# US 2021/0342318 A1 · Deduplication of encrypted data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0342318 A1 - Document ID: US20210342318A1 - Status: Published application - Kind: A1 - Application number: 16/864,649 - Filed: 2020-05-01 - Published: 2021-11-04 - Earliest claimed: 2020-05-01 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Lee Jason Sanders; Gareth Paul Jones; Ben Sasson; Gordon Douglas Hutchison - Web page: https://patentgrep.com/patent/US20210342318A1 ## CPC - G06F 16/1748: {De-duplication implemented within the file system, e.g. based on file segments (de-duplication techniques in storage systems for the management of data blocks G06F3/0641)} - G06F 16/215: Improving data quality; Data cleansing, e.g. de-duplication, removing invalid entries or correcting typographical errors - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/14: using a plurality of keys or algorithms - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A data storage system configured to deduplicate and store sets of data is presented. The system comprises a computer readable storage device configured to store a plurality of sets of data for a plurality of hosts, wherein each sets of data of the plurality of sets of data corresponding to each host of the plurality of hosts is encrypted with one or more different encryption keys, and wherein at least one of the plurality of sets of data contains deduplicated data. The system also comprises a key translator configured to create at least one translation key based, at least in part, on the one or more different encryption keys and the deduplicated data, and wherein the at least one translation key is configured to translate from a first encryption key to a second encryption key of the one or more different encryption keys. ## Claims ### Claim 1 A system configured to deduplicate and store sets of data, the system comprising: one or more computer processors and a computer readable storage device stored on at least one of the one or more computer processors; the computer readable storage device configured to store a plurality of sets of data for a plurality of hosts, wherein each sets of data of the plurality of sets of data corresponding to each host of the plurality of hosts is encrypted with one or more different encryption keys, and wherein at least one of the plurality of sets of data contains deduplicated data; and a key translator configured to create at least one translation key based, at least in part, on the one or more different encryption keys and the deduplicated data, and wherein the at least one translation key is configured to translate from a first encryption key to a second encryption key of the one or more different encryption keys. ### Claim 2 (depends on 1) The system of claim 1, wherein the computer readable storage device comprises: a storage controller configured to: create deduplication links; receive read and write instructions from a host; and send instructions to the key translator, and a physical storage configured to store the deduplicated data. ### Claim 3 (depends on 2) The system of claim 2, wherein instructions sent to the key translator are to translate the deduplicated data with the at least one translation key. ### Claim 4 (depends on 3) The system of claim 3, wherein the at least one translation key is based on symmetric encryptions keys. ### Claim 5 (depends on 3) The system of claim 3, wherein the at least one translation key is based on decrypting the deduplicated data with an original key, and subsequently re-encrypting the deduplicated data with an encryption key, wherein the original key is used to decrypt the deduplicated data and the encryption key is used to encrypt data by the plurality of hosts sending read instructions. ### Claim 6 (depends on 5) The system of claim 5, wherein the key translator is further configured to re-salt the deduplicated data following the duplicated data being translated with the at least one translation key. ### Claim 7 (depends on 2) The system of claim 2, wherein instructions sent to the key translator are to send the at least one translation key to the storage controller, and wherein the storage controller is configured to translate the duplicated data with the at least one translation key. ### Claim 8 (depends on 2) The system of claim 2, wherein the storage controller is further configured to store a metadata database, wherein the metadata database is configured to store information on a physical location of data in a physical storage device. ### Claim 9 (depends on 2) The system of claim 2, wherein the storage controller is further configured to store a deduplication database, wherein the deduplication database is configured to store information on data that has been deduplicated. ### Claim 10 (depends on 9) The system of claim 9, wherein the key translator is further configured to hash encrypted data when the storage controller receives a write instruction for the encrypted data, and wherein the hash is used by the storage controller to determine whether the encrypted data can be deduplicated based on the deduplication database. ### Claim 11 (depends on 1) The system of claim 1, wherein the key translator further comprises a load balancer. ### Claim 12 A computer-implemented method for deduplicating and storing sets of data, the method comprising: storing a plurality of sets of data for a plurality of hosts, wherein each sets of data of the plurality of sets of data corresponding to each host of the plurality of hosts is encrypted with one or more different encryption keys, and wherein at least one of the plurality of sets of data contains deduplicated data; and creating at least one translation key based, at least in part, on the one or more different encryption keys and the deduplicated data, and wherein the at least one translation key is configured to translate from a first encryption key to a second encryption key of the one or more different encryption keys. ### Claim 13 (depends on 12) The method of claim 12, wherein storing the plurality of sets of data, wherein at least one set of data of the plurality of sets of data contains deduplicated data, is based, at least in part on: receiving a write instruction, encrypted data and a hash corresponding to un-encrypted data from at least one host of the plurality of hosts with a corresponding encryption key and decryption key; checking whether the hash exists in a deduplication database; responsive to a determination that the hash exists, creating a deduplication link in a metadata database; and responsive to a determination that the hash does not exist: updating the deduplication database with the hash; writing the encrypted data in a physical storage; and updating the metadata database with a location of the encrypted data in a physical storage device. ### Claim 14 (depends on 12) The method of claim 12, wherein creating the at least one translation key is based on symmetric encryption keys. ### Claim 15 (depends on 12) The method of claim 12, wherein creating the at least one translation key is based on decrypting the deduplicated data with an original key, and subsequently re-encrypting the deduplicated data with an encryption key, wherein the original key is used to decrypt the deduplicated data and the encryption key is used to encrypt data by the plurality of hosts sending read instructions. ### Claim 16 (depends on 15) The method of claim 15, further comprising re-salting the deduplicated data following the duplicated data being translated with the at least one translation key. ### Claim 17 (depends on 12) The method of claim 12, wherein the deduplicated data is stored in a computer readable storage device and the at least one translation key is created in a key translator. ### Claim 18 (depends on 17) The method of claim 17, further comprising: sending the deduplication data from the computer readable storage device to the key translator based on receiving a read instruction for the deduplication data from a host of the plurality of hosts; and translating the deduplication data with the at least one translation key. ### Claim 19 A computer program product for deduplicating and storing sets of data, the computer program product comprising: one or more computer readable storage devices and program instructions stored on the one or more computer readable storage devices, the program instructions comprising: program instructions executable for storing a plurality of sets of data for a plurality of hosts, wherein each sets of data of the plurality of sets of data corresponding to each host of the plurality of hosts is encrypted with one or more different encryption keys, and wherein at least one of the plurality of sets of data contains deduplicated data; and program instructions executable for creating at least one translation key based, at least in part, on the one or more different encryption keys and the deduplicated data, and wherein the at least one translation key is configured to translate from a first encryption key to a second encryption key of the one or more different encryption keys. ### Claim 20 (depends on 19) The computer program product of claim 19, wherein the one or more computer readable storage devices further comprise: at least one storage controller configured to: create deduplication links; receive read and write instructions from a host; and send instructions to the key translator, and a physical storage device configured to store the deduplicated data.