IP Library › Granted Patent US 12,277,097
Granted Patent B2
US 12,277,097 · App. 18/224,500 · Granted Apr 15, 2025

Using ciphertext to deduplicate data using wide-block encryption

Inventor: Glen Alan Jaquette (Tucson, AZ)
Assignee: International Business Machines Corporation
G06F16/215H04L9/0631
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,277,097
App. No.
18/224,500
Granted
Apr 15, 2025
Kind
B2
Abstract

A computer-implemented method, according to one embodiment, includes: compressing an uncompressed instance of data to create a compressed instance of data. In response to determining that a size of the compressed instance of data is outside a predetermined range, the uncompressed instance of the data is encrypted utilizing wide-block encryption to create a ciphertext string. Moreover, a predetermined subset of the encrypted uncompressed instance of data in the ciphertext string is used to perform deduplication at a data storage server.

Claims (60)

1. A computer-implemented method, comprising:

receiving a stream of data at a data storage server;

in response to determining that the stream of data includes a subset of data instances that are not configured to implement data reduction accommodating persistent encryption, using calculated hash values to perform deduplication at the data storage server;

in response to determining that the stream of data includes a subset of data instances that are configured to implement data reduction accommodating persistent encryption, compressing a first of the data instances to create a compressed first instance of data;

in response to determining that a size of the compressed first instance of data is outside a predetermined range, encrypting the first instance of data utilizing wide-block encryption to create a ciphertext string; and

using a predetermined subset of the encrypted first instance of data in the ciphertext string to perform deduplication at the data storage server,

wherein the deduplication is performed at the data storage server without calculating a hash value at the data storage server.

2. The computer-implemented method of claim 1 , comprising:

determining whether the stream of data includes data instances that are configured to implement data reduction accommodating persistent encryption.

3. The computer-implemented method of claim 2 , comprising:

in response to determining that the stream of data includes a second subset of data instances that are not configured to implement data reduction accommodating persistent encryption:

calculating the hash values for the second subset of data, and

using the calculated hash values to perform deduplication at the data storage server.

4. The computer-implemented method of claim 1 , comprising:

in response to determining that the size of the compressed first instance of data is not outside the predetermined range, encrypting the compressed first instance of the data utilizing the wide-block encryption;

adding a zero pad to the encrypted compressed first instance of data to create a ciphertext string; and

using a predetermined subset of the encrypted compressed first instance of data to perform the deduplication at the data storage server.

5. The computer-implemented method of claim 4 , comprising:

adding a length field to the encrypted compressed first instance of data and the zero pad to create the ciphertext string, wherein the predetermined subset includes a same number of bytes of information in the respective encrypted instances of data.

6. The computer-implemented method of claim 1 , wherein the compressed first instance of data is abandoned or deleted in response to determining that the size of the compressed first instance of data is outside the predetermined range.

7. The computer-implemented method of claim 1 , wherein the wide-block encryption includes an EME2-AES encryption algorithm and/or an XCB-AES encryption algorithm.

8. A computer program product, comprising a computer readable storage medium having program instructions embodied therewith, the program instructions readable by a processor, executable by the processor, or readable and executable by the processor, to cause the processor to:

receive a stream of data at a data storage server;

in response to determining that the stream of data includes a subset of data instances that are not configured to implement data reduction accommodating persistent encryption, use calculated hash values to perform deduplication at the data storage server;

in response to determining that the stream of data includes a subset of data instances that are configured to implement data reduction accommodating persistent encryption, compress a first of the data instances to create a compressed first instance of data;

in response to determining that a size of the compressed first instance of data is outside a predetermined range, encrypt the first instance of data utilizing wide-block encryption to create a ciphertext string; and

use a predetermined subset of the encrypted first instance of data in the ciphertext string to perform deduplication at the data storage server,

wherein the deduplication is performed at the data storage server without calculating a hash value at the data storage server.

9. The computer program product of claim 8 , wherein the program instructions are readable and/or executable by the processor to cause the processor to:

determine whether the stream of data includes data instances that are configured to implement data reduction accommodating persistent encryption.

10. The computer program product of claim 8 , wherein the predetermined subset of the encrypted first instance of data includes a set number of non-sequential bytes in the ciphertext string.

11. The computer program product of claim 8 , wherein the program instructions are readable and/or executable by the processor to cause the processor to:

in response to determining that the size of the compressed first instance of data is not outside the predetermined range, encrypt the compressed first instance of data utilizing the wide-block encryption;

add a zero pad to the encrypted compressed first instance of data to create a ciphertext string; and

use a predetermined subset of the encrypted compressed first instance of data to perform the deduplication at the data storage server.

12. The computer program product of claim 11 , wherein the program instructions are readable and/or executable by the processor to cause the processor to:

add a length field to the encrypted compressed first instance of data and the zero pad to create the ciphertext string, wherein the predetermined subset includes a same number of bytes of information in the respective encrypted instances of data; and

use a predetermined subset of the encrypted compressed first instance of data in the ciphertext string to perform deduplication at the data storage server,

wherein the deduplication is performed at the data storage server without calculating a hash value at the data storage server.

