Performing deduplication on multi-tenancy dataset
End-to-end encryption in a storage system with multi-tenancy, includes: performing deduplication on a first tenant dataset, the first tenant dataset including data encrypted using a first storage system encryption key; and performing deduplication on a second tenant dataset, the second tenant dataset including data encrypted using a second storage system encryption key, where deduplication is not performed between the first and second tenant datasets.
1 . A method implemented by a storage system comprising a processor and a memory, the method comprising:
deduplicating, by the processor of the storage system, different decrypted datasets of a particular tenant of a plurality of tenants storing datasets in the storage system, wherein the different decrypted datasets were previously encrypted with different storage system encryption keys for the particular tenant, wherein deduplication data for a decrypted dataset includes limiting deduplication processes to data within a same decrypted dataset; and
storing, within the storage system, the deduplicated tenant datasets.
2 . The method of claim 1 , further comprising:
performing deduplication on a first tenant dataset by performing deduplication on first metadata associated with the first tenant dataset, wherein the first metadata includes one or more of a first set of key identifiers or one or more initialization vectors;
performing deduplication on a second tenant dataset by performing deduplication on second metadata associated with the second tenant dataset, wherein the second metadata includes one or more of a second set of key identifiers or one or more initialization vectors; and
deduplication is not performed between metadata of the first tenant dataset and the second tenant dataset.
3 . The method of claim 2 , further comprising:
receiving a write request of data to be stored in the first tenant dataset, wherein the data is encrypted by a host with a host encryption key; and
storing the data in the first tenant dataset, including:
decrypting the data utilizing the host encryption key;
performing data reduction on the decrypted data;
encrypting the data utilizing a first storage system encryption key; and
storing the data encrypted with the first storage system encryption key in the first tenant dataset.
4 . The method of claim 3 , further comprising:
receiving a write request of data to be stored in the second tenant dataset, wherein the data is encrypted by the host with a second host encryption key; and
storing the data in the second tenant dataset, including:
decrypting the data utilizing the second host encryption key;
performing data reduction on the decrypted data;
encrypting the data utilizing a second storage system encryption key; and
storing the data encrypted with the second storage system encryption key in the second tenant dataset.
5 . The method of claim 3 , wherein:
decrypting the data utilizing a first host encryption key by generating re-encryption information describing details of re-encrypting the data utilizing the first host encryption key.
6 . The method of claim 5 , wherein the re-encryption information comprises the first host encryption key and an initialization vector for use in re-encrypting the data.
7 . The method of claim 5 , wherein the re-encryption information specifies a method of calculating the first host encryption key and an initialization vector for use in re-encrypting the data.
8 . The method of claim 1 , further comprising:
receiving a read request for data stored in a tenant dataset;
decrypting the data from the tenant dataset utilizing a storage system encryption key associated with the tenant dataset; and
re-encrypting the data utilizing a host encryption key and re-encryption information.
9 . The method of claim 1 , wherein performing deduplication on the different decrypted tenant datasets comprises in-line deduplication.
10 . The method of claim 1 , wherein performing deduplication on the different decrypted tenant datasets comprises in-place deduplication.
11 . The method of claim 1 , further comprising:
performing deduplication on a first tenant dataset and generating a first block key for a first block of data in the first tenant dataset;
performing deduplication on a second tenant dataset and generating a second block key for a second block of data in the second tenant dataset, wherein the first block of data and the second block of data match and the first block key and the second block key match; and
storing, in metadata for the first tenant dataset and the second tenant dataset, a location of the matching block of data and the respective block key.
12 . A storage system, comprising:
a memory; and
a processing device, operatively coupled to the memory, configured to:
deduplicate, by the processing device of the storage system, different decrypted datasets of a particular tenant of a plurality of tenants storing datasets in the storage system, wherein the different decrypted datasets were previously encrypted with different storage system encryption keys for the particular tenant, wherein deduplication data for a decrypted dataset includes limiting deduplication processes to data within a same decrypted dataset; and
store, within the storage system, the deduplicated tenant datasets.
13 . The storage system of claim 12 , wherein the processing device is further configured to:
perform deduplication on a first tenant dataset by performing deduplication on first metadata associated with the first tenant dataset, wherein the first metadata includes one or more of a first set of key identifiers or one or more initialization vectors; and
perform deduplication on a second tenant dataset by performing deduplication on second metadata associated with the second tenant dataset, wherein the second metadata includes one or more of a second set of key identifiers or one or more initialization vectors.
14 . The storage system of claim 13 , wherein the processing device is further configured to:
receive a write request of data to be stored in the first tenant dataset, wherein the data is encrypted by a host with a host encryption key; and
store the data in the first tenant dataset, including:
decrypt the data utilizing the host encryption key;
perform data reduction on the decrypted data;
encrypt the data utilizing a first storage system encryption key; and
store the data encrypted with the first storage system encryption key in the first tenant dataset.
15 . The storage system of claim 14 , wherein the processing device is further configured to:
receive a write request of data to be stored in the second tenant dataset, wherein the data is encrypted by the host with a second host encryption key; and
store the data in the second tenant dataset, including:
decrypt the data utilizing the second host encryption key;
perform data reduction on the decrypted data;
encrypt the data utilizing a second storage system encryption key; and
store the data encrypted with the second storage system encryption key in the second tenant dataset.
16 . The storage system of claim 15 , wherein the processing device is further configured to:
decrypt the data utilizing a first host encryption key by generating re-encryption information describing details of re-encrypting the data utilizing the first host encryption key.
17 . The storage system of claim 16 , wherein the re-encryption information comprises the first host encryption key and an initialization vector for use in re-encrypting the data.
18 . The storage system of claim 16 , wherein the re-encryption information specifies a method of calculating the first host encryption key and an initialization vector for use in re-encrypting the data.
19 . The storage system of claim 18 , wherein the processing device is further configured to:
receive a read request for data stored in a tenant dataset;
decrypt the data from the tenant dataset utilizing a storage system encryption key associated with the tenant dataset; and
re-encrypt the data utilizing a host encryption key and re-encryption information.
20 . A non-transitory computer readable storage medium storing instructions which, when executed, cause a processor of a storage system to:
deduplicate, by the processor of the storage system, different decrypted datasets of a particular tenant of a plurality of tenants storing datasets in the storage system, wherein the different decrypted datasets were previously encrypted with different storage system encryption keys for the particular tenant, wherein deduplication data for a decrypted dataset includes limiting deduplication processes to data within a same decrypted dataset; and
store, within the storage system, the deduplicated tenant datasets.