Encrypting data for storage in a dispersed storage network

• US 10,042,703 B2
• Filed: 06/27/2016
• Issued: 08/07/2018
• Est. Priority Date: 04/25/2012
• Status: Expired due to Fees

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Resch, Jason K., Dhuse, Greg
• Primary Examiner(s): GIDDINS, NELSON S
• Application Number:
  US15/193,335
• Publication Number:
  US 20160306699A1
• Time in Patent Office: 771 Days
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/064 Management of blocks
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]

Abstract

A method includes generating a data matrix from the data, wherein the data matrix includes a plurality of columns and a plurality of rows. The method further includes generating a chunkset data matrix from one or more rows of the data matrix. The method further includes matrix multiplying the chunkset data matrix by an encoding matrix to produce a chunkset slice matrix, wherein a row of the chunkset slice matrix corresponds to an encoded data slice and wherein the plurality of rows of the chunkset slice matrix corresponds to a set of encoded data slices, wherein a decode threshold number of encoded data slices of the set of encoded data slices is needed to recover the data grouping associated with the one or more rows of the data matrix.

Claims

1. A method for dispersed storage error encoding data by a computing device, the method comprises:

generating, by the computing device, a data matrix from the data, wherein the data matrix includes a plurality of columns and a plurality of rows, a column of the plurality of columns is based on data size and a row of the plurality of rows is based on a data grouping;

generating, by the computing device, a chunkset data matrix, wherein generating, by the computing device, the chunkset data matrix comprises;

selecting, by the computing device, a row of the data matrix;

dividing, by the computing device, the data grouping of the selected row into a decode threshold number of data sub-groupings;

determining the selected number of data blocks based on a desired data size for a data block of the selected number of data blocks in accordance with a desired level of reliability performance;

dividing, by the computing device, each of the decode threshold number of data sub-groupings into the selected number of data blocks; and

arranging, by the computing device, the selected number of data blocks of the decode threshold number of data sub-groupings into the chunkset data matrix;

matrix multiplying, by the computing device, the chunkset data matrix by an encoding matrix to produce a chunkset slice matrix, wherein a row of the chunkset slice matrix corresponds to an encoded data slice and wherein the plurality of rows of the chunkset slice matrix corresponds to a set of encoded data slices, wherein a decode threshold number of encoded data slices of the set of encoded data slices is needed to recover the data grouping associated with the one or more rows of the data matrix.

2. The method of claim 1, wherein the generating, by the computing device, the data matrix comprises:

obtaining, by the computing device, the data, which includes a plurality of data groups;

determining, by the computing device, a data length for a data chunkset based on size of one or more data groups of the plurality of data groups;

arranging, by the computing device, the plurality of data groups into data chunksets based on the data length;

determining, by the computing device, whether data padding is needed for one or more of the data chunksets; and

when data padding is needed for one or more of the data chunksets, adding, by the computing device, data padding to the data one or more of the data chunksets such that each of the data chunksets is of a substantially similar data length.

3. The method of claim 1, wherein the matrix multiplying, by the computing device, comprises:

selecting, by the computing device, a column of the chunkset data matrix to produce a selected column of the chunkset data matrix;

matrix multiplying, by the computing device, the selected column of the chunkset data matrix by the encoding matrix to produce a column of the chunkset slice matrix; and

repeating the selecting of the selected column and the matrix multiplying, by the computing device, of the selected column until each of the columns of the chunkset data matrix have been selected and matrix multiplied to produce the chunkset slice matrix.

4. The method of claim 1 further comprises:

encrypting, by the computing device, the decode threshold number of encoded data slices to produce a subset of encrypted encoded data slices; and

sending, by the computing device, the subset of encrypted encoded data slices and remaining encoded data slices of the set of encoded data slices to storage units for storage therein.

5. The method of claim 1, where the data comprises one or more of:

a text data object;

a portion of the text data object;

a video data object;

a portion of the vide data object;

an audio data object;

a portion of the audio data object;

an graphic image data object; and

a portion of the graphic image data object, wherein at least one of;

the text data object, the portion of the text data object, the video data object, the portion of the vide data object, the audio data object, the portion of the audio data object, the graphic image data object, and the portion of the graphic image data object is in a group of data corresponding to the data grouping.

6. A computer readable memory device comprises:

a first memory section that stores operational instructions that, when executed by a computing device, causes the computing device to;

generate a data matrix from the data, wherein the data matrix includes a plurality of columns and a plurality of rows, a column of the plurality of columns is based on data size and a row of the plurality of rows is based on a data grouping;

a second memory section that stores operational instructions that, when executed by the computing device, causes the computing device to;

generate a chunkset data matrix from one or more rows of the data matrix, wherein generating the chunkset data matrix comprises;

selecting a row of the data matrix;

dividing the data grouping of the selected row into a decode threshold number of data sub-groupings;

determine the selected number of data blocks based on a desired data size for a data block of the selected number of data blocks in accordance with a desired level of reliability performance;

dividing each of the decode threshold number of data sub-groupings into the selected number of data blocks; and

arranging the selected number of data blocks of the decode threshold number of data sub-groupings into the chunkset data matrix;

a third memory section that stores operational instructions that, when executed by the computing device, causes the computing device to;

matrix multiply the chunkset data matrix by an encoding matrix to produce a chunkset slice matrix, wherein a row of the chunkset slice matrix corresponds to an encoded data slice and wherein the plurality of rows of the chunkset slice matrix corresponds to a set of encoded data slices, wherein a decode threshold number of encoded data slices of the set of encoded data slices is needed to recover the data grouping associated with the one or more rows of the data matrix.

7. The computer readable memory device of claim 6, wherein the first memory section further stores operational instructions that, when executed by the computing device, causes the computing device to generate the data matrix by:

obtaining the data, which includes a plurality of data groups;

determining a data length for a data chunkset based on size of one or more data groups of the plurality of data groups;

arranging the plurality of data groups into data chunksets based on the data length;

determining whether data padding is needed for one or more of the data chunksets; and

when data padding is needed for one or more of the data chunksets, adding data padding to the data one or more of the data chunksets such that each of the data chunksets is of a substantially similar data length.

8. The computer readable memory device of claim 6, wherein the third memory section further stores operational instructions that, when executed by the computing device, causes the computing device to matrix multiplying by:

selecting a column of the chunkset data matrix to produce a selected column of the chunkset data matrix;

matrix multiplying the selected column of the chunkset data matrix by the encoding matrix to produce a column of the chunkset slice matrix; and

repeating the selecting of the selected column and the matrix multiplying of the selected column until each of the columns of the chunkset data matrix have been selected and matrix multiplied to produce the chunkset slice matrix.

9. The computer readable memory device of claim 6, wherein the third memory section further stores operational instructions that, when executed by the computing device, causes the computing device to:

encrypt the decode threshold number of encoded data slices to produce a subset of encrypted encoded data slices; and

send the subset of encrypted encoded data slices and remaining encoded data slices of the set of encoded data slices to storage units for storage therein.

10. The computer readable memory device of claim 6, where the data comprises one or more of:

a text data object;

a portion of the text data object;

a video data object;

a portion of the vide data object;

an audio data object;

a portion of the audio data object;

an graphic image data object; and

a portion of the graphic image data object, wherein at least one of;

the text data object, the portion of the text data object, the video data object, the portion of the vide data object, the audio data object, the portion of the audio data object, the graphic image data object, and the portion of the graphic image data object is in a group of data corresponding to the data grouping.