# US 2014/0157005 A1 · Method and apparatus for a secure and deduplicated write once read many virtual disk

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0157005 A1
- Document ID: US20140157005A1
- Status: Published application
- Kind: A1
- Application number: 13/866,257
- Filed: 2013-04-19
- Published: 2014-06-05
- Earliest claimed: 2012-05-07
- Assignees: Dark Signal Research, LLC
- Inventors: David H. Leventhal; Robert F. Barnitt
- Web page: https://patentgrep.com/patent/US20140157005A1

## CPC

- H04L 9/0662: {with particular pseudorandom sequence generator}
- G06F 21/79: in semiconductor storage media, e.g. directly-addressable memories
- H04L 9/0637: {Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]}
- H04L 2209/125: Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method and apparatus is provided for the operation of a secure and deduplicated write once read many virtual disk which exceeds the write performance of traditional cryptographic methods. This is achieved through the utilization of a time-memory tradeoff via the empty space on a virtual disk at format time. Traditionally empty space is zeroed to indicate that data is not present. When implementing the apparatus, the empty space is filled with the output of a symmetric-key algorithm uniquely keyed for that specific disk. From an information theoretic point of view, the format operation stores cryptographically structured data, rather than purely redundant data, enabling the write operation that encodes data to be stored on the disk to operate without additional cryptographic computation. This reduced computation requirement for encoding enables the computation required deduplication to operate as if encoding was not being performed, resulting in a net throughput increase.

## Claims

### Claim 1

A secure and deduplicated write once read many data storage system comprising:
a format operation where a logical set of bytes on a memory resident write once read many virtual disk are initialized with the output of a symmetric-key algorithm operating in a block cipher mode where blocks can be encrypted in parallel; and
a write operation where a logical set of bytes are deduplicated encoded and written to a memory resident write once read many virtual disk; and
a read operation where a logical set of bytes are read decoded and reduplicated from a memory resident write once read many virtual disk.

### Claim 2 (depends on 1)

The system of claim 1, wherein memory resident means a set of bytes physically located in a processor cache or random access memory.

### Claim 3 (depends on 1)

The system of claim 1, wherein memory resident means a set of bytes physically located on a solid state memory device.

### Claim 4 (depends on 1)

The system of claim 1, wherein block cipher mode means a symmetric-key algorithm operating in counter mode or an authenticated mode that can operate in parallel.

### Claim 5

A method for formatting a secure and deduplicated write once read many virtual disk comprising:
a keying operation where a random number is generated and used to key a symmetric-key algorithm; and
an initialization operation where each byte of virtual disk is formatted with consecutive values from a keystream computed using a symmetric-key algorithm rather than redundant values.

### Claim 6 (depends on 5)

The method of claim 5, wherein a random number is generated using a hardware based random number generator.

### Claim 7 (depends on 5)

The method of claim 5, wherein a random number is generated using a software based pseudorandom number generator.

### Claim 8 (depends on 5)

The method of claim 5, wherein symmetric-key algorithm means the Advanced Encryption Standard operating in counter mode an authenticated mode that can operate in parallel.

### Claim 9 (depends on 5)

The method of claim 5, wherein symmetric-key algorithm means an arbitrary symmetric-key algorithm operating in counter mode an authenticated mode that can operate in parallel.

### Claim 10 (depends on 5)

The method of claim 5, wherein said initialization operation is performed using multiple processors, multiple cores on a single processor, or multiple cores on multiple processors in parallel.

### Claim 11

A method for writing to and reading bytes from a secure and deduplicated write once read many virtual disk comprising:
a write operation where bytes are deduplicated then encoded using keystream values from a previous format operation before being written to virtual disk; and
each byte written to virtual disk replaces the corresponding keystream byte which was used to encode by writing encoded byte to the same location on said virtual disk; and
a read operation where bytes are decoded using a symmetric-key algorithm operating in real time and then reduplicated.

### Claim 12 (depends on 10)

The method of claim 10, wherein deduplicated means each byte of data is compressed using a specialized technique for eliminating duplicate copies of redundant data.

### Claim 13 (depends on 10)

The method of claim 10, wherein encoded means each byte of data is combined with a corresponding byte of keystream using an exclusive or operation.

### Claim 14 (depends on 10)

The method of claim 10, wherein decoded means each byte of data is combined with a corresponding byte of output from a symmetric-key algorithm using an exclusive or operation.

### Claim 15 (depends on 10)

The method of claim 10, wherein reduplicated means each byte of data is uncompressed using a specialized technique for reconstructing to original form of data deduplicated by a previous write operation.