Preserving redundancy in data deduplication systems by encryption

• US 9,792,450 B2
• Filed: 02/09/2015
• Issued: 10/17/2017
• Est. Priority Date: 04/23/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Fiske, Rahul M., Jones, Carl E., Roy, Subhojit
• Primary Examiner(s): SHAW, PETER C
• Application Number:
  US14/617,091
• Publication Number:
  US 20150154410A1
• Time in Patent Office: 981 Days
• Field of Search: 713189
• CPC Class Codes: G06F 16/1748 De-duplication implemented within the file system, e.g. based on file segments de-duplication techniques in storage systems for the management of data blocks G06F3/0641
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 3/0608 Saving storage space on storage systems
• CPC Class Codes: G06F 3/0623 in relation to content
• CPC Class Codes: G06F 3/0641 De-duplication techniques
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]

Abstract

A method for preserving data redundancy in a data deduplication system in a computing environment is provided. A selected data segment, to be written through the data deduplication system, is encrypted such that the selected data segment is not subject to a deduplication operation. The method determines and identifies copies of the data segment that are to be precluded from data deduplication. A unique encryption key is used to encrypt the selected data segment to be written through the data deduplication system such that the selected data segment is not subject to a deduplication operation. The data deduplication system is tricked to recognize the encrypted, selected data segment as new, undeduplicated data by the encrypting thereby skipping steps of the deduplication operation that includes fingerprint generation and matching. The encrypted, selected data segment is directly written to a new physical storage location.

Claims

1. A method for preserving data redundancy in a data deduplication system for adhering to requirements of an application for allocating a plurality of copies of a selected data segment to a plurality of physical storage locations in a computing environment by a processor, comprising:

in a two-way mirrored storage pool, determining and identifying the plurality of copies of the selected data segment that are to be precluded from data deduplication, the selected data segment comprising a superblock associated with a segment of metadata describing characteristics of a file system;

before a write of the selected data segment is issued, encrypting with a unique encryption key, by the application, the selected data segment to be written through the data deduplication system such that the selected data segment is not subject to a deduplication operation, wherein the unique encryption key is a weak and predictable encryption key and does not require additional metadata storage space of the selected data segment;

tricking the data deduplication system to recognize the encrypted, selected data segment as new, undeduplicated data by the encrypting thereby skipping steps of the deduplication operation that includes fingerprint generation and matching, wherein the encrypted, selected data segment is not matched with identical data previously written; and

directly writing the encrypted, selected data segment to a new physical storage location even if there are earlier instances of identical data of the encrypted, selected data segment being stored on a storage controller such that multiple, redundant copies of the selected data segment comprising the superblock are stored in the plurality of physical storage locations in the computing environment;

wherein encrypting the selected data segment includes choosing multiple selected data segments written as a unit such that each of the multiple selected data segments are decrypted as the unit.

2. The method of claim 1, further including processing the encrypted, selected data segment through the computing environment such that the deduplication operation is withheld from being performed on the selected data segment.

3. The method of claim 2, wherein encrypting the selected data segment further includes encrypting the selected data segment with the unique encryption key for an associated virtual device in advance of issuing a write request to the storage controller.

4. The method of claim 3, wherein encrypting the selected data segment with the unique key further includes selecting the encryption key to be associated with one of a start of a logical block address (LBA) for the selected data segment, and an offset of the selected data segment within a file, wherein an encryption function is chosen to retain a size of encrypted data processed through the encryption function.

5. The method of claim 4, wherein encrypting the selected data segment includes choosing multiple selected data segments written as the unit such that decrypting each of the multiple selected data segments returns original data for each segment.

6. The method of claim 2, wherein processing the encrypted, selected data segment includes issuing a write request for the encrypted, selected data segment through a deduplication engine in a storage controller of the computing environment.

7. The method of claim 6, wherein during execution of the write request for the encrypted, selected data segment, the data deduplication engine recognizes the encrypted, selected data segment as a new segment of data and withholds performing the deduplication operation.

8. The method of claim 1, further including, on a subsequent read operation of the selected data segment, decrypting the selected data segment.

9. The method of claim 8, wherein decrypting the selected data segment includes decrypting the selected data segment with the weak, unique, and predictable encryption key.

10. The method of claim 1, further including selecting the unique encryption key to be associated with a data segment for a deduplication operation.