Patent ID: 8117464

Claim:
A network storage system comprising: a hardware-implemented processor; a storage manager, operatively coupled to the processor, to service requests to access data stored in a persistent mass storage facility; a duplicate detection unit to detect a duplicate block of a first logical container of data and to determine whether the duplicate block is also part of a second logical container of data; and a cryptographic engine to encrypt a unique block of the first logical container of data by using a unique cryptographic key, encrypt the duplicate block by using a shared cryptographic key and the unique cryptographic key only if the duplicate block is determined also to be part of the second logical container of data, and otherwise to encrypt the duplicate block using the unique cryptographic key but not the shared cryptographic key if the duplicate block is determined not also to be part of the second logical container of data, and in conjunction with servicing a request to access the first logical container of data, decrypt the unique block of the first logical container of data by using the unique cryptographic key and decrypt the duplicate block of the first logical container of data by using the shared cryptographic key.