Enhanced data encryption in distributed datastores using a cluster-wide fixed random tweak

1. A method for encrypting data in one or more data blocks, the method comprising:

generating a fixed random tweak;

receiving a first data block to write on at least one physical disk of a set of physical disks associated with a set of host machines;

applying the fixed random tweak to data indicative of the first data block to generate a first encrypted data block;

writing a first entry to a data log in a cache, the first entry comprising a first header and the first encrypted data block;

writing the first encrypted data block to the at least one physical disk;

receiving a second data block, different from the first data block, to write on the at least one physical disk;

applying the fixed random tweak to data indicative of the second data block to generate a second encrypted data block;

writing a second entry to the data log, the second entry comprising a second header and the second encrypted data block; and

writing the second encrypted data block to the at least one physical disk.

2. The method of claim 1 , further comprising, before applying the fixed random tweak to the data indicative of the first data block, compressing data in the received first data block to generate the data indicative of the first data block.

3. The method of claim 1 , wherein generating the fixed random tweak comprises generating the fixed random tweak when the set of physical disks associated with the set of host machines is initially formatted and associated with a storage cluster.

4. The method of claim 1 , wherein writing the first and second encrypted data blocks to the at least one physical disk comprises writing the first and second encrypted data blocks to the at least one physical disk as part of a stripe comprising a plurality of additional encrypted data blocks and the first and second encrypted data blocks.

5. The method of claim 4 , wherein writing the first and second encrypted data blocks to the at least one physical disk as part of the stripe comprises writing the first and second encrypted data blocks and the plurality of additional encrypted data blocks on multiple physical disks across multiple host machines without decrypting the encrypted data blocks.

6. The method of claim 1 , wherein at least one of the set of host machines that comprises one of the set of physical disks performs deduplication on encrypted data blocks stored on the one physical disk without decrypting the encrypted data blocks.

7. The method of claim 1 , wherein the applying the fixed random tweak comprises using advanced encryption standard text encryption.

8. A non-transitory computer readable medium comprising instructions that, when executed by one or more processors of a computing system, cause the computing system to perform a method of encrypting data in one or more data blocks, the method comprising:

generating a fixed random tweak;

receiving a first data block to write on at least one physical disk of a set of physical disks associated with a set of host machines;

applying the fixed random tweak to data indicative of the first data block to generate a first encrypted data block;

writing a first entry to a data log in a cache, the first entry comprising a first header and the first encrypted data block;

writing the first encrypted data block to the at least one physical disk;

receiving a second data block, different from the first data block, to write on the at least one physical disk;

applying the fixed random tweak to data indicative of the second data block to generate a second encrypted data block;

writing a second entry to the data log, the second entry comprising a second header and the second encrypted data block; and

writing the second encrypted data block to the at least one physical disk.

9. The non-transitory computer readable medium of claim 8 , wherein the method further comprises:

before applying the fixed random tweak to the data indicative of the first data block, compressing data in the received first data block to generate the data indicative of the first data block.

10. The non-transitory computer readable medium of claim 8 , wherein generating the fixed random tweak comprises generating the fixed random tweak when the set of physical disks associated with the set of host machines is initially formatted and associated with a storage cluster.

11. The non-transitory computer readable medium of claim 8 , wherein writing the first and second encrypted data blocks to the at least one physical disk comprises writing the first and second encrypted data blocks to the at least one physical disk as part of a stripe comprising a plurality of additional encrypted data blocks and the first and second encrypted data blocks.

12. The non-transitory computer readable medium of claim 11 , wherein writing the first and second encrypted data blocks to the at least one physical disk as part of the stripe comprises writing the first and second encrypted data blocks and the plurality of additional encrypted data blocks on multiple physical disks across multiple host machines without decrypting the encrypted data blocks.

13. The non-transitory computer readable medium of claim 8 , wherein at least one of the set of host machines that comprises one of the set of physical disks performs deduplication on encrypted data blocks stored on the one physical disk without decrypting the encrypted data blocks.

14. A computer system, comprising:

a memory; and

a processor coupled to the memory, the processor being configured to:

generate a fixed random tweak;

receive a first data block to write on at least one physical disk of a set of physical disks associated with a set of host machines;

apply the fixed random tweak to data indicative of the first data block to generate a first encrypted data block;

write a first entry to a data log in a cache, the first entry comprising a first header and the first encrypted data block;

write the first encrypted data block to the at least one physical disk;

receive a second data block, different from the first data block, to write on the at least one physical disk;

apply the fixed random tweak to data indicative of the second data block to generate a second encrypted data block;

write a second entry to the data log, the second entry comprising a second header and the second encrypted data block; and

write the second encrypted data block to the at least one physical disk.

15. The computer system of claim 14 , wherein the processor is further configured to:

before applying the fixed random tweak to the data indicative of the first data block, compressing data in the received first data block to generate the data indicative of the first data block.

16. The computer system of claim 14 , wherein generating the fixed random tweak comprises generating the fixed random tweak when the set of physical disks associated with the set of host machines is initially formatted and associated with a storage cluster.

17. The computer system of claim 14 , wherein writing the first and second encrypted data blocks to the at least one physical disk comprises writing the first and second encrypted data blocks to the at least one physical disk as part of a stripe comprising a plurality of additional encrypted data blocks and the first and second encrypted data blocks.

18. The computer system of claim 17 , wherein writing the first and second encrypted data blocks to the at least one physical disk as part of the stripe comprises writing the first and second encrypted data blocks and the plurality of additional encrypted data blocks on multiple physical disks across multiple host machines without decrypting the encrypted data blocks.

19. The computer system of claim 14 , wherein at least one of the set of host machines that comprises one of the set of physical disks performs deduplication on encrypted data blocks stored on the one physical disk without decrypting the encrypted data blocks.

20. The computer system of claim 14 , wherein the applying the fixed random tweak comprises using advanced encryption standard text encryption.