Apparatus, systems, and methods for crypto-erasing deduplicated data
AssigneeInternational Business Machines Corporation
InventorYosef Shatsky
Life of this patent
Estimating the term…
Abstract
Methods that can crypto-erase deduplicated data are disclosed herein. One method includes encrypting, by a processor, each data chunk on a storage device with a unique first encryption key that is different from each other first encryption key and encrypting each storage object on the storage device with a unique second encryption key that is different from each first encryption key and each other second encryption key in which each second encryption key encrypts a first encryption key for a data chunk. Apparatus, systems, and computer program products that can include, perform, and/or implement the methods are also disclosed herein.
Claims20
An apparatus, comprising:
- a first encryption module that encrypts each data chunk on a storage device with a unique first encryption key that is different from each other first encryption key;
- and
- a second encryption module that encrypts each storage object on the storage device with a unique second encryption key that is different from each first encryption key and each other second encryption key,
- wherein:
- each storage object stores at least one pointer to a respective data chunk,
- each pointer includes the unique first encryption key associated with its respective data chunk,
- each unique second encryption key encrypts each pointer on its respective storage object with a same unique second encryption key to encrypt each respective unique first encryption key for each respective data chunk including a corresponding pointer on the respective storage object with the same unique second encryption key, and
- at least a portion of said modules comprise one or more of a set of hardware circuits, a set of programmable hardware devices, and executable code stored on a set of non-transitory computer-readable storage media.
A method, comprising:
- encrypting, by a processor, each data chunk on a storage device with a unique first encryption key that is different from each other first encryption key;
- and
- encrypting each storage object on the storage device with a unique second encryption key that is different from each first encryption key and each other second encryption key,
- wherein:
- each storage object stores at least one pointer to a respective data chunk,
- each pointer includes the unique first encryption key associated with its respective data chunk, and
- each unique second encryption key encrypts each on its respective storage object with a same unique second encryption key to encrypt each respective unique first encryption key for each respective data chunk including a corresponding pointer on the respective storage object with the same unique second encryption key.
A computer program product comprising a computer-readable storage medium including program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:
- encrypt each data chunk on a storage device with a unique first encryption key that is different from each other first encryption key;
- and
- encrypt each storage object on the storage device with a unique second encryption key that is different from each first encryption key and each other second encryption key,
- wherein:
- each storage object stores at least one pointer to a respective data chunk,
- each pointer includes the unique first encryption key associated with its respective data chunk, and
- each unique second encryption key encrypts each pointer on its respective storage object with a same unique second encryption key to encrypt each respective unique first encryption key for each respective data chunk including a corresponding pointer on the respective storage object with the same unique second encryption key.
Dependencies are inferred from the claim text.