrypted data blocks on multiple physical disks across multiple host machines without decrypting the encrypted data blocks.

6. The method of claim 1 , wherein at least one of the set of host machines that comprises one of the set of physical disks performs deduplication on encrypted data blocks stored on the one physical disk without decrypting the encrypted data blocks.

7. The method of claim 1 , wherein the applying the fixed random tweak comprises using advanced encryption standard text encryption.

8. A non-transitory computer readable medium comprising instructions that, when executed by one or more processors of a computing system, cause the computing system to perform a method of encrypting data in one or more data blocks, the method comprising:
generating a fixed random tweak;
receiving a first data block to write on at least one physical disk of a set of physical disks associated with a set of host machines;
applying the fixed random tweak to data indicative of the first data block to generate a first encrypted data block;
writing a first entry to a data log in a cache, the first entry comprising a first header and the first encrypted data block;
writing the first encrypted data block to the at least one physical disk;
receiving a second data block, different from the first data block, to write on the at least one physical disk;
applying the fixed random tweak to data indicative of the second data block to generate a second encrypted data block;
writing a second entry to the data log, the second entry comprising a second header and the second encrypted data block; and
writing the second encrypted data block to the at least one physical disk.

9. The non-transitory computer readable medium of claim 8 , wherein the method further comprises:
before applying the fixed random tweak to the data indicative of the first data block, compressing data in the received first data block to generate the data indicative of the first data block.

10. The non-transitory computer readable medium of claim 8 , wherein generating the fixed random tweak comprises generating the fixed random tweak when the set of physical disks associated with the set of host machines is initially formatted and associated with a storage cluster.

11. The non-transitory computer readable medium of claim 8 , wherein writing the first and second encrypted data blocks to the at least one physical disk comprises writing the first and second encrypted data blocks to the at least one physical disk as part of a stripe comprising a plurality of additional encrypted data blocks and the first and second encrypted data blocks.

12. The non-transitory computer readable medium of claim 11 , wherein writing the first and second encrypted data blocks to the at least one physical disk as part of the stripe comprises writing the first and second encrypted data blocks and the plurality of additional encrypted data blocks on multiple physical disks across multiple host machines without decrypting the encrypted data blocks.

13. The non-transitory computer readable medium of claim 8 , wherein at least one of the set of host machines that comprises one of the set of physical disks performs deduplication on encrypted data blocks stored on the one physical disk without decrypting the encrypted data blocks.

14. A computer system, comprising:
a memory; and
a processor coupled to the memory, the processor being configured to:
generate a fixed random tweak;
receive a first data block to write on at least one physical disk of a set of physical disks associated with a set of host machines;
apply the fixed random tweak to data indicative of the first data block to generate a first encrypted data block;
write a first entry to a data log in a cache, the first entry comprising a first header and the first encrypted data block;
write the first encrypted data block to the at least one physical disk;
receive a second data block, different from the first data block, to write on the at least one physical disk;
apply the fixed random tweak to data indicative of the second data block to generate a second encrypted data block;
write a second entry to the data log, the second entry comprising a second header and the second encrypted data block; and
write the second encrypted data block to the at least one physical disk.

15. The computer system of claim 14 , wherein the processor is further configured to:
before applying the fixed random tweak to the data indicative of the first data block, compressing data in the received first data block to generate the data indicative of the first data block.

16. The computer system of claim 14 , wherein generating the fixed random tweak comprises generating the fixed random tweak when the set of physical disks associated with the set of host machines is initially formatted and associated with a storage cluster.

17. The computer system of claim 14 , wherein writing the first and second encrypted data blocks to the at least one physical disk comprises writing the first and second encrypted data blocks to the at least one physical disk as part of a stripe comprising a plurality of additional encrypted data blocks and the first and second encrypted data blocks.

18. The computer system of claim 17 , wherein writing the first and second encrypted data blocks to the at least one physical disk as part of the stripe comprises writing the first and second encrypted data blocks and the plurality of additional encrypted data blocks on multi

Assignees

• Vmware Inc

Inventors

• Wang Wenguang
• Gunturu Vamsi

Classifications

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F3/067

  Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS] · CPC title

• G06F3/0641

  De-duplication techniques · CPC title

• G06F3/064 Primary

  Management of blocks · CPC title

• G06F3/0623

  in relation to content · CPC title