Data encryption in a two-tier storage system

A non-transitory computer readable medium comprising instructions that, when executed by one or more processors of a computing system, cause the computing system to perform a method of encrypting data in one or more data blocks, the method comprising:

• receiving a plurality of data blocks to write on a plurality of physical disks associated with a set of one or more host machines;
• encrypting data in each data block in the plurality of data blocks using a logical block address (LBA) of the data block as a tweak;
• storing the plurality of encrypted data blocks in a plurality of physical blocks of the plurality of physical disks;
• storing, for each of the plurality of physical blocks, an indication of whether encrypted data stored in the physical block is encrypted with an LBA as a tweak or a physical block address (PBA) as a tweak, wherein a first indication indicates that first encrypted data stored in a first physical block in the plurality of physical blocks is encrypted with an LBA as a tweak;
• and
• performing deduplication on the plurality of physical disks by:
• determining that the first physical block and a second physical block in the plurality of physical disks are duplicates, the first physical block having the first encrypted data encrypted by a first LBA associated with the first physical block as a tweak, the second physical block having second encrypted data encrypted by a second LBA associated with the second physical block as a tweak;
• decrypting the first encrypted data in the first physical block using the first LBA associated with the first physical block as a tweak;
• re-encrypting decrypted data in the first physical block using a first PBA associated with the first physical block as a tweak;
• and
• changing the first indication to indicate that encrypted data stored in the first physical block is encrypted with a PBA as a tweak.

A computer system, comprising:

• a memory;
• and
• at least one processor coupled to the memory, the at least one processor being configured to cause the computer system to:
• receive a plurality of data blocks to write on a plurality of physical disks associated with a set of one or more host machines;
• encrypt data in each data block in the plurality of data blocks using a logical block address (LBA) of the data block as a tweak;
• store the plurality of encrypted data blocks in a plurality of physical blocks of the plurality of physical disks;
• store, for each of the plurality of physical blocks, an indication of whether encrypted data stored in the physical block is encrypted with an LBA as a tweak or a physical block address (PBA) as a tweak, wherein a first indication indicates that first encrypted data stored in a first physical block in the plurality of physical blocks is encrypted with an LBA as a tweak;
• and
• perform deduplication on the plurality of physical disks by:
• determining that the first physical block and a second physical block in the plurality of physical disks are duplicates, the first physical block having the first encrypted data encrypted by a first LBA associated with the first physical block as a tweak, the second physical block having second encrypted data encrypted by a second LBA associated with the second physical block as a tweak;
• decrypting the first encrypted data in the first physical block using the first LBA associated with the first physical block as a tweak;
• re-encrypting decrypted data in the first physical block using a first PBA associated with the first physical block as a tweak;
• and
• changing the first indication to indicate that encrypted data stored in the first physical block is encrypted with a PBA as a tweak.