# US 11,307,998 B2 · Storage efficiency of encrypted host system data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,307,998 B2 - Document ID: US11307998B2 - Status: Granted - Kind: B2 - Application number: 16/514,831 - Filed: 2019-07-17 - Published: 2019-11-07 - Granted: 2022-04-19 - Earliest claimed: 2017-01-09 - Assignees: Pure Storage, Inc. - Applicants: Pure Storage, Inc. - Inventors: Jonas R. Irwin; Ethan L. Miller; John D. Davis - Web page: https://patentgrep.com/patent/US11307998B2 ## CPC - G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)} - G06F 3/0608: {Saving storage space on storage systems} - G06F 3/0641: {De-duplication techniques} - G06F 3/067: {Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]} - G06F 3/0683: {Plurality of storage devices} - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - G06F 2212/1052: Security improvement - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A storage controller coupled to a storage array comprising one or more storage devices that performs at least one data reduction operation on decrypted data, encrypts the reduced data using a second encryption key to generate a second encrypted data, and stores the second encrypted data on the storage array. ## Claims ### Claim 1 A cloud-based storage system comprising: one or more cloud computing instances hosting at least two or more logical volumes; and a cloud computing instance executing a storage controller application, the storage controller application configured to: receive a first request to write first encrypted data to a logical volume of the at least two or more logical volumes, wherein the first encrypted data comprises a first data encrypted by a first encryption key associated with a property of the data; decrypt the first encrypted data using a first decryption key to generate first decrypted data; perform at least one of a data deduplication operation or a data compression operation on the first decrypted data to generate first reduced data; encrypt the first reduced data using a second encryption key to generate second encrypted data, wherein the second encryption key is associated with the logical volume, wherein the at least two or more logical volumes in the cloud-based storage system store data encrypted using different encryption keys for each of the at least two or more logical volumes; and store the second encrypted data on the logical volume. ### Claim 2 (depends on 1) The cloud-based storage system of claim 1, wherein the storage controller application is further configured to: determine the first decryption key. ### Claim 3 (depends on 2) The cloud-based storage system of claim 2, wherein to determine the first decryption key the storage controller application is further configured to: determine a security identifier associated with the at least one of a logical volume, a logical volume range on the cloud-based storage system, or a client identifier associated with the first data; send a key request to a key management service for the first decryption key, the key request comprising the security identifier; and receive a response with the first decryption key. ### Claim 4 (depends on 2) The cloud-based storage system of claim 2, wherein to determine the first decryption key the storage controller application is further configured to: detect a device on an input port associated with the cloud-based storage system; and receive the first decryption key from the device. ### Claim 5 (depends on 1) The cloud-based storage system of claim 1, wherein the storage controller application is further configured to: receive a second request to read the second encrypted data from a logical volume on the cloud-based storage system; retrieve the second encrypted data from the logical volume on the cloud-based storage system; decrypt the second encrypted data using a second decryption key to gene rate second decrypted data, wherein the second decryption key is associated with the second encryption key; perform at least one of a data reconstitution operation or a data decompression operation on the second decrypted data to obtain reconstituted data; encrypt the reconstituted data using the first encryption key to generate a third encrypted data; and send a response to the second request, the response comprising the third encrypted data. ### Claim 6 A method comprising: receiving, at a cloud computing instance executing a storage controller application, a first request to write first encrypted data to a logical volume resident on a cloud-based storage system, wherein the first encrypted data comprises a first data encrypted by a first encryption key associated with a property of the data; decrypting, by the storage controller application, the first encrypted data using a first decryption key to generate first decrypted data; performing, by the storage controller application, at least one data reduction operation on a first decrypted data to generate a first reduced data; encrypting, by the storage controller application, the first reduced data using a second encryption key to generate a second encrypted data, wherein the second encryption key is associated with the logical volume, wherein at least two or more logical volumes in the cloud-based storage system store data encrypted using different encryption keys for each of the at least two or more logical volumes; and storing the second encrypted data on the cloud-based storage system. ### Claim 7 (depends on 6) The method of claim 6, further comprising: determining a first decryption key to decrypt the first encrypted data. ### Claim 8 (depends on 7) The method of claim 7, wherein determining the first decryption key comprises: determining, by the storage controller application, a security identifier; and accessing, by the storage controller application, a mapping table that stores a mapping between the security identifier and the first decryption key. ### Claim 9 (depends on 