Deduplication in a trusted execution environment

A method comprising:

• receiving, by a processing device, a plurality of encrypted, incoming user data blocks for a storage platform;
• decrypting, by the processing device, in a trusted execution environment associated with the storage platform, the plurality of encrypted, incoming user data blocks to produce unencrypted user data blocks;
• producing, by the processing device, an incoming digital fingerprint from an unencrypted user data block of the unencrypted user data blocks;
• comparing, by the processing device, for the unencrypted user data block, the incoming digital fingerprint to existing digital fingerprints stored in the trusted execution environment to determine a presence of the incoming digital fingerprint among the existing digital fingerprints;
• and
• adding, by the processing device, a reference count to a data pointer that identifies an encrypted, user data block as used by a tenant of the storage platform to deduplicate, the encrypted, incoming user data block based on the presence of the incoming digital fingerprint.

A non-transitory computer-readable medium comprising program code that is executable by a processing device for causing the processing device to:

• receive a plurality of encrypted, incoming user data blocks for a storage platform;
• decrypt, in a trusted execution environment associated with the storage platform, the plurality of encrypted, incoming user data blocks to produce unencrypted user data blocks;
• produce an incoming digital fingerprint from an unencrypted user data block of the unencrypted user data blocks;
• compare, for the unencrypted user data block, the incoming digital fingerprint to existing digital fingerprints stored in the trusted execution environment to determine a presence of the incoming digital fingerprint among the existing digital fingerprints;
• and
• add a reference count to a data pointer that identifies an encrypted, user data block as used by a tenant of the storage platform to deduplicate the encrypted, incoming user data block based on the presence of the incoming digital fingerprint.