Granted Patent B2

US 11,418,326 · App. 16/925,647 · Granted Aug 16, 2022

Inventors: Dharmesh M. Patel (Round Rock, TX); Rizwan Ali (Cedar Park, TX); Ravikanth Chaganti (Bangalore, IN)

Assignee: Dell Products L.P.

H04L9/0822H04L9/083H04L9/0894H04L9/14

Abstract

Claims (133)

1. A method for securing data in a data cluster, comprising:

receiving, by the data cluster, a write request for a user to write data to the data cluster, wherein the write request comprises an object identifier (OID) associated with data and a user identifier (UID) associated with the user;

sending, to a key manager, an intermediate key request, wherein the intermediate key request comprises the UID;

receiving, by the data cluster from the key manager, an intermediate key, wherein:

the intermediate key is generated in response to the intermediate key request,

the intermediate key is generated using a data cluster key and a user key,

the user key is obtained using the UID, and

the intermediate key is not persistently stored in the key manager;

processing the data to obtain a plurality of chunks and metadata associated with the plurality of chunks;

generating an encryption key using the intermediate key and the OID;

encrypting the metadata using the encryption key to generate encrypted metadata;

deleting, after generating the encrypted metadata, the encryption key; and

storing the encrypted metadata and the plurality of chunks in the data cluster.

2. The method of claim 1 , further comprising:

prior to receiving the write request:

receiving, by the key manager, a data cluster identifier (DCID) from the data cluster;

generating, by the key manager, a data cluster key; and

associating, the DCID with the data cluster key,

wherein the intermediate key request further comprises the DCID.

3. The method of claim 2 , further comprising:

prior to receiving the write request:

receiving, by the key manager, the UID from a host operatively connected to the key manager and a data manager;

generating, by the key manager, a user key; and

associating, the UID with the user key.

4. The method of claim 1 , further comprising:

receiving, by the data cluster, a read request for the user to read the data from the data cluster, wherein the read request comprises OID associated with data and the UID;

sending, to the key manager, a second intermediate key request, wherein the second intermediate key request comprises the UID;

receiving, by the data cluster from the key manager, the intermediate key;

generating the encryption key using the intermediate key and the OID;

decrypting the encrypted metadata to obtain the metadata;

obtaining the plurality of chunks using the metadata;

deleting, after the decrypting the encrypted metadata, the encryption key; and

providing the plurality of chunks in the data cluster to a data manager.

5. The method of claim 1 , further comprising:

receiving, by the data cluster, an authorization update request for the data, wherein the authorization update request comprises OID associated with data and a second UID associated with a second user;

sending, to the key manager, a second intermediate key request, wherein the second intermediate key request comprises the UID;

receiving, by the data cluster from the key manager, the intermediate key;

generating the encryption key using the intermediate key and the OID;

decrypting the encrypted metadata to obtain the metadata;

after the decrypting:

obtaining the UID from the metadata;

ending, to the key manager, a third intermediate key request, wherein the second intermediate key request comprises the UID and the second UID;

receiving, by the data cluster from the key manager, a second intermediate key;

generating a second encryption key using the second intermediate key and the OID;

encrypting the metadata using the second encryption key to generate second encrypted metadata;

deleting, after generating the second encrypted metadata, the second encryption key; and

storing the second encrypted metadata and the plurality of chunks in the data cluster.

6. The method of claim 1 , wherein processing the data to obtain the plurality of chunks comprises at least one selected from a grouped consistent of erasure coding and deduplication.

7. The method of claim 1 , wherein the metadata comprises at least one selected from a group consisting of storage metadata and object metadata.

8. A system, comprising:

a processor;

a data processor of a data cluster, which when executed by the processor performs a method, the method comprising:

receiving, by the data cluster, a write request for a user to write data to the data cluster, wherein the write request comprises an object identifier (OID) associated with data and a user identifier (UID) associated with the user;

sending, to a key manager, an intermediate key request, wherein the intermediate key request comprises the UID;

receiving, by the data cluster from the key manager, an intermediate key, wherein:

the intermediate key is generated in response to the intermediate key request,

the intermediate key is generated using a data cluster key and a user key,

the user key is obtained using the UID, and

the intermediate key is not persistently stored in the key manager;

processing the data to obtain a plurality of chunks and metadata associated with the plurality of chunks;

generating an encryption key using the intermediate key and the OID;

encrypting the metadata using the encryption key to generate encrypted metadata;

deleting, after generating the encrypted metadata, the encryption key; and

storing the encrypted metadata and the plurality of chunks in the data cluster.