7) The method of claim 7, wherein determining the first decryption key comprises: determining, by the storage controller application, a security identifier associated with at least one property of the first data; sending, by the storage controller application, a second request to a key management service for the first decryption key, the second request comprising the security identifier; and receiving, by the storage controller application, a response with the first decryption key. ### Claim 10 (depends on 7) The method of claim 7, wherein determining the first decryption key comprises: identifying, by the storage controller application, a plurality of security identifiers associated with at least one property of the first data; accessing, by the storage controller application, a policy definition mapping associated with the first data; selecting, by the storage controller application, a first security identifier of the plurality of security identifiers based on the policy definition mapping; and determining, by the storage controller application, the first decryption key using the first security identifier. ### Claim 11 (depends on 7) The method of claim 7, wherein determining the first decryption key comprises: detecting, by the storage controller application, a device on an input port associated with the cloud-based storage system; and receiving, by the storage controller application, the first decryption key from the device. ### Claim 12 (depends on 7) The method of claim 7, wherein the at least one data reduction operation comprises at least one of a data deduplication operation or a data compression operation. ### Claim 13 (depends on 7) The method of claim 7, wherein the second encryption key is associated with at least one property of the cloud-based storage system. ### Claim 14 (depends on 7) The method of claim 7, further comprising: receiving, by the storage controller application, a second request to read the second encrypted data from a logical volume on the cloud-based storage system; retrieving, by the storage controller application, the second encrypted data from the logical volume on the cloud-based storage system; decrypting, by the storage controller application, the second encrypted data using a second decryption key to generate a second decrypted data, wherein the second decryption key is associated with the second encryption key; encrypting, by the storage controller application, the second decrypted data using the first encryption key to generate a third encrypted data; and providing, by the storage controller application, a response to the second request, the response comprising the third encrypted data. ### Claim 15 (depends on 14) The method of claim 14, further comprising: performing, by the storage controller application, at least one of a data reconstitution operation or a data decompression operation on the second decrypted data. ### Claim 16 A non-transitory computer readable storage medium storing instructions, which when executed, cause one or more processor cores to instantiate a cloud computing instance of a storage controller application, the storage controller application configured to: receive a first request to write first encrypted data to a logical volume resident on a cloud-based storage system, wherein the first encrypted data comprises a first data encrypted by a first encryption key associated with a property of the data; decrypt the first encrypted data using a first decryption key to generate first decrypted data; perform at least one of a data deduplication operation or a data compression operation on first decrypted data to generate a first reduced data; encrypt the first reduced data using a second encryption key to generate second encrypted data, wherein the second encryption key is associated with the logical volume, wherein at least two or more logical volumes in the cloud-based storage system store data encrypted using different encryption keys for each of the at least two or more logical volumes; and store the second encrypted data on the cloud-based storage system. ### Claim 17 (depends on 16) The non-transitory computer readable storage medium of claim 16, wherein the storage controller application is further configured to determine a first decryption key to decrypt the first encrypted data. ### Claim 18 (depends on 17) The non-transitory computer readable storage medium of claim 17, wherein the storage controller application is further configured to: identify a plurality of security identifiers associated with at least one property of the first data; access a policy definition mapping associated with the first data; select a first security identifier of the plurality of security identifiers based on the policy definition mapping; and determine the first decryption key using the first security identifier by accessing at least one of a mapping table or a key management service. ### Claim 19 (depends on 17) The non-transitory computer readable storage medium of claim 17, wherein the storage controller application is further configured to: receive a second request to read the second encrypted data from a logical volume on the cloud-based storage system; retrieve the second encrypted data from the logical volume on the cloud-based storage system; decrypt the second encrypted data using a second decryption key to generate a second decrypted data, wherein the second decryption key is associated with the second encryption key; encrypt the second decrypted data using the first encryption key to generate a third encrypted data; and provide a response to the second request, the response comprising the third encrypted data. ### Claim 20 (depends on 19) The non-transitory computer readable storage medium of claim 19, wherein the storage controller application is further configured to: perform at least one of a data reconstitution operation or a data decompression operation on the second decrypted data.