Processing and archiving encrypted data at shared storage locations
A computer-implemented method, according to one embodiment, includes: receiving encrypted data at a storage controller, and providing the encrypted data to a secure software container. The secure software container is configured to decrypt the encrypted data, calculate hash values using the decrypted data, and compress the decrypted data. The secure software container is also configured to re-encrypt the decrypted data. The computer-implemented method also includes receiving a new copy of the encrypted data from the secure software container. The new copy of the encrypted data may be compressed, include hash values calculated at the secure software container, or compressed as well as including hash values. The new copy of the encrypted data received may thereby be stored in memory.
1 . A computer-implemented method, comprising:
receiving encrypted data at a storage controller;
providing the encrypted data to a secure software container configured to:
decrypt the encrypted data,
calculate hash values using the decrypted data,
compress the decrypted data, and
re-encrypt the decrypted data;
receiving a new copy of the encrypted data from the secure software container, wherein the new copy of the encrypted data is compressed, includes hash values, or is compressed and includes hash values; and
causing the new copy of the encrypted data to be stored in memory,
wherein the storage controller is unable to access the decrypted data in the secure software container.
2 . The computer-implemented method of claim 1 , wherein the secure software container includes one or more cryptographic keys configured to decrypt, encrypt, or decrypt and encrypt data, wherein the storage controller is unable to access the cryptographic keys in the secure software container.
3 . The computer-implemented method of claim 1 , wherein the secure software container is configured to assist with deduplicating the decrypted data by, for each block of the decrypted data:
calculating a hash value of a respective decrypted data block;
returning the hash value to the storage controller;
in response to receiving an indication from the storage controller that the hash value is not a duplicate, maintaining the respective decrypted data block in the new copy of the encrypted data; and
in response to receiving an indication from the storage controller that the hash value is a duplicate, replacing the respective decrypted data block with a pointer in the new copy of the encrypted data.
4 . The computer-implemented method of claim 3 , wherein the hash value is returned from the secure software container to a deduplication agent of the storage controller without exposing the decrypted data.
5 . The computer-implemented method of claim 3 , comprising:
re-encrypting the decrypted data by encrypting data blocks and pointers in the new copy of the encrypted data.
6 . The computer-implemented method of claim 3 , comprising:
comparing the hash values received from the secure software container to a list of known ransomware signatures; and
in response to identifying a match between the hash values and the list of known ransomware signatures, sending instructions to prevent the corresponding decrypted data block from being stored in the memory.
7 . The computer-implemented method of claim 1 , wherein the secure software container is configured to compress the decrypted data by, for each block of the decrypted data:
sending the respective decrypted data block to a compression accelerator; and
receiving a compressed copy of the respective decrypted data block,
wherein re-encrypting the decrypted data includes encrypting the compressed copies of the decrypted data blocks.
8 . The computer-implemented method of claim 7 , wherein the storage controller is unable to access the decrypted data blocks or the compressed copies of the decrypted data blocks from the compression accelerator.
9 . A computer program product, comprising a computer readable storage medium having program instructions embodied therewith, the program instructions readable by a storage controller, executable by the storage controller, or readable and executable by the storage controller, to cause the storage controller to:
receive encrypted data;
provide the encrypted data to a secure software container configured to:
decrypt the encrypted data,
calculate hash values using the decrypted data,
compress the decrypted data, and
re-encrypt the decrypted data;
receive a new copy of the encrypted data from the secure software container, wherein the new copy of the encrypted data is compressed, includes hash values, or is compressed and includes hash values; and
cause the new copy of the encrypted data to be stored in memory,
wherein the storage controller is unable to access the decrypted data in the secure software container.
10 . The computer program product of claim 9 , wherein the secure software container includes one or more cryptographic keys configured to decrypt, encrypt, or decrypt and encrypt data, wherein the storage controller is unable to access the cryptographic keys in the secure software container.
11 . The computer program product of claim 9 , wherein the secure software container is configured to assist with deduplicating the decrypted data by, for each block of the decrypted data:
calculating a hash value of the respective decrypted data block;
returning the hash value to the storage controller;
in response to receiving an indication from the storage controller that the hash value is not a duplicate, maintaining the respective decrypted data block in the new copy of the encrypted data; and
in response to receiving an indication from the storage controller that the hash value is a duplicate, replacing the respective decrypted data block with a pointer in the new copy of the encrypted data.
12 . The computer program product of claim 11 , wherein the hash value is returned to a deduplication agent of the storage controller.
13 . The computer program product of claim 11 , comprising:
re-encrypting the decrypted data by: encrypting data blocks and pointers in the new copy of the encrypted data.
14 . The computer program product of claim 11 , wherein the program instructions are readable and/or executable by the storage controller to cause the storage controller to:
compare the hash values received from the secure software container to a list of known ransomware signatures; and
in response to identifying a match between the hash values and the list of known ransomware signatures, send instructions to prevent the corresponding decrypted data block from being stored in the memory.
15 . The computer program product of claim 9 , wherein the secure software container is configured to compress the decrypted data by, for each block of the decrypted data:
sending the respective decrypted data block to a compression accelerator; and
receiving a compressed copy of the respective decrypted data block,
wherein re-encrypting the decrypted data includes encrypting the compressed copies of the decrypted data blocks.
16 . The computer program product of claim 15 , wherein the storage controller is unable to access the decrypted data blocks or the compressed copies of the decrypted data blocks from the compression accelerator.
17 . A system, comprising:
storage controller having a secure software container; and
logic integrated with the storage controller, executable by the storage controller, or integrated with and executable by the storage controller, the logic being configured to:
receive encrypted data;
provide the encrypted data to a secure software container configured to:
decrypt the encrypted data,
calculate hash values using the decrypted data,
compress the decrypted data, and
re-encrypt the decrypted data;
receive a new copy of the encrypted data from the secure software container, wherein the new copy of the encrypted data is compressed, includes hash values, or is compressed and includes hash values; and
cause the new copy of the encrypted data to be stored in memory,
wherein the storage controller is unable to access the decrypted data in the secure software container.
18 . The system of claim 17 , wherein the secure software container is a plugin-based software package that has been modified by a host, and implemented in the storage controller, wherein software running in the storage controller, but outside the secure software container, is unable to directly access data being processed by software running in the secure software container.
19 . The computer-implemented method of claim 7 , further comprising:
causing the secure software container to compress the decrypted data by submitting a request through an application program interface (API) exposed by the secure software container,
wherein the storage controller is unable to access the decrypted data blocks or the compressed copies of the decrypted data blocks from the compression accelerator.
20 . The computer-implemented method of claim 19 , wherein software running in the storage controller, but outside the secure software container, is unable to directly access data being processed by software running in the secure software container.