# US 12,182,424 B2 · Optimizing data reduction for data in encrypted volumes

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,182,424 B2
- Document ID: US12182424B2
- Status: Granted
- Kind: B2
- Application number: 18/481,113
- Filed: 2023-10-04
- Published: 2024-02-01
- Granted: 2024-12-31
- Earliest claimed: 2017-12-21
- Assignees: Pure Storage, Inc.
- Applicants: Pure Storage, Inc.
- Inventors: Constantine P. Sapuntzakis; Timothy W. Brennan; Yuval Frandzel
- Web page: https://patentgrep.com/patent/US12182424B2

## CPC

- G06F 3/0626: {Reducing size or complexity of storage systems}
- G06F 3/0608: {Saving storage space on storage systems}
- G06F 3/062: {Securing storage systems}
- G06F 3/0661: {Format or protocol conversion arrangements}
- G06F 3/0662: {Virtualisation aspects}
- G06F 3/067: {Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]}
- G06F 3/0689: {Disk arrays, e.g. RAID, JBOD}
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- H04L 9/14: using a plurality of keys or algorithms
- G06F 2009/45583: {Memory management, e.g. access or allocation}
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- H04L 2209/30: Compression, e.g. Merkle-Damgard construction
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method of data reduction in a partially encrypted volume includes receiving data to be stored on a storage array, decrypting the data using a first encryption key to generate first decrypted data, and decrypting the data using a second encryption key to generate second decrypted data. The method further includes comparing, by a storage array controller, a first compressibility value of the first decrypted data to a second compressibility value of the second decrypted data. The method further includes storing the first decrypted data if the first compressibility value is greater than or equal to the second compressibility value. The method further includes storing the second decrypted data if the second compressibility value is greater than the first compressibility value.

## Claims

### Claim 1

A method, comprising:
generating a plurality of decryption results by decrypting data to be stored on a storage array using a plurality of encryption keys; and
of the plurality of decryption results, storing a first decryption result whose degree of compressibility is indicated by a first compressibility value that is greater than at least one other compressibility value of at least one other decryption result of the plurality of decryption results.

### Claim 2 (depends on 1)

The method of claim 1, wherein an encryption key of the plurality of encryption keys corresponds to a null encryption algorithm.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
calculating compressibility values of sets of decrypted data that are generated using different encryption keys.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
storing an identifier of an encryption key of the plurality of encryption keys with the decrypted data that corresponds to the encryption key if a corresponding compressibility value is greater than another compressibility value calculated for another set of decrypted data that is generated using another encryption key.

### Claim 5 (depends on 4)

The method of claim 4, wherein a first compressibility value is greater than or equal to a second compressibility value, further comprising:
receiving a request to read first decrypted data corresponding to the first compressibility value;
identifying a particular encryption key matching the first decrypted data;
encrypting the first decrypted data with the particular encryption key to generate first encrypted data; and
providing the first encrypted data.

### Claim 6 (depends on 1)

The method of claim 1, wherein a compressibility value of decrypted data comprises a deduplication metric of the decrypted data.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
determining that a performance metric of the storage array is greater than or equal to a performance metric threshold; and
based on the determining, decrypting the data using a second encryption key to generate second decrypted data;
comparing a second compressibility value of the second decrypted data to at least one other compressibility value; and
storing the second decrypted data if the second compressibility value is greater than or equal to the at least one other compressibility value.

### Claim 8 (depends on 1)

The method of claim 1, wherein different encryption keys correspond to different virtual machines.

### Claim 9 (depends on 1)

The method of claim 1, wherein generating the first decrypted result comprises decrypting only a subset of the data to generate the first decrypted result.

### Claim 10 (depends on 1)

The method of claim 1, wherein the first compressibility value corresponds to a subset of the first decryption result.

### Claim 11

A storage system comprising:
a storage array comprising one or more storage devices; and
a storage array controller coupled to the storage array, the storage array controller to:
generate a plurality of decryption results by decrypting data to be stored on a storage array using a plurality of encryption keys; and
of the plurality of decryption results, store a first decryption result whose degree of compressibility is indicated by a first compressibility value that is greater than at least one other compressibility value of at least one other decryption result of the plurality of decryption results.

### Claim 12 (depends on 11)

The storage system of claim 11, wherein an encryption key of the plurality of encryption keys corresponds to a null encryption algorithm.

### Claim 13 (depends on 11)

The storage system of claim 11, the storage array controller further to:
calculate compressibility values of sets of decrypted data that are generated using different encryption keys.

### Claim 14 (depends on 11)

The storage system of claim 11, the storage array controller further to:
store an identifier of an encryption key of the plurality of encryption keys with the decrypted data that corresponds to the encryption key if a corresponding compressibility value is greater than another compressibility value calculated for another set of decrypted data that is generated using another encryption key.

### Claim 15 (depends on 14)

The storage system of claim 14, wherein the first compressibility value is greater than or equal to another compressibility value, the storage array controller further to:
receive a request to read first decrypted data corresponding to the first compressibility value;
identify a particular encryption key matching the first decrypted data;
encrypting the first decrypted data with the particular encryption key to generate first encrypted data; and
provide the first encrypted data.

### Claim 16 (depends on 15)

The storage system of claim 15, wherein a compressibility value of decrypted data comprises a deduplication metric of the decrypted data.

### Claim 17 (depends on 11)

The storage system of claim 11, wherein the first compressibility value of the first decrypted data comprises a first deduplication metric of the first decrypted data.

### Claim 18 (depends on 11)

The storage system of claim 11, the storage array controller further to:
determine that a performance metric of the storage array is greater than or equal to a performance metric threshold; and
based on the determining, decrypt the data using a second encryption key to generate second decrypted data;
compare a second compressibility value of the second decrypted data to at least one other compressibility value; and
store the second decrypted data if the second compressibility value is greater than or equal to the at least one other compressibility value.

### Claim 19 (depends on 11)

The storage system of claim 11, wherein different encryption keys correspond to different virtual machines.

### Claim 20 (depends on 11)

The storage system of claim 11, wherein generating the first decrypted result comprises decrypting only a subset of the data to generate the first decrypted result.