Content aware hierarchical encryption for secure storage systems

Patent metadata

Field	Value
Publication number	US-9432192-B1
Application number	US-201414229364-A
Country	US
Kind code	B1
Filing date	Mar 28, 2014
Priority date	Mar 28, 2014
Publication date	Aug 30, 2016
Grant date	Aug 30, 2016

Abstract

In one embodiment, metadata of a data object to be stored in a storage system is received, where the metadata is in a hierarchical structure having multiple levels, each level having multiple nodes and each node being one of a root node, a leaf node and an intermediate node. Each leaf node represents a deduplicated segment associated with the data object. The hierarchical structure is traversed to encrypt each of the nodes in a bottom-up approach, starting from leaf nodes, using different keys. A child key for encrypting content of a child node is stored in a parent node that references the child node, and the child key is encrypted by a parent key associated with the parent node. The encrypted content of the nodes are then stored in one or more storage units of the storage system in a deduplicated manner.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving metadata of a data object to be stored in a storage system, wherein the metadata is represented in a hierarchical structure having a plurality of levels, each level having a plurality of nodes and each node being one of a root node, a leaf node and an intermediate node, and wherein each leaf node represents a deduplicated segment associated with the data object and each parent node stores metadata of its one or more child nodes;
traversing the hierarchical structure to encrypt each of the nodes in a bottom-up approach, starting from leaf nodes, using a plurality of different keys, wherein a child key for encrypting content of a child node is stored in a parent node that references the child node, and wherein the child key is encrypted together with content of the parent node by a parent key associated with the parent node, wherein traversing the hierarchical structure to encrypt each of the nodes in a bottom-up approach comprises
for a given first node as a parent node to one or more second nodes as child nodes, obtaining a first fingerprint of content of the first node,
encrypting, using a first key derived from the first fingerprint, content of the first node and one or more second keys that encrypt the second nodes, and
storing the encrypted first node having content of the first node and the one or more second keys embedded therein in the storage system; and
storing the encrypted content of the plurality of nodes in one or more storage units of the storage system in a deduplicated manner.

2. The method of claim 1 , wherein content data of the parent node and one or more child keys of one or more child nodes referenced by the parent node are stored together and encrypted using the parent key associated with the parent node.

3. The method of claim 1 , wherein the one or more second keys are derive from fingerprints of the one or more second nodes, respectively.

4. The method of claim 1 , further comprising iteratively performing obtaining the first fingerprint, encrypting using the first key, and storing the encrypted first node on a node-by-node and level-by-level basis based on the bottom-up approach.

5. The method of claim 1 , further comprising encrypting a root node of the hierarchical structure using a root key that is maintained separately from remaining encrypted content of the data object.

6. The method of claim 5 , wherein the root key is provided by a user who initiates encryption of the data object, and wherein the root key is not stored within the storage system to prevent from being compromised.

7. The method of claim 1 , further comprising:
in response to a request for retrieving the data object that has been encrypted and stored in the storage system, deriving a root key from the request; and
traversing the hierarchical structure of the metadata associated with the data object in a top-down approach to decrypt each of the nodes in the hierarchical structure using a key provided from its parent node, starting from the root node to the leaf nodes.

8. The method of claim 7 , wherein traversing the hierarchical structure of the metadata associated with the data object in a top-down approach comprises:
for a given third node as a parent node to one or more fourth nodes as child nodes, decrypting the third node using a third key associated with the third node to reveal one or more fourth keys corresponding to the one or more fourth nodes, respectively; and
decrypting, using the fourth keys, the one or more fourth nodes, to reveal content of the one or more fourth nodes.

9. A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor, cause the processor to perform operations, the operations comprising:
receiving metadata of a data object to be stored in a storage system, wherein the metadata is represented in a hierarchical structure having a plurality of levels, each level having a plurality of nodes and each node being one of a root node, a leaf node and an intermediate node, and wherein each leaf node represents a deduplicated segment associated with the data object and each parent node stores metadata of its one or more child nodes;
traversing the hierarchical structure to encrypt each of the nodes in a bottom-up approach, starting from leaf nodes, using a plurality of different keys, wherein a child key for encrypting content of a child node is stored in a parent node that references the child node, and wherein the child key is encrypted together with content of the parent node by a parent key associated with the parent node, wherein traversing the hierarchical structure to encrypt each of the nodes in a bottom-up approach comprises
for a given first node as a parent node to one or more second nodes as child nodes, obtaining a first fingerprint of content of the first node,
encrypting, using a first key derived from the first fingerprint, content of the first node and one or more second keys that encrypt the second nodes, and
storing the encrypted first node having content of the first node and the one or more second keys embedded therein in the storage system; and

storing the encrypted content of the plurality of nodes in one or more storage units of the storage system in a deduplicated manner.

10. The non-transitory machine-readable medium of claim 9 , wherein content data of the parent node and one or more child keys of one or more child nodes referenced by the parent node are stored together and encrypted using the parent key associated with the parent node.

11. The non-transitory machine-readable medium of claim 9 , wherein the one or more second keys are derive from fingerprints of the one or more second nodes, respectively.

12. The non-transitory machine-readable medium of claim 9 , wherein the operations further comprise iteratively performing obtaining the first fingerprint, encrypting using the first key, and storing the encrypted first node on a node-by-node and level-by-level basis based on the bottom-up approach.

13. The non-transitory machine-readable medium of claim 9 , wherein the operations further comprise encrypting a root node of the hierarchical structure using a root key that is maintained separately from remaining encrypted content of the data object.

14. The non-transitory machine-readable medium of claim 13 , wherein the root key is provided by a user who initiates encryption of the data object, and wherein the root key is not stored within the storage system to prevent from being compromised.

15. The non-transitory machine-readable medium of claim 9 , wherein the operations further comprise:
in response to a request for retrieving the data object that has been encrypted and stored in the storage system, deriving a root key from the request; and
traversing the hierarchical structure of the metadata associated with the data object in a top-down approach to decrypt each of the nodes in the hierarchical structure using a key provided from its parent node, starting from the root node to the leaf nodes.

16. The non-transitory machine-readable medium of claim 15 , wherein traversing the hierarchical structure of the metadata associated with the data object in a top-down approach comprises:
for a given third node as a parent node to one or more fourth nodes as child nodes, decrypting the third node using a third key associated with the third node to reveal one or more fourth keys corresponding to the one or more fourth nodes, respectively; and
decrypting, using the fourth keys, the one or more fourth nodes, to reveal conte

Assignees

• Emc Corp

Inventors

• Pogde Prashant
• Botelho Fabiano C
• Garg Nitin

Classifications

• H04L9/30 Primary

  Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy · CPC title

• H04L9/0836 Primary

  using tree structure or hierarchical structure · CPC title

• H04L2209/60

  Digital content management, e.g. content distribution · CPC title

• H04L9/0891

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title