End-to-end encryption in a storage system with multi-tenancy
End-to-end encryption in a storage system with multi-tenancy, includes: performing deduplication on a first tenant dataset, the first tenant dataset including data encrypted using a first storage system encryption key; and performing deduplication on a second tenant dataset, the second tenant dataset including data encrypted using a second storage system encryption key, where deduplication is not performed between the first and second tenant datasets.
1. A method comprising:
storing, by a storage system, a first tenant dataset encrypted with a first storage system encryption key and a second tenant dataset encrypted with a second storage system encryption key that is different from the first storage system encryption key;
decrypting, by the storage system, the first tenant dataset and the second tenant dataset;
performing, by the storage system, deduplication operations on first data stored by the storage system
without deduplicating data between the decrypted first tenant dataset and the decrypted second tenant dataset; and
storing the deduplicated first tenant dataset and the deduplicated second tenant dataset.
2. The method of claim 1 , wherein:
performing deduplication on the first tenant dataset further comprises performing deduplication on first metadata associated with the first tenant dataset, wherein the first metadata includes one or more of a first set of key identifiers or one or more initialization vectors;
performing deduplication on the second tenant dataset further comprises performing deduplication on the second metadata associated with the second tenant dataset, wherein the second metadata includes one or more of a second set of key identifiers or one or more initialization vectors; and
deduplication is not performed between the metadata of the first and the second datasets.
3. The method of claim 1 , further comprising:
receiving a write request of data to be stored in the first tenant dataset, wherein the data is encrypted by a host with a first host encryption key; and
storing the data in the first tenant dataset, including:
decrypting the data utilizing the first host encryption key;
performing data reduction on the unencrypted data;
encrypting the data utilizing the first storage system encryption key; and
storing the data encrypted with the first storage system encryption key in the first tenant dataset.
4. The method of claim 3 , further comprising:
receiving a write request of data to be stored in the second tenant dataset, wherein the data is encrypted by the host with a second host encryption key; and
storing the data in the second tenant dataset, including:
decrypting the data utilizing the second host encryption key;
performing data reduction on the unencrypted data;
encrypting the data utilizing the second storage system encryption key; and
storing the data encrypted with the second storage system encryption key in the second tenant dataset.
5. The method of claim 3 , wherein:
decrypting the data utilizing the first host encryption key further comprises generating re-encryption information describing details of re-encrypting the data utilizing the first host encryption key.
6. The method of claim 5 , wherein the re-encryption information comprises the first host encryption key and an initialization vector for use in re-encrypting the data.
7. The method of claim 5 , wherein the re-encryption information specifies a method of calculating the first host encryption key and an initialization vector for use in re-encrypting the data.
8. The method of claim 1 , further comprising:
receiving a read request for data stored in the first tenant dataset;
decrypting the data from the first tenant dataset utilizing the first storage system encryption key; and
re-encrypting the data utilizing a host encryption key and re-encryption information.
9. The method of claim 1 , further comprising:
receiving a read request for data stored in the second tenant dataset;
decrypting the data from the second tenant dataset utilizing the second storage system encryption key; and
re-encrypting the data utilizing another host encryption key and re-encryption information.
10. The method of claim 1 , wherein performing deduplication on the first tenant dataset and performing deduplication on the second tenant dataset comprises in-line deduplication.
11. The method of claim 1 , wherein performing deduplication on the first tenant dataset and performing deduplication on the second tenant dataset comprises in-place deduplication.
12. A storage system including a computer memory and a computer processor, the computer memory including computer program instructions that, when executed by the computer processor, cause a storage system to carry out the steps of:
storing, by a storage system, a first tenant dataset encrypted with a first storage system encryption key and a second tenant dataset encrypted with a second storage system encryption key that is different from the first storage system encryption key;
decrypting, by the storage system, the first tenant dataset and the second tenant dataset;
performing, by the storage system, deduplication operations on data stored by the storage system
without deduplicating data between the decrypted first tenant dataset and the decrypted second tenant dataset; and
storing the deduplicated first tenant dataset and the deduplicated second tenant dataset.
13. The storage system of claim 12 , wherein:
performing deduplication on the first tenant dataset further comprises performing deduplication on metadata associated with the first tenant dataset;
performing deduplication on the second tenant dataset further comprises performing deduplication on metadata associated with the second tenant dataset; and
deduplication is not performed between the metadata of the first and the second datasets.
14. The storage system of claim 12 , further comprising computer program instructions that, when executed by the computer processor, cause the storage system to carry out the steps of:
receiving a write request of data to be stored in the first tenant dataset, wherein the data is encrypted by a host with a first host encryption key; and
storing the data in the first tenant dataset, including:
decrypting the data utilizing the first host encryption key;
performing data reduction on the unencrypted data;
encrypting the data utilizing the first storage system encryption key; and
storing the data encrypted with the first storage system encryption key in the first tenant dataset.
15. The storage system of claim 14 , further comprising computer program instructions that, when executed by the computer processor, cause the storage system to carry out the steps of:
receiving a write request of data to be stored in the second tenant dataset, wherein the data is encrypted by the host with a second host encryption key; and
storing the data in the second tenant dataset, including:
decrypting the data utilizing the second host encryption key;
performing data reduction on the unencrypted data;
encrypting the data utilizing the second storage system encryption key; and
storing the data encrypted with the second storage system encryption key in the second tenant dataset.
16. The storage system of claim 15 , wherein:
decrypting the data utilizing the first host encryption key further comprises generating re-encryption information describing details of re-encrypting the data utilizing the first host encryption key.
17. The storage system of claim 16 , wherein the re-encryption information comprises the first host encryption key and an initialization vector for use in re-encrypting the data.
18. The storage system of claim 16 , wherein the re-encryption information specifies a method of calculating the first host encryption key and an initialization vector for use in re-encrypting the data.
19. The storage system of claim 18 , further comprising computer program instructions that, when executed by the computer processor, cause the storage system to carry out the steps of:
receiving a read request for data stored in the first tenant dataset;
decrypting the data from the first tenant dataset utilizing the first storage system encryption key; and
re-encrypting the data utilizing the first host encryption key and re-encryption information.
20. The storage system of claim 18 , further comprising computer program instructions that, when executed by the computer processor, cause the storage system to carry out the steps of:
receiving a read request for data stored in the second tenant dataset;
decrypting the data from the second tenant dataset utilizing the second storage system encryption key; and
re-encrypting the data utilizing the second host encryption key and re-encryption information.