Secure data deduplication with smaller hash values

A system for providing secure data deduplication with smaller hash values, comprising:

• a plurality of storage resources of a respective deduplication domain from among a plurality of deduplication domains;
• a memory;
• and
• a storage processor operative to execute instructions out of the memory:
• to randomly generate a plurality of noncryptographic keys for a plurality of deduplication domains, respectively, the plurality of noncryptographic keys including a noncryptographic key for the respective deduplication domain;
• to receive data for storage in one or more of the plurality of storage resources of the respective deduplication domain;
• to segment the data into a plurality of data segments;
• for at least a respective data segment from among the plurality of data segments, to input only the respective data segment and the noncryptographic key for the respective deduplication domain into a universal hash function based on a Galois Message Authentication Code (GMAC) to obtain a keyed hash value for the respective data segment that has an acceptable probability of accidental collision for secure data deduplication;
• to maintain the obtained keyed hash value for the respective data segment in an index table for the respective deduplication domain;
• and
• to perform a data deduplication operation on the respective data segment using the keyed hash value for the respective data segment.

A computer program product having a non-transitory computer readable medium that stores a set of instructions to provide secure data deduplication with smaller hash values in a data storage system, the set of instructions, when carried out by computerized circuitry, causing the computerized circuitry to perform a method of:

• randomly generating a plurality of noncryptographic keys for a plurality of deduplication domains, respectively, the plurality of noncryptographic keys including a noncryptographic key for a respective deduplication domain from among the plurality of deduplication domains;
• receiving, at a storage processor, data for storage in one or more storage resources of the respective deduplication domain;
• segmenting the data into a plurality of data segments;
• for at least a respective data segment from among the plurality of data segments, inputting only the respective data segment and the noncryptographic key for the respective deduplication domain into a universal hash function based on a Galois Message Authentication Code (GMAC) to obtain a keyed hash value for the respective data segment that has an acceptable probability of accidental collision for secure data deduplication;
• maintaining the obtained keyed hash value for the respective data segment in an index table for the respective deduplication domain;
• and
• performing a data deduplication operation on the respective data segment using the keyed hash value for the respective data segment.