Maintaing encryption keys to provide encryption on top of data deduplication

1. A computer-implemented method, comprising:

generating an encryption key based upon data content of a portion of data to be encrypted by the encryption key;

storing the encryption key as one of a plurality of encryption keys within a subset of storage, each of the plurality of encryption keys generated based upon corresponding data content;

calculating a checksum representing the plurality of encryption keys;

calculating, in response to receiving an input/output (I/O) request for data encrypted by the encryption key, a verification checksum representing the plurality of encryption keys;

modifying the checksum to a reserved value in response to determining the checksum and the verification checksum do not match due to a corruption of the plurality of encryption keys;

repairing the plurality of encryption keys; and

recalculating the checksum in response to the repairing of the plurality of encryption keys.

2. The computer-implemented method of claim 1 , further comprising:

determining, when calculating the checksum, that the checksum equals a reserved value; and

modifying the checksum to no longer equal the reserved value.

3. The computer-implemented method of claim 1 , further comprising:

determining the verification checksum equals a reserved value; and

modifying the verification checksum to no longer equal the reserved value.

4. The computer-implemented method of claim 1 , wherein generating the encryption key is based upon a secret key and the data content.

5. The computer-implemented method of claim 1 , wherein the plurality of stored encryption keys are wrapped using a secret key.

6. The computer-implemented method of claim 5 , wherein the portion of data is stored within a datacenter on behalf of one of a plurality of tenant groups of the datacenter, and wherein the secret key is used to wrap a plurality of encryption keys for a plurality of users within the tenant group.

7. A non-transitory computer-readable medium storing instructions, which when executed by a processing device, cause the processing device to perform a method comprising:

generating an encryption key based upon data content of a portion of data to be encrypted by the encryption key;

storing the encryption key as one of a plurality of encryption keys within a subset of storage, each of the plurality of encryption keys generated based upon corresponding data content;

calculating a checksum representing the plurality of encryption keys;

calculating, in response to receiving an input/output (I/O) request for data encrypted by the encryption key, a verification checksum representing the plurality of encryption keys;

modifying the checksum to a reserved value in response to determining the checksum and the verification checksum do not match due to a corruption of the plurality of encryption keys;

repairing the plurality of encryption keys; and

recalculating the checksum in response to the repairing of the plurality of encryption keys.

8. The non-transitory computer-readable medium of claim 7 , the method further comprising:

determining, when calculating the checksum, that the checksum equals a reserved value; and

modifying the checksum to no longer equal the reserved value.

9. The non-transitory computer-readable medium of claim 7 , the method further comprising:

determining the verification checksum equals a reserved value; and

modifying the verification checksum to no longer equal the reserved value.

10. The non-transitory computer-readable medium of claim 7 , wherein generating the encryption key is based upon a secret key and the data content.

11. The non-transitory computer-readable medium of claim 7 , wherein the plurality of stored encryption keys are wrapped using a secret key.

12. The non-transitory computer-readable medium of claim 11 , wherein the portion of data is stored within a datacenter on behalf of one of a plurality of tenant groups of the datacenter, and wherein the secret key is used to wrap a plurality of encryption keys for a plurality of users within the tenant group.

13. An apparatus comprising:

a processing device; and

a memory coupled to the processing device, the memory storing instructions which, when executed by the processing device, cause the apparatus to:

generate an encryption key based upon data content of a portion of data to be encrypted by the encryption key;

store the encryption key as one of a plurality of encryption keys within a subset of storage, each of the plurality of encryption keys generated based upon corresponding data content;

calculate a checksum representing the plurality of encryption keys; calculate, in response to receiving an input/output (I/O) request for data encrypted by the encryption key, a verification checksum representing the plurality of encryption keys;

modify the checksum to a reserved value in response to determining the checksum and the verification checksum do not match due to a corruption of the plurality of encryption keys;

repair the plurality of encryption keys; and

recalculate the checksum in response to the repairing of the plurality of encryption keys.

14. The apparatus of claim 13 , wherein the instructions further cause the host computer to:

determine, when calculating the checksum, that the checksum equals a reserved value; and

modify the checksum to no longer equal the reserved value.

15. The apparatus of claim 13 , wherein the instructions further cause the host computer to:

determine the verification checksum equals a reserved value; and

modify the verification checksum to no longer equal the reserved value.

16. The apparatus of claim 13 , wherein generating the encryption key is based upon a secret key and the data content.

17. The apparatus of claim 13 , wherein the plurality of stored encryption keys are wrapped using a secret key, wherein the portion of data is stored within a datacenter on behalf of one of a plurality of tenant groups of the datacenter, and wherein the secret key is used to wrap a plurality of encryption keys for a plurality of users within the tenant group.