13. The computer program product of claim 8 , wherein the compressed first instance of data is abandoned or deleted in response to determining that the size of the compressed first instance of data is outside the predetermined range.

14. The computer program product of claim 8 , wherein the wide-block encryption includes an EME2-AES encryption algorithm and/or an XCB-AES encryption algorithm.

15. A system, comprising:

a data storage server; and

logic integrated with the data storage server, executable by the data storage server, or integrated with and executable by the data storage server, the logic being configured to:

receive a stream of data at a data storage server;

in response to determining that the stream of data includes a subset of data instances that are not configured to implement data reduction accommodating persistent encryption, use calculated hash values to perform deduplication at the data storage server;

in response to determining that the stream of data includes a subset of data instances that are configured to implement data reduction accommodating persistent encryption, compress a first of the data instances to create a compressed first instance of data;

in response to determining that a size of the compressed first instance of data is outside a predetermined range, encrypt the first instance of data utilizing wide-block encryption to create a ciphertext string; and

use a predetermined subset of the encrypted first instance of data in the ciphertext string to perform deduplication at the data storage server,

wherein the deduplication is performed at the data storage server without calculating a hash value at the data storage server.

16. The system of claim 15 , wherein the logic is configured to:

determine whether the stream of data includes data instances that are configured to implement data reduction accommodating persistent encryption.

17. The system of claim 15 , wherein the predetermined subset of the encrypted first instance of data includes a set number of sequential bytes in the ciphertext string.

18. The system of claim 15 , wherein the logic is configured to:

in response to determining that the size of the compressed first instance of data is not outside the predetermined range, encrypting the compressed first instance of the data utilizing the wide-block encryption;

adding a zero pad to the encrypted compressed first instance of data to create a ciphertext string;

using a predetermined subset of the encrypted compressed first instance of data to perform the deduplication at the data storage server, wherein the deduplication is performed at the data storage server without calculating a hash value at the data storage server; and

adding a length field to the encrypted compressed first instance of data and the zero pad to create the ciphertext string, wherein the predetermined subset includes a same number of bytes of information in the respective encrypted instances of data.

19. The system of claim 15 , wherein the compressed first instance of data is abandoned or deleted in response to determining that the size of the compressed first instance of data is outside the predetermined range.

