Multi-path end-to-end encryption in a storage system

1. A method comprising:

receiving, by a storage system from a host device through a first path of a plurality of paths, a first write request for first data to be stored in a dataset, wherein the storage system is connected to a plurality of host devices over the plurality of paths;

based on receiving the first write request through the first path of the plurality of paths, decrypting, by the storage system, the first data utilizing a first path-specific encryption key that is specified for requests received by the storage system through only the first path of the plurality of paths from the plurality of host devices;

storing the first data in the dataset, wherein the first data is encrypted using a storage system encryption key;

receiving, by the storage system from the host device through a second path, a second write request for second data to be stored in the dataset;

based on receiving the second write request through the second path, decrypting, by the storage system, the second data utilizing a second path-specific encryption key that is different from the first path-specific encryption key and is specified for requests received by the storage system through only the second path of the plurality of paths from the plurality of host devices; and

storing the second data in the dataset, wherein the second data is encrypted using the storage system encryption key.

2. The method of claim 1 , further comprising:

receiving, through the first path, a read request for the first data;

decrypting the first data utilizing the storage system encryption key;

encrypting the first data with the first encryption key; and

returning the encrypted first data through the first path.

3. The method of claim 1 , further comprising:

receiving, through the second path, a request for the first data;

decrypting the first data utilizing the storage system encryption key;

encrypting the first data with the second encryption key; and

returning the encrypted first data through the second path.

4. The method of claim 1 , further comprising:

receiving, through the first path, a request for the first data;

decrypting the first data utilizing the storage system encryption key;

upon the host device detecting inaccessibility of the first path, and reissuing the request for the first data along the second path;

encrypting the first data with the second encryption key; and

returning the encrypted first data through the second path.

5. The method of claim 1 , further comprising:

receiving, through the first path, a read request for the first data;

decrypting the first data utilizing the storage system encryption key;

upon the host device detecting inaccessibility of the first path, and reissuing the request for the first data along the second path;

encrypting the first data with the first encryption key; and

returning the encrypted first data along the second path.

6. The method of claim 1 , further comprising:

performing data reduction on the first data, prior to encrypting the first data using the storage system encryption key and storing the encrypted first data.

7. The method of claim 1 , wherein decrypting the first data utilizing the first encryption key further comprises generating re-encryption information describing details of re-encrypting the first data utilizing the first encryption key.

8. The method of claim 1 , further comprising:

receiving a read request for the first data;

decrypting the first data utilizing the storage system encryption key; and

prior to re-encryption, decompressing the first data.

9. A storage system including a computer memory and a computer processor, the computer memory including computer program instructions that, when executed by the computer processor, cause the storage system to carry out the steps of:

receiving, by the storage system from a host device through a first path of a plurality of paths, a first write request for first data to be stored in a dataset, wherein the storage system is connected to a plurality of host devices over the plurality of paths;

based on receiving the first write request through the first path of the plurality of paths, decrypting, by the storage system, the first data utilizing a first path-specific encryption key that is specified for requests received by the storage system through only the first path of the plurality of paths from the plurality of host devices;

storing the first data in the dataset, wherein the first data is encrypted using a storage system encryption key;

receiving, by the storage system from the host device through a second path, a second write request for second data to be stored in the dataset;

based on receiving the second write request through the second path, decrypting, by the storage system, the second data utilizing a second path-specific encryption key that is different from the first path-specific encryption key and is specified for requests received by the storage system through only the second path of the plurality of paths from the a plurality of host devices; and

storing the second data in the dataset, wherein the second data is encrypted using the storage system encryption key.

10. The storage system of claim 9 , further comprising computer program instructions that, when executed by the computer processor, cause the storage system to carry out the steps of:

receiving, through the first path, a read request for the first data;

decrypting the first data utilizing the storage system encryption key;

encrypting the first data with the first encryption key; and

returning the encrypted first data through the first path.

11. The storage system of claim 9 , further comprising computer program instructions that, when executed by the computer processor, cause the storage system to carry out the steps of:

receiving, through the second path, a request for the first data;

decrypting the first data utilizing the storage system encryption key;

encrypting the first data with the second encryption key; and

returning the encrypted first data through the second path.

12. The storage system of claim 9 , further comprising computer program instructions that, when executed by the computer processor, cause the storage system to carry out the steps of:

receiving, through the first path, a request for the first data; decrypting the first data utilizing the storage system encryption key;

upon the host device detecting inaccessibility of the first path, and reissuing the request for the first data along the second path;

encrypting the first data with the second encryption key; and

returning the encrypted first data through the second path.

13. The storage system of claim 11 , further comprising computer program instructions that, when executed by the computer processor, cause the storage system to carry out the steps of:

receiving, through the first path, a read request for the first data;

decrypting the first data utilizing the storage system encryption key;

detecting inaccessibility of the first path;

encrypting the first data with the first encryption key; and

returning the encrypted first data along the second path.

14. The storage system of claim 11 , further comprising computer program instructions that, when executed by the computer processor, cause the storage system to carry out the step of:

performing data reduction on the first data, prior to encrypting the first data using the storage system encryption key and storing the encrypted first data.

15. The storage system of claim 11 , wherein decrypting the first data utilizing the first encryption key further comprises generating re-encryption information describing details of re-encrypting the first data utilizing the first encryption key.

16. The storage system of claim 11 , further comprising computer program instructions that, when executed by the computer processor, cause the storage system to carry out the steps of:

receiving a read request for the first data;

decrypting the first data utilizing the storage system encryption key; and

prior to re-encryption, decompressing the first data.