System and Method for Content Encryption in a Key/Value Store

Abstract

System and Method for Content Encryption in a Key/Value Store System and method embodiments are provided for content encryption in a key/value store. The embodiments include encrypting both the key and value of client data blocks for storage so that the data can be retrieved reliability without compromising the key. An embodiment method includes obtaining a key from a data block comprising the key and a value, encrypting the key using a deterministic encryption algorithm with an encryption key to map the key to a cypher text in a one-to-one mapping, and encrypting the value using a second encryption algorithm to randomly map the value to a second cypher text. Encrypting both the key and the value provides more protection to the client data instead of encrypting only the value and leaving the key vulnerable without encryption. The encrypted key can also be protected from unauthorized access and from the owner of the database or the storage system.

What is claimed is: 
     
         1 . A method for content encryption in a key-value store, the method comprising:
 deterministically encrypting a key in a key-value pair to map the key to a first cypher text, wherein deterministically encrypting the key provides a guarantee that the key is reproducible from the first cipher text;   randomly encrypting a value in the key-value pair to map the value to a second cypher text, wherein randomly encrypting the value does not provide a guarantee that the value is reproducible from the second cypher text; and   storing the second cypher text of the value with the first cypher text of the key in the key-value store.   
     
     
         2 . The method of  claim 1 , wherein deterministically encrypting the key in the key-value pair maps the key to the same cypher text each time the key is deterministically encrypted using a first encryption key. 
     
     
         3 . The method of  claim 2 , wherein randomly encrypting the value in the key-value pair maps the value to a different cypher text each time the value is randomly encrypted using a second encryption key. 
     
     
         4 . The method of  claim 1 , further comprising:
 retrieving the first cypher text of the key from the key-value store; and   deterministically decrypting the first cypher text to map the first cypher text to the key.   
     
     
         5 . The method of  claim 1 , wherein deterministically encrypting the key in the key-value pair comprises encrypting the key using an Advanced Encryption Standard (AES) EME 2  algorithm. 
     
     
         6 . The method of  claim 1 , wherein randomly encrypting the value in the key-value pair comprises encrypting the value using a Galois/Counter Mode (GCM) algorithm. 
     
     
         7 . The method of  claim 1 , wherein the key provides an index for retrieving data associated with the value from the key-value store. 
     
     
         8 . An apparatus for content encryption in a key-value store, the apparatus comprising:
 a processor; and   a computer readable storage medium storing programming for execution by the processor, the programming including instructions to:
 deterministically encrypt a key in a key-value pair to map the key to a first cypher text, wherein deterministically encrypting the key provides a guarantee that the key is reproducible from the first cipher text; 
 randomly encrypt a value in the key-value pair to map the value to a second cypher text, wherein randomly encrypting the value does not provide a guarantee that the value is reproducible from the second cypher text; and 
 store the second cypher text of the value with the first cypher text of the key in a key-value store. 
   
     
     
         9 . The apparatus of  claim 8 , wherein deterministically encrypting the key in the key-value pair maps the key to the same cypher text each time the key is deterministically encrypted using a first encryption key. 
     
     
         10 . The apparatus of  claim 9 , wherein randomly encrypting the value in the key-value pair maps the value to a different cypher text each time the value is randomly encrypted using a second encryption key. 
     
     
         11 . The apparatus of  claim 8 , wherein the programming further includes instructions to:
 retrieve the first cypher text of the key from the key-value store; and   deterministically decrypt the first cypher text to map the first cypher text to the key.   
     
     
         12 . The apparatus of  claim 8 , wherein the instructions to deterministically encrypt the key in the key-value pair includes instruction to encrypt the key using an Advanced Encryption Standard (AES) EME 2  algorithm. 
     
     
         13 . The apparatus of  claim 8 , wherein the instructions to randomly encrypt the value in the key-value pair includes instructions to encrypt the value using a Galois/Counter Mode (GCM) algorithm. 
     
     
         14 . The apparatus of  claim 8 , wherein the key provides an index for retrieving data associated with the value from the key-value store. 
     
     
         15 . A computer program product comprising a non-transitory computer readable storage medium storing programming, the programming including instructions to:
 deterministically encrypt a key in a key-value pair to map the key to a first cypher text, wherein deterministically encrypting the key provides a guarantee that the key is reproducible from the first cipher text;   randomly encrypt a value in the key-value pair to map the value to a second cypher text, wherein randomly encrypting the value does not provide a guarantee that the value is reproducible from the second cypher text; and   store the second cypher text of the value with the first cypher text of the key in a key-value store.   
     
     
         16 . The computer program product of  claim 15 , wherein deterministically encrypting the key in the key-value pair maps the key to the same cypher text each time the key is deterministically encrypted using a first encryption key. 
     
     
         17 . The computer program product of  claim 16 , wherein randomly encrypting the value in the key-value pair maps the value to a different cypher text each time the value is randomly encrypted using a second encryption key. 
     
     
         18 . The computer program product of  claim 16 , wherein the programming further includes instructions to:
 retrieve the first cypher text of the key from the key-value store; and   deterministically decrypt the first cypher text to map the first cypher text to the key.   
     
     
         19 . The computer program product of  claim 16 , wherein the instructions to deterministically encrypt the key in the key-value pair includes instruction to encrypt the key using an Advanced Encryption Standard (AES) EME 2  algorithm. 
     
     
         20 . The computer program product of  claim 16 , wherein the instructions to randomly encrypt the value in the key-value pair includes instructions to encrypt the value using a Galois/Counter Mode (GCM) algorithm.