9. The system of claim 8 , wherein the method further comprises:

prior to receiving the write request:

receiving, by the key manager, a data cluster identifier (DCID) from the data cluster;

generating, by the key manager, a data cluster key; and

associating, the DCID with the data cluster key,

wherein the intermediate key request further comprises the DCID.

10. The system of claim 9 , wherein the method further comprises:

prior to receiving the write request:

receiving, by the key manager, the UID from a host operatively connected to the key manager and a data manager;

generating, by the key manager, a user key; and

associating, the UID with the user key.

11. The system of claim 8 , wherein the method further comprises:

receiving, by the data cluster, a read request for the user to read the data from the data cluster, wherein the read request comprises OID associated with data and the UID;

sending, to the key manager, a second intermediate key request, wherein the second intermediate key request comprises the UID;

receiving, by the data cluster from the key manager, the intermediate key;

generating the encryption key using the intermediate key and the OID;

decrypting the encrypted metadata to obtain the metadata;

obtaining the plurality of chunks using the metadata;

deleting, after the decrypting the encrypted metadata, the encryption key; and

providing the plurality of chunks in the data cluster to a data manager.

12. The system of claim 8 , wherein the method further comprises:

receiving, by the data cluster, an authorization update request for the data, wherein the authorization update request comprises OID associated with data and a second UID associated with a second user;

sending, to the key manager, a second intermediate key request, wherein the second intermediate key request comprises the UID;

receiving, by the data cluster from the key manager, the intermediate key;

generating the encryption key using the intermediate key and the OID;

decrypting the encrypted metadata to obtain the metadata;

after the decrypting:

obtaining the UID from the metadata;

ending, to the key manager, a third intermediate key request, wherein the second intermediate key request comprises the UID and the second UID;

receiving, by the data cluster from the key manager, a second intermediate key;

generating a second encryption key using the second intermediate key and the OID;

encrypting the metadata using the second encryption key to generate second encrypted metadata;

deleting, after generating the second encrypted metadata, the second encryption key; and

storing the second encrypted metadata and the plurality of chunks in the data cluster.

13. The system of claim 8 , wherein processing the data to obtain the plurality of chunks comprises at least one selected from a grouped consistent of erasure coding and deduplication.

14. The system of claim 8 , wherein the metadata comprises at least one selected from a group consisting of storage metadata and object metadata.

15. A non-transitory computer readable medium comprising computer readable program code, which when executed by a computer processor enables the computer processor to perform a method, the method comprising:

receiving, by a data cluster, a write request for a user to write data to the data cluster, wherein the write request comprises an object identifier (OID) associated with data and a user identifier (UID) associated with the user;

sending, to a key manager, an intermediate key request, wherein the intermediate key request comprises the UID;

receiving, by the data cluster from the key manager, an intermediate key, wherein:

the intermediate key is generated in response to the intermediate key request,

the intermediate key is generated using a data cluster key and a user key,

the user key is obtained using the UID, and

the intermediate key is not persistently stored in the key manager;

processing the data to obtain a plurality of chunks and metadata associated with the plurality of chunks;

generating an encryption key using the intermediate key and the OID;

encrypting the metadata using the encryption key to generate encrypted metadata;

deleting, after generating the encrypted metadata, the encryption key; and

storing the encrypted metadata and the plurality of chunks in the data cluster.

16. The non-transitory computer readable medium of claim 15 , wherein the method further comprises:

prior to receiving the write request:

receiving, by the key manager, a data cluster identifier (DCID) from the data cluster;

generating, by the key manager, a data cluster key; and

associating, the DCID with the data cluster key,

wherein the intermediate key request further comprises the DCID.

17. The non-transitory computer readable medium of claim 16 , wherein the method further comprises:

prior to receiving the write request:

receiving, by the key manager, the UID from a host operatively connected to the key manager and a data manager;

generating, by the key manager, a user key; and

associating, the UID with the user key.

18. The non-transitory computer readable medium of claim 15 , wherein the method further comprises:

receiving, by the data cluster, a read request for the user to read the data from the data cluster, wherein the read request comprises OID associated with data and the UID;

sending, to the key manager, a second intermediate key request, wherein the second intermediate key request comprises the UID;

receiving, by the data cluster from the key manager, the intermediate key;

generating the encryption key using the intermediate key and the OID;

decrypting the encrypted metadata to obtain the metadata;

obtaining the plurality of chunks using the metadata;

deleting, after the decrypting the encrypted metadata, the encryption key; and

providing the plurality of chunks in the data cluster to a data manager.

Assignments (9)

Priority Claims (1)

Continuity (1)

Cited By (1)

US 12,192,210