Techniques for data storage protection and integrity checking

Abstract

Various embodiments are generally directed to techniques for encrypting stored data. An apparatus includes a processor component comprising a cache that comprises a cache line to store a first block of data corresponding to a second block of encrypted data stored within a storage; a compressor to compress the data within the first block to generate compressed data within the first block to clear sufficient storage space within the first block to store metadata associated with generation of the second block of encrypted data from the first block in response to eviction of the first block from the cache line; and an encrypter to encrypt the compressed data within the first block to generate the encrypted data within the second block and to store encryption metadata associated with encrypting the compressed data within the second block as a portion of the metadata associated with the generation of the second block.

1 . An apparatus, comprising:
 a processor; and   memory comprising instructions that when executed by the processor cause the processor to:
 retrieve a block from storage, the block comprising encrypted data and unencrypted data; 
 determine the encrypted data in the block includes compressed data; 
 retrieve encryption metadata from the unencrypted data in the block based on determination the encrypted data is compressed; 
 decrypt the encrypted data with the encryption metadata to produce decrypted compressed data and decrypted compression metadata; 
 decompress the decrypted compressed data with the decrypted compression metadata to produce recreated data; and 
 store the recreated data in the storage. 
   
     
     
         2 . The apparatus of  claim 1 , the memory comprising instructions that when executed by the processor cause the processor to:
 retrieve the encryption metadata and integrity metadata from the unencrypted data in the block based on determination the encrypted data is compressed;   verify integrity of at least one portion of the encrypted data based on the integrity metadata; and   decrypt the encrypted data with the encryption metadata to produce decrypted compressed data and decrypted compression metadata based on verification of the integrity of the at least one portion of the encrypted data.   
     
     
         3 . The apparatus of  claim 2 , the memory comprising instructions that when executed by the processor cause the processor to:
 take a measure of the at least one portion of the encrypted data; and   compare the measure of the at least one portion of the encrypted data with the integrity metadata to verify the integrity of the at least one portion of the encrypted data.   
     
     
         4 . The apparatus of  claim 3 , the measure comprising one or more of a checksum, a hash, and a cryptographic hash. 
     
     
         5 . The apparatus of  claim 1 , the memory comprising instructions that when executed by the processor cause the processor to:
 decrypt the encrypted data with the encryption metadata to produce the decrypted compressed data, decrypted integrity metadata, and the decrypted compression metadata;   verify integrity of the recreated data based on the decrypted integrity metadata; and   store the recreated data in the storage based on verification of the integrity of the recreated data.   
     
     
         6 . The apparatus of  claim 5 , the memory comprising instructions that when executed by the processor cause the processor to:
 take a measure of the recreated data; and   compare the measure of the recreated data with the decrypted integrity metadata to verify the integrity of the recreated data.   
     
     
         7 . The apparatus of  claim 6 , the measure comprising one or more of a checksum, a hash, and a cryptographic hash. 
     
     
         8 . The apparatus of  claim 1 , the storage comprising a cache and the block comprising a cache line. 
     
     
         9 . The apparatus of  claim 1 , the memory comprising instructions that when executed by the processor cause the processor to determine the encrypted data in the block includes compressed data based on a compression indicator included in the block. 
     
     
         10 . The apparatus of  claim 9 , the compression indicator comprising a single-bit binary value included in the block. 
     
     
         11 . At least one non-transitory computer-readable medium comprising a set of instructions that, in response to being executed by a processor circuit, cause the processor circuit to:
 retrieve a block from storage, the block comprising encrypted data and unencrypted data;   determine the encrypted data in the block includes compressed data;   retrieve encryption metadata from the unencrypted data in the block based on determination the encrypted data is compressed;   decrypt the encrypted data with the encryption metadata to produce decrypted compressed data and decrypted compression metadata;   decompress the decrypted compressed data with the decrypted compression metadata to produce recreated data; and   store the recreated data in the storage.   
     
