End-to-end secure data storage in a dispersed storage network

• US 10,169,147 B2
• Filed: 08/16/2016
• Issued: 01/01/2019
• Est. Priority Date: 10/30/2015
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Dhuse, Greg R., Resch, Jason K., Vossberg, Trevor J.
• Primary Examiner(s): Lamarre, Guy J
• Application Number:
  US15/238,106
• Publication Number:
  US 20170123907A1
• Time in Patent Office: 868 Days
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 11/1092 Rebuilding, e.g. when physically replacing a failing disk
• CPC Class Codes: G06F 11/1096 Parity calculation or recalculation after configuration or reconfiguration of the system
• CPC Class Codes: G06F 11/2094 Redundant storage or storage space G06F11/2056 takes precedence
• CPC Class Codes: G06F 12/0646 Configuration or reconfiguration
• CPC Class Codes: G06F 2201/805 Real-time
• CPC Class Codes: G06F 2201/82 Solving problems relating to consistency ensuring consistency in mirrored systems G06F11/2064
• CPC Class Codes: G06F 2212/1008 Correctness of operation, e.g. memory ordering
• CPC Class Codes: G06F 2212/657 Virtual address space management
• CPC Class Codes: G06F 3/061 Improving I/O performance
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0623 in relation to content
• CPC Class Codes: G06F 3/0635 by changing the path, e.g. traffic rerouting, path reconfiguration
• CPC Class Codes: G06F 3/064 Management of blocks
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: G06F 9/4856 resumption being on a different machine, e.g. task migration, virtual machine migration G06F9/5088 takes precedence
• CPC Class Codes: H03M 13/1515 Reed-Solomon codes
• CPC Class Codes: H03M 13/3761 using code combining, i.e. using combining of codeword portions which may have been transmitted separately, e.g. Digital Fountain codes, Raptor codes or Luby Transform [LT] codes
• CPC Class Codes: H04L 41/0816 : the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 47/803 : Application aware
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0457 : wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065
• CPC Class Codes: H04L 63/06 : for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/068 : using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 : Access control lists [ACL]
• CPC Class Codes: H04L 67/1097 : for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/0861 : Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/14 : using a plurality of keys or algorithms

Abstract

A method includes a first computing device generating a set of encryption keys and encrypting a data matrix based on the set of encryption keys to produce an encrypted data matrix. The method further includes the first computing device sending the encrypted data matrix to a second computing device. The method further includes the second computing device dispersed storage error encoding the data matrix to produce a set of encrypted encoded data slices. The method further includes the second computing device sending the set of encrypted encoded data slices to a set of storage units of the DSN for storage therein.

Claims

1. A method comprises:

generating, by a first computing device of a dispersed storage network (DSN), a set of encryption keys;

encrypting, by the first computing device, a data matrix based on the set of encryption keys to produce an encrypted data matrix, wherein the data matrix includes data blocks of a data segment of a data object;

sending, by the first computing device, the encrypted data matrix to a second computing device of the DSN;

dispersed storage error encoding, by the second computing device, the data matrix to produce a set of encrypted encoded data slices; and

sending, by the second computing device, the set of encrypted encoded data slices to a set of storage units of the DSN for storage therein.

2. The method of claim 1 further comprises:

generating, by the first computing device, a set of temporary encryption keys as the set of encryption keys;

obtaining, by the set of storage units, the set of temporary encryption keys, wherein a first storage unit of the set of storage units obtains a first temporary encryption key of the set of temporary encryption keys;

decrypting, by the first storage unit, a first encrypted encoded data slice of the set of encrypted encoded data slices based on the first temporary encryption key to produce a first encoded data slice; and

storing, by the first storage unit, the first encoded data slice.

3. The method of claim 2, wherein the decrypting the first encrypted encoded data slice comprises:

converting the first temporary encryption key into a first key stream; and

finite field subtracting the first key stream from the first encrypted encoded data slice to produce the first encoded data slice.

4. The method of claim 3, wherein the finite field subtracting comprises:

exclusive ORing the first key stream with the first encrypted encoded data slice to produce the first encoded data slice.

5. The method of claim 1, wherein the encrypting the data matrix comprises:

generating a first key stream from a first encryption key of the set of encryption keys; and

finite field adding the first key stream with a first row of the data matrix to produce a first encrypted data matrix row.

6. The method of claim 5, wherein the finite field adding comprises:

exclusive ORing the first key stream with the first row of the data matrix to produce the first encrypted data matrix row.

7. The method of claim 1 further comprises:

generating the data matrix by;

determining a pillar width parameter, a decode threshold parameter, and an encoding function of the dispersed storage error encoding function; and

organizing the data blocks into a number of rows corresponding to the decode threshold parameter and a number of columns corresponding to the number of data blocks divided by the decode threshold parameter.

8. A computer readable memory comprises:

a first memory element that stores operational instructions, which, when executed by a first computing device of a dispersed storage network (DSN), causes the first computing device to;

generate a set of encryption keys;

encrypt a data matrix based on the set of encryption keys to produce an encrypted data matrix, wherein the data matrix includes data blocks of a data segment of a data object;

send the encrypted data matrix to a second computing device of the DSN;

a second memory element that stores operational instructions, which, when executed by the second computing device, causes the second computing device to;

dispersed storage error encode the data matrix to produce a set of encrypted encoded data slices; and

send the set of encrypted encoded data slices to a set of storage units of the DSN for storage therein.

9. The computer readable memory of claim 8 further comprises:

the first memory element further stores operational instructions, which, when executed by the first computing device, causes the first computing device to;

generate a set of temporary encryption keys as the set of encryption keys;

a third memory element that stores operational instructions, which, when executed by a storage unit of the set of storage units, causes the storage unit to;

obtain a temporary encryption key of the set of temporary encryption keys such that the set of storage units obtains the set of temporary encryption keys;

decrypt a corresponding encrypted encoded data slice of the set of encrypted encoded data slices based on the temporary encryption key to produce an encoded data slice; and

store the encoded data slice.

10. The computer readable memory of claim 9, wherein the decrypting the corresponding encrypted encoded data slice comprises:

converting the temporary encryption key into a key stream; and

finite field subtracting the key stream from the corresponding encrypted encoded data slice to produce the first encoded data slice.

11. The computer readable memory of claim 10, wherein the finite field subtracting comprises:

exclusive ORing the key stream with the corresponding encrypted encoded data slice to produce the encoded data slice.

12. The computer readable memory of claim 8, wherein the first memory element further stores operational instructions, which, when executed by the first computing device, causes the first computing device to encrypt the data matrix by:

generating a first key stream from a first encryption key of the set of encryption keys; and

finite field adding the first key stream with a first row of the data matrix to produce a first encrypted data matrix row.

13. The computer readable memory of claim 12, wherein the finite field adding comprises:

exclusive ORing the first key stream with the first row of the data matrix to produce the first encrypted data matrix row.

14. The computer readable memory of claim 8, wherein the first memory element further stores operational instructions, which, when executed by the first computing device, causes the first computing device to:

generate the data matrix by;

determining a pillar width parameter, a decode threshold parameter, and an encoding function of the dispersed storage error encoding function; and

organizing the data blocks into a number of rows corresponding to the decode threshold parameter and a number of columns corresponding to the number of data blocks divided by the decode threshold parameter.