20. The system of claim 15 , wherein the wide-block encryption includes an EME2-AES encryption algorithm and/or an XCB-AES encryption algorithm.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jul 26, 2023
From: JAQUETTE, GLEN ALAN
To: INTERNATIONAL BUSINESS MACHINES CORPORATION
Reel/Frame 064393/0551 →
Continuity (1)
Related Publication 20250028692A1 · Jan 23, 2025
References Cited (68)
US 4467354A · Eby, Jr. et al. · 1984 [cited by applicant]
US 5778395A · Whiting et al. · 1998 [cited by applicant]
US 6983365B1 · Douceur et al. · 2006 [cited by applicant]
US 7266689B2 · Douceur et al. · 2007 [cited by applicant]
US 7406595B1 · Boyle, Jr. et al. · 2008 [cited by applicant]
US 7827408B1 · Gehringer et al. · 2010 [cited by applicant]
US 8218759B2 · Moffat et al. · 2012 [cited by applicant]
US 8259934B2 · Karroumi et al. · 2012 [cited by applicant]
US 8634549B2 · Schneider · 2014 [cited by applicant]
US 9237014B2 · Leung et al. · 2016 [cited by applicant]
US 9407437B1 · Campagna · 2016 [cited by applicant]
US 9635011B1 · Wu et al. · 2017 [cited by applicant]
US 9930099B2 · McCanne et al. · 2018 [cited by applicant]
US 10044509B1 · Kirshner · 2018 [cited by applicant]
US 10348486B2 · Karame · 2019 [cited by applicant]
US 10430102B2 · Kaczmarczyk et al. · 2019 [cited by applicant]
US 10459801B2 · Bangalore et al. · 2019 [cited by applicant]
US 10489249B2 · Bangalore et al. · 2019 [cited by applicant]
US 10514986B2 · Bangalore et al. · 2019 [cited by applicant]
US 11601257B2 · Jaquette · 2023 [cited by applicant]
US 11695541B2 · Jaquette et al. · 2023 [cited by applicant]
US 20030074319A1 · Jaquette · 2003 [cited by applicant]
US 20070101412A1 · Yang et al. · 2007 [cited by applicant]
US 20100199042A1 · Bates et al. · 2010 [cited by applicant]
US 20110103580A1 · Hazay et al. · 2011 [cited by applicant]
US 20130198509A1 · Buruganahalli et al. · 2013 [cited by applicant]
US 20150379276A1 · Glickman et al. · 2015 [cited by applicant]
US 20170091046A1 · Bangalore · 2017 [cited by examiner]
US 20170134160A1 · Onoda · 2017 [cited by applicant]
US 20170243012A1 · Karame et al. · 2017 [cited by applicant]
US 20180176014A1 · Campagna · 2018 [cited by applicant]
US 20180191492A1 · Barham et al. · 2018 [cited by applicant]
US 20190215155A1 · Wang · 2019 [cited by examiner]
US 20200213109A1 · Perlman et al. · 2020 [cited by applicant]
US 20200366895A1 · De Luxán Hernández et al. · 2020 [cited by applicant]
US 20210377016A1 · Perlman et al. · 2021 [cited by applicant]
US 20220103338A1 · Brooker et al. · 2022 [cited by applicant]
US 20220182217A1 · Jaquette et al. · 2022 [cited by applicant]
US 20220182219A1 · Jaquette · 2022 [cited by examiner]
US 20220182242A1 · Jaquette et al. · 2022 [cited by applicant]
US 20240311472A1 · Zhang · 2024 [cited by examiner]
CN 104303452A · 2015 [cited by applicant]
CN 108200172A · 2018 [cited by applicant]
Kavade et al., “Secure De-Duplication using Convergent Keys (Convergent Cryptography) for Cloud Storage,” International Journal of Computer Applications, vol. 126, No. 10, Sep. 2015, pp. 5-9. [cited by applicant]
Jaquette et al., U.S. Appl. No. 17/114,058, filed Dec. 7, 2020. [cited by applicant]
Non-Final Office Action from U.S. Appl. No. 17/114,058, dated Apr. 28, 2022. [cited by applicant]
Final Office Action from U.S. Appl. No. 17/114,058, dated Aug. 15, 2022. [cited by applicant]
Notice of Allowance from U.S. Appl. No. 17/114,058, dated Feb. 23, 2023. [cited by applicant]
Supplemental Notice of Allowance from U.S. Appl. No. 17/114,058, dated May 1, 2023. [cited by applicant]
Jaquette et al., U.S. Appl. No. 18/128,820, filed Mar. 30, 2023. [cited by applicant]
Wikipedia, “Convergent encryption,” Wikipedia, 2020, 2 pages, retrieved from https://en.wikipedia.org/wiki/Convergent_encryption. [cited by applicant]
Anonymous, “NIST Cloud Computing Program,” NIST, Information Technology Laboratory, Nov. 13, 2013, pp. 1-2, retrieved from www.nist.gov/itl/cloud/. [cited by applicant]
Mell et al., “The NIST Definition of Cloud Computing,” Version 15, Oct. 7, 2009, pp. 1-2. [cited by applicant]
Mell et al., “The NIST Definition of Cloud Computing,” Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-145, Sep. 2011, pp. 1-7. [cited by applicant]
CSRC, “Cloud Computing,” Computer Security Resource Center, Oct. 2017, 3 pages, retrieved from https://csrc.nist.gov/projects/cloud-computing. [cited by applicant]
U.S. Appl. No. 16/540,088, filed Aug. 14, 2019. [cited by applicant]
U.S. Appl. No. 16/199,268, filed Nov. 26, 2018. [cited by applicant]
Harkins, D., “Synthetic Initialization Vector (SIV) Authenticated Encryption Using the Advanced Encryption Standard (AES),” Aruba Networks, Oct. 2008, 27 pages, retrieved from https://tools.ietf.org/html/rfc5297. [cited by applicant]
International Search Report and Written Opinion from PCT Application No. PCT/CN2021/128720, dated Jan. 24, 2021. [cited by applicant]
Jaquette et al., U.S. Appl. No. 17/112,679, filed Dec. 4, 2020. [cited by applicant]
Non-Final Office Action from U.S. Appl. No. 17/112,679, dated Jul. 6, 2022. [cited by applicant]
Notice of Allowance from U.S. Appl. No. 17/112,679, dated Oct. 21, 2022. [cited by applicant]
Wei et al., “MAD2: A Scalable High-Throughput Exact Deduplication Approach for Network Backup Services,” IEEE, May 2010, 15 pages. [cited by applicant]
Anonymous, “A method for fast integer format preserving encryption for large integers,” IP.com Prior Art Database, Technical Disclosure No. IPCOM000245153D, Feb. 14, 2016, 4 pages. [cited by applicant]
Anonymous, “Method to avoid re-encryption of data in deduplication enabled storage controllers,” IP.com Prior Art Database Technical Disclosure No. IPCOM000260404D, Nov. 19, 2019, 6 pages. [cited by applicant]
Anonymous, “Instance based format preserving encryption and tokenization,” IP.com Prior Art Database, Technical Disclosure No. IPCOM000244284D, Nov. 30, 2015, 7 pages. [cited by applicant]
IEEE, “IEEE 1619.2-2010—IEEE Standard for Wide-Block Encryption for Shared Storage Media,” IEEE Standards Association, 2020, retrieved from https://standards.ieee.org/standard/1619_2-2010.html. [cited by applicant]
IEEE Computer Society, “IEEE Standard for Wide-Block Encryption for Shared Storage Media,” IEEE Standards Association, Mar. 8, 2011, 91 pages. [cited by applicant]