Deduplication in a trusted execution environment
Aspects and features of the present disclosure can provide a trusted, privacy-preserved deduplication process by executing deduplication functions in a trusted execution environment (TEE). In some examples, encrypted, incoming user data blocks are decrypted in the TEE to produce unencrypted user data blocks. An incoming digital fingerprint or each unencrypted user data block is produced. A processing device can compare the incoming digital fingerprint to existing digital fingerprints stored in the TEE to determine a presence of the incoming digital fingerprint and hence the presence of a copy of the data block in the storage platform, and writes the encrypted. Incoming data blocks are written to storage only when necessary. The technique allows public mass storage systems to meet cybersecurity objectives while achieving the storage space efficiency that deduplication provides.
1. A system comprising:
a processing device; and
at least one memory device including instructions that are executable by the processing device for causing the processing device to perform operations comprising:
receiving a plurality of encrypted, incoming user data blocks for a storage platform;
decrypting, in a trusted execution environment associated with the storage platform, the plurality of encrypted, incoming user data blocks to produce unencrypted user data blocks;
producing an incoming digital fingerprint from an unencrypted user data block of the unencrypted user data blocks;
comparing, for the unencrypted user data block, the incoming digital fingerprint to existing digital fingerprints stored in the trusted execution environment to determine a presence of the incoming digital fingerprint among the existing digital fingerprints; and
adding a reference count to a data pointer that identifies an encrypted, user data block as used by a tenant of the storage platform to deduplicate the encrypted, incoming user data block based on the presence of the incoming digital fingerprint.
2. The system of claim 1 , wherein the operations further comprise applying a hash function to the unencrypted user data block to produce the incoming digital fingerprint.
3. The system of claim 1 , wherein the operations further comprise:
storing at least some of the plurality of encrypted, incoming user data blocks in the storage platform; and
updating the plurality of existing digital fingerprints stored in the trusted execution environment.
4. The system of claim 1 , wherein the storage platform comprises a multitenancy, public storage platform.
5. The system of claim 4 , wherein the existing digital fingerprints comprise digital fingerprints corresponding to tenant data blocks from a plurality of tenants.
6. The system of claim 1 , wherein each of the plurality of encrypted, incoming user data blocks are received through a proxy to provide an interface protocol between a client and the storage platform, wherein the proxy further redirects the incoming user data blocks from storage locations specified in the interface protocol to the trusted execution environment.
7. A method comprising:
receiving, by a processing device, a plurality of encrypted, incoming user data blocks for a storage platform;
decrypting, by the processing device, in a trusted execution environment associated with the storage platform, the plurality of encrypted, incoming user data blocks to produce unencrypted user data blocks;
producing, by the processing device, an incoming digital fingerprint from an unencrypted user data block of the unencrypted user data blocks;
comparing, by the processing device, for the unencrypted user data block, the incoming digital fingerprint to existing digital fingerprints stored in the trusted execution environment to determine a presence of the incoming digital fingerprint among the existing digital fingerprints; and
adding, by the processing device, a reference count to a data pointer that identifies an encrypted, user data block as used by a tenant of the storage platform to deduplicate, the encrypted, incoming user data block based on the presence of the incoming digital fingerprint.
8. The method of claim 7 , further comprising applying a hash function to the unencrypted user data block to produce the incoming digital fingerprint.
9. The method of claim 7 , further comprising:
storing at least some of the plurality of encrypted, incoming user data blocks in the storage platform; and
updating the plurality of existing digital fingerprints stored in the trusted execution environment.
10. The method of claim 7 , wherein the storage platform comprises a multitenancy, public storage platform and the existing digital fingerprints comprise digital fingerprints corresponding to tenant data blocks from a plurality of tenants.
11. The method of claim 7 , wherein each of the plurality of encrypted, incoming user data blocks are received through a proxy to provide an interface protocol between a client and the storage platform, wherein the proxy further redirects the incoming user data blocks from storage locations specified in the interface protocol to the trusted execution environment.
12. A non-transitory computer-readable medium comprising program code that is executable by a processing device for causing the processing device to:
receive a plurality of encrypted, incoming user data blocks for a storage platform;
decrypt, in a trusted execution environment associated with the storage platform, the plurality of encrypted, incoming user data blocks to produce unencrypted user data blocks;
produce an incoming digital fingerprint from an unencrypted user data block of the unencrypted user data blocks;
compare, for the unencrypted user data block, the incoming digital fingerprint to existing digital fingerprints stored in the trusted execution environment to determine a presence of the incoming digital fingerprint among the existing digital fingerprints; and
add a reference count to a data pointer that identifies an encrypted, user data block as used by a tenant of the storage platform to deduplicate the encrypted, incoming user data block based on the presence of the incoming digital fingerprint.
13. The non-transitory computer-readable medium of claim 12 , wherein the program code is further executable for causing the processing device to apply a hash function to the unencrypted user data block to produce the incoming digital fingerprint.
14. The non-transitory computer-readable medium of claim 12 , wherein the program code is further executable for causing the processing device to:
store at least some of the plurality of encrypted, incoming user data blocks in the storage platform; and
update the plurality of existing digital fingerprints stored in the trusted execution environment.
15. The non-transitory computer-readable medium of claim 12 , wherein the storage platform comprises a multitenancy, public storage platform.
16. The non-transitory computer-readable medium of claim 15 , wherein the existing digital fingerprints comprise digital fingerprints corresponding to tenant data blocks from a plurality of tenants.
17. The non-transitory computer-readable medium of claim 12 , wherein each of the plurality of encrypted, incoming user data blocks are received through a proxy to provide an interface protocol between a client and the storage platform, wherein the proxy further redirects the incoming user data blocks from storage locations specified in the interface protocol to the trusted execution environment.