Maintaing encryption keys to provide encryption on top of data deduplication

Patent metadata

Field	Value
Publication number	US-9652634-B2
Application number	US-201514716768-A
Country	US
Kind code	B2
Filing date	May 19, 2015
Priority date	May 19, 2015
Publication date	May 16, 2017
Grant date	May 16, 2017

Abstract

Exemplary methods, apparatuses, and systems generate an encryption key based upon data content of a portion of data to be encrypted by the encryption key. The encryption key is stored as one of a plurality of encryption keys within a subset of storage. Each of the plurality of encryption keys is generated based upon corresponding data content. A checksum representing the plurality of encryption keys is calculated. In response to receiving an input/output (I/O) request for data encrypted by the encryption key, a verification checksum representing the plurality of encryption keys is calculated. The requested data is decrypted using the encryption key in response to verifying the checksum and verification checksum match.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
generating an encryption key based upon data content of a portion of data to be encrypted by the encryption key;
storing the encryption key as one of a plurality of encryption keys within a subset of storage, each of the plurality of encryption keys generated based upon corresponding data content;
calculating a checksum representing the plurality of encryption keys;
calculating, in response to receiving an input/output (I/O) request for data encrypted by the encryption key, a verification checksum representing the plurality of encryption keys;
modifying the checksum to a reserved value in response to determining the checksum and the verification checksum do not match due to a corruption of the plurality of encryption keys;
repairing the plurality of encryption keys; and
recalculating the checksum in response to the repairing of the plurality of encryption keys.

2. The computer-implemented method of claim 1 , further comprising:
determining, when calculating the checksum, that the checksum equals a reserved value; and
modifying the checksum to no longer equal the reserved value.

3. The computer-implemented method of claim 1 , further comprising:
determining the verification checksum equals a reserved value; and
modifying the verification checksum to no longer equal the reserved value.

4. The computer-implemented method of claim 1 , wherein generating the encryption key is based upon a secret key and the data content.

5. The computer-implemented method of claim 1 , wherein the plurality of stored encryption keys are wrapped using a secret key.

6. The computer-implemented method of claim 5 , wherein the portion of data is stored within a datacenter on behalf of one of a plurality of tenant groups of the datacenter, and wherein the secret key is used to wrap a plurality of encryption keys for a plurality of users within the tenant group.

7. A non-transitory computer-readable medium storing instructions, which when executed by a processing device, cause the processing device to perform a method comprising:
generating an encryption key based upon data content of a portion of data to be encrypted by the encryption key;
storing the encryption key as one of a plurality of encryption keys within a subset of storage, each of the plurality of encryption keys generated based upon corresponding data content;
calculating a checksum representing the plurality of encryption keys;
calculating, in response to receiving an input/output (I/O) request for data encrypted by the encryption key, a verification checksum representing the plurality of encryption keys;
modifying the checksum to a reserved value in response to determining the checksum and the verification checksum do not match due to a corruption of the plurality of encryption keys;
repairing the plurality of encryption keys; and
recalculating the checksum in response to the repairing of the plurality of encryption keys.

8. The non-transitory computer-readable medium of claim 7 , the method further comprising:
determining, when calculating the checksum, that the checksum equals a reserved value; and
modifying the checksum to no longer equal the reserved value.

9. The non-transitory computer-readable medium of claim 7 , the method further comprising:
determining the verification checksum equals a reserved value; and
modifying the verification checksum to no longer equal the reserved value.

10. The non-transitory computer-readable medium of claim 7 , wherein generating the encryption key is based upon a secret key and the data content.

11. The non-transitory computer-readable medium of claim 7 , wherein the plurality of stored encryption keys are wrapped using a secret key.

12. The non-transitory computer-readable medium of claim 11 , wherein the portion of data is stored within a datacenter on behalf of one of a plurality of tenant groups of the datacenter, and wherein the secret key is used to wrap a plurality of encryption keys for a plurality of users within the tenant group.

13. An apparatus comprising:
a processing device; and
a memory coupled to the processing device, the memory storing instructions which, when executed by the processing device, cause the apparatus to:
generate an encryption key based upon data content of a portion of data to be encrypted by the encryption key;
store the encryption key as one of a plurality of encryption keys within a subset of storage, each of the plurality of encryption keys generated based upon corresponding data content;
calculate a checksum representing the plurality of encryption keys; calculate, in response to receiving an input/output (I/O) request for data encrypted by the encryption key, a verification checksum representing the plurality of encryption keys;
modify the checksum to a reserved value in response to determining the checksum and the verification checksum do not match due to a corruption of the plurality of encryption keys;
repair the plurality of encryption keys; and
recalculate the checksum in response to the repairing of the plurality of encryption keys.

14. The apparatus of claim 13 , wherein the instructions further cause the host computer to:
determine, when calculating the checksum, that the checksum equals a reserved value; and
modify the checksum to no longer equal the reserved value.

15. The apparatus of claim 13 , wherein the instructions further cause the host computer to:
determine the verification checksum equals a reserved value; and
modify the verification checksum to no longer equal the reserved value.

16. The apparatus of claim 13 , wherein generating the encryption key is based upon a secret key and the data content.

17. The apparatus of claim 13 , wherein the plurality of stored encryption keys are wrapped using a secret key, wherein the portion of data is stored within a datacenter on behalf of one of a plurality of tenant groups of the datacenter, and wherein the secret key is used to wrap a plurality of encryption keys for a plurality of users within the tenant group.

Assignees

• Vmware Inc

Inventors

• Wang Wenguang
• Meng Xiaoxuan

Classifications

• H04L9/0861

  Generation of secret information including derivation or calculation of cryptographic keys or passwords · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L9/3239

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title

• G06F11/00

  Error detection; Error correction; Monitoring (error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00) · CPC title

• G06F21/64 Primary

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title