     
         12 . The at least one non-transitory computer-readable medium of  claim 11 , comprising instructions that, in response to being executed by the processor circuit, cause the processor circuit to:
 retrieve the encryption metadata and integrity metadata from the unencrypted data in the block based on determination the encrypted data is compressed;   verify integrity of at least one portion of the encrypted data based on the integrity metadata; and   decrypt the encrypted data with the encryption metadata to produce decrypted compressed data and decrypted compression metadata based on verification of the integrity of the at least one portion of the encrypted data.   
     
     
         13 . The at least one non-transitory computer-readable medium of  claim 12 , comprising instructions that, in response to being executed by the processor circuit, cause the processor circuit to:
 take a measure of the at least one portion of the encrypted data; and   compare the measure of the at least one portion of the encrypted data with the integrity metadata to verify the integrity of the at least one portion of the encrypted data.   
     
     
         14 . The at least one non-transitory computer-readable medium of  claim 13 , the measure comprising one or more of a checksum, a hash, and a cryptographic hash. 
     
     
         15 . The at least one non-transitory computer-readable medium of  claim 11 , comprising instructions that, in response to being executed by the processor circuit, cause the processor circuit to:
 decrypt the encrypted data with the encryption metadata to produce the decrypted compressed data, decrypted integrity metadata, and the decrypted compression metadata;   verify integrity of the recreated data based on the decrypted integrity metadata; and   store the recreated data in the storage based on verification of the integrity of the recreated data.   
     
     
         16 . The at least one non-transitory computer-readable medium of  claim 15 , comprising instructions that, in response to being executed by the processor circuit, cause the processor circuit to:
 take a measure of the recreated data; and   compare the measure of the recreated data with the decrypted integrity metadata to verify the integrity of the recreated data.   
     
     
         17 . The at least one non-transitory computer-readable medium of  claim 16 , the measure comprising one or more of a checksum, a hash, and a cryptographic hash. 
     
     
         18 . The at least one non-transitory computer-readable medium of  claim 11 , the storage comprising a cache and the block comprising a cache line. 
     
     
         19 . The at least one non-transitory computer-readable medium of  claim 11 , comprising instructions that, in response to being executed by the processor circuit, cause the processor circuit to determine the encrypted data in the block includes compressed data based on a compression indicator included in the block. 
     
     
         20 . The at least one non-transitory computer-readable medium of  claim 19 , the compression indicator comprising a single-bit binary value included in the block. 
     
     
         21 . A computer-implemented method, comprising:
 retrieving a block from storage, the block comprising encrypted data and unencrypted data;   determining the encrypted data in the block includes compressed data;   retrieving encryption metadata from the unencrypted data in the block based on determination the encrypted data is compressed;   decrypting the encrypted data with the encryption metadata to produce decrypted compressed data and decrypted compression metadata;   decompressing the decrypted compressed data with the decrypted compression metadata to produce recreated data; and   storing the recreated data in the storage.   
     
     
         22 . The computer-implemented method of  claim 21 , comprising:
 retrieving the encryption metadata and integrity metadata from the unencrypted data in the block based on determination the encrypted data is compressed;   verifying integrity of at least one portion of the encrypted data based on the integrity metadata; and   decrypting the encrypted data with the encryption metadata to produce decrypted compressed data and decrypted compression metadata based on verification of the integrity of the at least one portion of the encrypted data.   
     
     
         23 . The computer-implemented method of  claim 22 , comprising:
 taking a measure of the at least one portion of the encrypted data; and   comparing the measure of the at least one portion of the encrypted data with the integrity metadata to verify the integrity of the at least one portion of the encrypted data.   
     
     
         24 . The computer-implemented method of  claim 21 , comprising:
 decrypting the encrypted data with the encryption metadata to produce the decrypted compressed data, decrypted integrity metadata, and the decrypted compression metadata;   verifying integrity of the recreated data based on the decrypted integrity metadata; and   storing the recreated data in the storage based on verification of the integrity of the recreated data.   
     
     
         25 . The computer-implemented method of  claim 24 , comprising:
 taking a measure of the recreated data; and   comparing the measure of the recreated data with the decrypted integrity metadata to verify the integrity of the recreated data.