Deduplication-aware per-tenant encryption

1. A system comprising:

a multi-tenant storage array comprising one or more storage devices; and

a storage controller operatively coupled to the multi-tenant storage array, the storage controller comprising a processing device, the processing device configured to:

receive a request to write a data block to a volume resident on the multi-tenant storage array, wherein the request is associated with a first tenant of the multi-tenant storage array; and

based on a determination that the data block is deduplicatable, decrypt the data block to generate a decrypted data block;

determine that the decrypted data block matches an existing data block associated with a second tenant of the multi-tenant storage array;

based on the determination that the decrypted data block matches the existing data block, generate a shared volume encryption key;

encrypt the existing data block with the generated shared volume encryption key;

encrypt the shared volume encryption key with a first tenant encryption key associated with the first tenant;

encrypt the shared volume encryption key with a second tenant encryption key associated with the second tenant; and

store, in a tenant key data structure, the shared volume encryption key encrypted with the first tenant encryption key and the shared volume encryption key encrypted with the second tenant encryption key mapped to an identifier of the volume.

2. The system of claim 1 , wherein to decrypt the data block to generate the decrypted data block, the processing device is further configured to:

retrieve the first tenant encryption key based on a determination that the first tenant owns the data block.

3. The system of claim 2 , wherein to determine that the first tenant owns the data block, the processing device is further configured to retrieve an identifier of the first tenant from the tenant key data structure.

4. The system of claim 2 , wherein to retrieve the first tenant encryption key, the processing device is further configured to retrieve the first tenant encryption key from a key management server.

5. The system of claim 1 , wherein the processing device is further configured to:

generate the shared volume encryption key based on a determination that the shared volume encryption key does not already exist.

6. The system of claim 1 , wherein the data block is encrypted with a first volume encryption key, and wherein the processing device is further configured to:

generate the shared volume encryption key to be distinct from the first volume encryption key.

7. A method comprising:

receive a request to write a data block to a volume resident on the multi-tenant storage array, wherein the request is associated with a first tenant of the multi-tenant storage array; and

based on a determination that the data block is deduplicatable, decrypt the data block to generate a decrypted data block;

determine that the decrypted data block matches an existing data block associated with a second tenant of the multi-tenant storage array;

based on the determination that the decrypted data block matches the existing data block, generate a shared volume encryption key;

encrypt the existing data block with the generated shared volume encryption key;

encrypt the shared volume encryption key with a first tenant encryption key associated with the first tenant;

encrypt the shared volume encryption key with a second tenant encryption key associated with the second tenant; and

store, in a tenant key data structure, the shared volume encryption key encrypted with the first tenant encryption key and the shared volume encryption key encrypted with the second tenant encryption key mapped to an identifier of the volume.

8. The method of claim 7 , wherein to decrypt the data block to generate the decrypted data block, the method further comprises:

retrieving the first tenant encryption key based on a determination determining that the first tenant owns the data block; and

retrieving the first tenant encryption key.

9. The method of claim 8 , wherein to determine that the first tenant owns the data block, the method further comprises retrieving an identifier of the first tenant from the tenant key data structure.

10. The method of claim 8 , wherein to retrieve the first tenant encryption key, the method further comprises retrieving the first tenant encryption key from a key management server.

11. The method of claim 7 , further comprising:

generating the shared volume encryption key based on a determination that the shared volume encryption key does not already exist.

12. A non-transitory computer readable storage medium storing instructions, which when executed, cause a processing device to:

receive a request to write a data block to a volume resident on the multi-tenant storage array, wherein the request is associated with a first tenant of the multi-tenant storage array; and

based on a determination that the data block is deduplicatable, decrypt the data block to generate a decrypted data block;

determine that the decrypted data block matches an existing data block associated with a second tenant of the multi-tenant storage array;

based on the determination that the decrypted data block matches the existing data block, generate a shared volume encryption key;

encrypt the existing data block with the generated shared volume encryption key;

encrypt the shared volume encryption key with a first tenant encryption key associated with the first tenant;

encrypt the shared volume encryption key with a second tenant encryption key associated with the second tenant; and

store, in a tenant key data structure, the shared volume encryption key encrypted with the first tenant encryption key and the shared volume encryption key encrypted with the second tenant encryption key mapped to an identifier of the volume.