Performing deduplication based on encrypted storage blocks generated using a secure enclave
Deduplication can be performed based on encrypted storage blocks generated by a secure enclave. For example, a secure enclave can generate a first encrypted storage block and a second encrypted storage block using an encryption key. The first encrypted storage block can be an encrypted version of a first storage block and the second encrypted storage block can be an encrypted version of a second storage block. The secure enclave can then provide the first encrypted storage block and the second encrypted storage block to a supervisory program executable on a processor that is separate from the secure enclave. The supervisory program can be configured to initiate deduplication of the first storage block and the second storage block in response to determining that the first encrypted storage block matches the second encrypted storage block.
1. A method comprising:
generating, by a secure enclave, a first encrypted storage block and a second encrypted storage block using an encryption key, the first encrypted storage block being an encrypted version of a first storage block and the second encrypted storage block being an encrypted version of a second storage block; and
providing, by the secure enclave, the first encrypted storage block and the second encrypted storage block to a supervisory program executing on a processor that is separate from the secure enclave, the supervisory program being configured to initiate deduplication of the first storage block and the second storage block in response to determining that the first encrypted storage block matches the second encrypted storage block.
2. The method of claim 1 , wherein the encryption key is maintained in the secure enclave and concealed from the supervisory program.
3. The method of claim 1 , further comprising:
generating, by the secure enclave, the encryption key without generating a corresponding decryption key.
4. The method of claim 1 , further comprising:
deleting, by the secure enclave, the encryption key subsequent to generating the first encrypted storage block and the second encrypted storage block.
5. The method of claim 1 , further comprising the secure enclave repeatedly performing an encryption process, wherein each iteration of the encryption process involves:
generating a new encryption key that is different from an existing encryption key used in a previous iteration of the encryption process; and
encrypting the first storage block and the second storage block using the new encryption key to generate a new version of the first encrypted storage block and a new version of the second encrypted storage block, respectively.
6. The method of claim 1 , wherein the first storage block and the second storage block are duplicate memory pages.
7. The method of claim 1 , wherein the secure enclave and the processor are parts of the same computing device.
8. The method of claim 1 , further comprising:
generating, by the secure enclave, a third encrypted storage block and a fourth encrypted storage block using the encryption key, the third encrypted storage block being an encrypted version of a third storage block and the fourth encrypted storage block being an encrypted version of a fourth storage block;
providing, by the secure enclave, the third encrypted storage block and the fourth encrypted storage block to the supervisory program executing on the processor;
determining, by the supervisory program, that the third encrypted storage block is different from the fourth encrypted storage block; and
in response to determining that the third encrypted storage block is different from the fourth encrypted storage block, preventing, by the supervisory program, deduplication from being performed in relation to the third storage block and the fourth storage block.
9. The method of claim 1 , further comprising, prior to generating the first encrypted storage block and the second encrypted storage block using the encryption key:
receiving, by the secure enclave, the first storage block and the second storage block from a storage device that is separate from the secure enclave.
10. A non-transitory computer-readable medium comprising program code that is executable by a secure enclave for causing the secure enclave to:
generate a first encrypted storage block and a second encrypted storage block using an encryption key, the first encrypted storage block being an encrypted version of a first storage block and the second encrypted storage block being an encrypted version of a second storage block; and
provide the first encrypted storage block and the second encrypted storage block to a supervisory program executable on a processor that is separate from the secure enclave, the supervisory program being configured to initiate deduplication of the first storage block and the second storage block in response to determining that the first encrypted storage block matches the second encrypted storage block.
11. The non-transitory computer-readable medium of claim 10 , wherein the encryption key is maintained in the secure enclave and concealed from the supervisory program.
12. The non-transitory computer-readable medium of claim 10 , further comprising program code that is executable by the secure enclave for causing the secure enclave to:
delete the encryption key subsequent to generating the first encrypted storage block and the second encrypted storage block.
13. The non-transitory computer-readable medium of claim 10 , further comprising program code that is executable by the secure enclave for causing the secure enclave to repeatedly perform an encryption process, wherein each iteration of the encryption process involves:
deleting an existing version of the first encrypted storage block and an existing version of the second encrypted storage block;
generating a new encryption key that is different from an existing encryption key used to generate the existing version of the first encrypted storage block and the existing version of the second encrypted storage block;
encrypting the first storage block and the second storage block using the new encryption key to generate a new version of the first encrypted storage block and a new version of the second encrypted storage block, respectively; and
providing the new version of the first encrypted storage block and the new version of the second encrypted storage block to the supervisory program for use in a deduplication process.
14. The non-transitory computer-readable medium of claim 10 , wherein the first storage block and the second storage block are duplicate memory pages.
15. The non-transitory computer-readable medium of claim 10 , wherein the supervisory program is a kern el of an operating system executable by the processor.
16. The non-transitory computer-readable medium of claim 10 , wherein the secure enclave is in a first computing device and the processor is in a second computing device that is separate from the first computing device.
17. The non-transitory computer-readable medium of claim 10 , further comprising program code that is executable by the secure enclave for causing the secure enclave to:
generate a third encrypted storage block and a fourth encrypted storage block using the encryption key, the third encrypted storage block being an encrypted version of a third storage block and the fourth encrypted storage block being an encrypted version of a fourth storage block; and
provide the third encrypted storage block and the fourth encrypted storage block to the supervisory program, the supervisory program being configured to prevent deduplication from being performed in relation to the third storage block and the fourth storage block in response to determining that the third encrypted storage block is different from the fourth encrypted storage block.
18. A system comprising:
a secure enclave including a secure enclave processor; and
a memory including instructions that are executable by the secure enclave processor for causing the secure enclave to:
generate a first encrypted storage block and a second encrypted storage block using an encryption key, the first encrypted storage block being an encrypted version of a first storage block and the second encrypted storage block being an encrypted version of a second storage block; and
provide the first encrypted storage block and the second encrypted storage block to a supervisory program executable on a processor that is separate from the secure enclave, the supervisory program being configured to initiate deduplication of the first storage block and the second storage block in response to determining that the first encrypted storage block matches the second encrypted storage block.
19. The system of claim 18 , wherein the encryption key is maintained in the secure enclave and concealed from the supervisory program.
20. The system of claim 18 , wherein the memory further includes instructions that are executable by the processor for causing the secure enclave to repeatedly perform an encryption process, wherein each iteration of the encryption process involves:
deleting an existing encryption key stored in the secure enclave and used in a previous iteration of the encryption process;
deleting an existing version of the first encrypted storage block and an existing version of the second encrypted storage block generated during the previous iteration of the encryption process using the existing encryption key;
generating a new encryption key that is different from the existing encryption key;
encrypting the first storage block and the second storage block using the new encryption key to generate a new version of the first encrypted storage block and a new version of the second encrypted storage block, respectively; and
providing the new version of the first encrypted storage block and the new version of the second encrypted storage block to the supervisory program for use in a deduplication process.