Providing end-to-end encryption for data stored in a storage system

1. A method comprising: receiving a request to read encrypted data from a logical volume of a plurality of logical volumes of a storage system, wherein the plurality of logical volumes resident on the storage system are encrypted using different keys for each of the plurality of logical volumes; decrypting the encrypted data using a decryption key associated with the logical volume of the storage system; performing at least one of a data operation to reconstitute the data; encrypting the data using an encryption key associated with at least one property of the data to generate new encrypted data; and providing a response to the request that includes the new encrypted data.

2. The method of claim 1 wherein performing at least one of a data operation to reconstitute the data further comprises performing a data reduplication operation.

3. The method of claim 1 wherein performing at least one of a data operation to reconstitute the data further comprises performing a data rehydration operation.

4. The method of claim 1 wherein performing at least one of a data operation to reconstitute the data further comprises performing a data decompression operation.

5. The method of claim 1 wherein the encryption key is received from a key management service.

6. The method of claim 5 wherein the encryption key is received from the key management service based on a security identifier associated with a logical volume, a logical volume range, or a client identifier associated with the data.

7. The method of claim 1 further comprising:

after decrypting the encrypted data, performing at least one data reduction operation on the data to generate a first reduced data;

encrypting the first reduced data using a second encryption key to generate the encrypted data; and

storing the encrypted data on the storage system.

8. A storage system comprising: one or more storage devices; and a storage controller, the storage controller comprising a one or more computer processors to: receive a request to read encrypted data from a logical volume of a plurality of logical volumes of a storage system, wherein the plurality of logical volumes resident on the storage system are encrypted using different keys for each of the plurality of logical volumes; decrypt the encrypted data using a decryption key associated with the logical volume of the storage system; perform at least one of a data operation to reconstitute the data; encrypt the data using an encryption key associated with at least one property of the data to generate new encrypted data; and provide a response to the request that includes the new encrypted data.

9. The storage system of claim 8 wherein performing at least one of a data operation to reconstitute the data further comprises performing a data reduplication operation.

10. The storage system of claim 8 wherein performing at least one of a data operation to reconstitute the data further comprises performing a data rehydration operation.

11. The storage system of claim 8 wherein performing at least one of a data operation to reconstitute the data further comprises performing a data decompression operation.

12. The storage system of claim 8 wherein the encryption key is received from a key management service.

13. The storage system of claim 12 wherein the encryption key is received from the key management service based on a security identifier associated with a logical volume, a logical volume range, or a client identifier associated with the data.

14. The storage system of claim 8 further comprising one or more computer processors to:

after decrypting the encrypted data, performing at least one data reduction operation on the data to generate a first reduced data;

encrypt the first reduced data using a second encryption key to generate the encrypted data; and

store the encrypted data on the storage system.

15. A non-transitory computer readable storage medium storing instructions, which when executed, cause one or more processor cores to: receive a request to read encrypted data from a logical volume of a plurality of logical volumes of a storage system, wherein the plurality of logical volumes resident on the storage system are encrypted using different keys for each of the plurality of logical volumes; decrypt the encrypted data using a decryption key associated with the logical volume of the storage system; perform at least one of a data operation to reconstitute the data; encrypt the data using an encryption key associated with at least one property of the data to generate new encrypted data; and provide a response to the request that includes the new encrypted data.

16. The non-transitory computer readable storage medium of claim 15 wherein performing at least one of a data operation to reconstitute the data further comprises performing a data reduplication operation.

17. The non-transitory computer readable storage medium of claim 15 wherein performing at least one of a data operation to reconstitute the data further comprises performing a data rehydration operation.

18. The non-transitory computer readable storage medium of claim 15 wherein performing at least one of a data operation to reconstitute the data further comprises performing a data decompression operation.

19. The non-transitory computer readable storage medium of claim 15 wherein the encryption key is received from a key management service.

20. The non-transitory computer readable storage medium of claim 19 wherein the encryption key is received from the key management service based on a security identifier associated with a logical volume, a logical volume range, or a client identifier associated with the data.