Differential key backup

• US 10,027,478 B2
• Filed: 07/13/2016
• Issued: 07/17/2018
• Est. Priority Date: 10/09/2007
• Status: Expired due to Fees

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Baptist, Andrew D., Gladwin, S. Christopher, Leggette, Wesley B., Resch, Jason K.
• Primary Examiner(s): Naji, Younes
• Application Number:
  US15/208,790
• Publication Number:
  US 20160323103A1
• Time in Patent Office: 734 Days
• Field of Search: None
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 11/1443 Transmit or communication errors
• CPC Class Codes: G06F 11/1474 in transactions G06F16/20 takes precedence
• CPC Class Codes: G06F 11/3034 where the computing system component is a storage system, e.g. DASD based or network based digital input from or digital output to record carriers G06F3/06; digital recording or reproducing G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 12/1009 using page tables, e.g. page table structures
• CPC Class Codes: G06F 15/17331 Distributed shared memory [DSM], e.g. remote direct memory access [RDMA]
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2201/835 Timestamp
• CPC Class Codes: G06F 2211/1028 Distributed, i.e. distributed RAID systems with parity
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/064 Management of blocks
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB

Abstract

A method begins by computing device receiving a store data object message. The method continues by determining at least a portion of the data object. The method continues by determining an encryption key based on the at least a portion of the data object and a key reference of the encryption key. The method continues by retrieving a prior encryption key with a similar key reference from dispersed storage network (DSN) memory and calculating a difference key based on the encryption key and the prior encryption key. The method continues by creating encryption key information including the difference key and the similar key reference of the prior encryption key and encrypting the portion of the data object utilizing the key in accordance with operational parameters.

Claims

1. A method for execution by a computing device, the method comprises:

receiving a message to store a data object;

determining at least a portion of the data object;

generating an encryption key based on the at least a portion;

determining a key reference of the encryption key;

retrieving a prior encryption key with a similar key reference from dispersed storage network (DSN) memory;

calculating a difference key based on the encryption key and the prior encryption key, the difference key calculated by subtracting the prior encryption key from the encryption key; and

creating encryption key information including the difference key and the similar key reference of the prior encryption key;

encrypting the portion of the data object utilizing the encryption key information in accordance with operational parameters;

compressing the encrypted portion of the data object;

sending the compressed encrypted portion of the data object as the encrypted data portion to an access module of a DS processing unit to create encoded data slices and store the encoded data slices in the DSN memory.

2. The method of claim 1, wherein the determining at least a portion of the data object is based on one or more of:

operational parameters, a previous portion determination, or information in the message to store a data object.

3. The method of claim 1, wherein the generating the encryption key is based on one or more of:

the portion of the data object, an encryption algorithm, operational parameters, or content of the message to store a data object.

4. The method of claim 1, wherein the determining the key reference is based on one or more of the key, the portion of the data object, a hash algorithm, an encryption algorithm, operational parameters, or content of the message to store a data object.

5. The method of claim 1 further comprises a comparison of a key reference profile to key reference profiles stored with the DSN memory.

6. The method of claim 1 further comprises determining that the similar key reference is in the DSN memory based on a comparison that reveals that the key reference is substantially the same as a key reference stored in the DSN memory.

7. The method of claim 6 further comprises determining the similar key information based on one or more of a lookup in a key reference table, a vault lookup, a list, a command, a message, or a predetermination.

8. The method of claim 1 further comprises decompressing the key information from the DSN memory in accordance with operational parameters to retrieve the prior key.

9. The method of claim 1 further comprises compressing the difference key.

10. The method of claim 1 further comprises storing the key information in the DSN memory by creating a key information encoded data slices and storing the key information encoded data slices in the DSN.

11. A method for execution by a computing device, the method comprises:

receiving a message to store a data object;

determining at least a portion of the data object;

generating an encryption key based on the at least a portion of the data object;

determining a key reference;

determining whether a similar key reference is stored in a dispersed storage network (DSN) memory based on a search of key reference information stored in the DSN memory;

retrieving from DSN memory a prior key with the similar key reference;

calculating a difference key based on the encryption key and the prior key, the difference key calculated by subtracting the prior key from the encryption key; and

creating key information including the difference key and the key reference of the prior key;

encrypting the portion of the data object utilizing the key information in accordance with operational parameters;

compressing the encrypted portion of the data object;

sending the compressed encrypted portion of the data object as the encrypted data portion to an access module of a DS processing unit to create encoded data slices and store the encoded data slices in the DSN memory.