Applying multiple hash functions to generate multiple masked keys in a secure slice implementation

• US 10,198,199 B2
• Filed: 11/16/2016
• Issued: 02/05/2019
• Est. Priority Date: 12/30/2015
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Resch, Jason K.
• Primary Examiner(s): McMahon, Daniel F.
• Application Number:
  US15/353,166
• Publication Number:
  US 20170192907A1
• Time in Patent Office: 811 Days
• Field of Search: None
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 11/1092 Rebuilding, e.g. when physically replacing a failing disk
• CPC Class Codes: G06F 12/0684 with feedback, e.g. presence or absence of unit detected by addressing, overflow detection
• CPC Class Codes: G06F 12/0813 with a network or matrix configuration
• CPC Class Codes: G06F 12/0888 using selective caching, e.g. bypass
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 16/182 Distributed file systems
• CPC Class Codes: G06F 16/2246 Trees, e.g. B+trees
• CPC Class Codes: G06F 2212/154 Networked environment
• CPC Class Codes: G06F 2212/263 Network storage, e.g. SAN or NAS
• CPC Class Codes: G06F 3/0604 Improving or facilitating administration, e.g. storage management
• CPC Class Codes: G06F 3/0608 Saving storage space on storage systems
• CPC Class Codes: G06F 3/0611 in relation to response time
• CPC Class Codes: G06F 3/0616 in relation to life time, e.g. increasing Mean Time Between Failures [MTBF]
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/0623 in relation to content
• CPC Class Codes: G06F 3/0631 by allocating resources to storage systems
• CPC Class Codes: G06F 3/064 Management of blocks
• CPC Class Codes: G06F 3/0644 Management of space entities, e.g. partitions, extents, pools
• CPC Class Codes: G06F 3/0647 Migration mechanisms
• CPC Class Codes: G06F 3/0652 : Erasing, e.g. deleting, data cleaning, moving of data to a wastebasket
• CPC Class Codes: G06F 3/0653 : Monitoring storage devices or systems
• CPC Class Codes: G06F 3/0659 : Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/0661 : Format or protocol conversion arrangements
• CPC Class Codes: G06F 3/0665 : at area level, e.g. provisioning of virtual or logical volumes
• CPC Class Codes: G06F 3/067 : Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H03M 13/1515 : Reed-Solomon codes
• CPC Class Codes: H03M 13/3761 : using code combining, i.e. using combining of codeword portions which may have been transmitted separately, e.g. Digital Fountain codes, Raptor codes or Luby Transform [LT] codes
• CPC Class Codes: H04L 43/0852 : Delays
• CPC Class Codes: H04L 43/0876 : Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/0888 : Throughput
• CPC Class Codes: H04L 43/16 : Threshold monitoring
• CPC Class Codes: H04L 67/1097 : for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

Methods and apparatus for efficiently storing and accessing secure data are disclosed. The method of storing includes encrypting data utilizing an encryption key to produce encrypted data, performing deterministic functions on the encrypted data to produce deterministic function values, masking the encryption key utilizing the deterministic function values to produce masked keys and combining the encrypted data and the masked keys to produce a secure package. The method of accessing includes de-combining a secure package to reproduce encrypted data and masked keys, selecting a deterministic function, performing the selected deterministic function on the reproduced encrypted data to reproduce a deterministic function value, de-masking a corresponding masked key utilizing the reproduced deterministic function value to reproduce an encryption key, and decrypting the reproduced encrypted data utilizing the reproduced encryption key to reproduce data.

Claims

1. A dispersed storage processing unit for use in a dispersed storage network, the dispersed storage processing unit comprising:

a communications interface;

a memory; and

a computer processor operably coupled to the memory and the communications interface, where the memory includes instructions for causing the computer processor to;

encrypt first data utilizing a first encryption key to produce first encrypted data;

perform a first plurality of deterministic functions on the first encrypted data to produce a first plurality of deterministic function values;

mask the first encryption key utilizing the first plurality of deterministic function values to produce a first plurality of masked keys;

combine the first encrypted data and the first plurality of masked keys to produce a first secure package;

receive, via the communications interface, a second secure package that differs from the first secure package;

de-combine the second secure package to reproduce second encrypted data and a second plurality of masked keys;

select a selected deterministic function of a second plurality of deterministic functions based on one or more characteristics of the second plurality of deterministic functions;

perform the selected deterministic function of the second plurality of deterministic functions on the second encrypted data to reproduce a reproduced deterministic function value;

de-mask a masked key of the second plurality of masked keys corresponding to the selected deterministic function of the second plurality of deterministic functions using the reproduced deterministic function value to produce a second encryption key; and

decrypt the second encrypted data utilizing the second encryption key to produce second data.

2. The dispersed storage processing unit of claim 1, wherein the first plurality of deterministic function values each includes a number of bits that is equal to a number of bits of the first encryption key.

3. The dispersed storage processing unit of claim 1, wherein the memory further comprises instructions for causing the computer processor to perform an exclusive OR function on first the encryption key and the first plurality of deterministic function values.

4. The dispersed storage processing unit of claim 1, wherein combining the first encrypted data and the first plurality of masked keys to produce a first secure packages includes appending each of the first plurality of masked keys to the first encrypted data.

5. The dispersed storage processing unit of claim 1, wherein the memory further comprises instructions for causing the computer processor to dispersed storage error encode the first secure package.

6. The dispersed storage processing unit of claim 1, wherein de-combining the second secure package to reproduce second encrypted data and a second plurality of masked keys includes de-appending the second plurality of masked keys from the second encrypted data.

7. The dispersed storage processing unit of claim 1, wherein the one or more characteristics of the second plurality of deterministic functions includes speed of execution.

8. The dispersed storage processing unit of claim 1, wherein the one or more characteristics of the second plurality of deterministic functions includes processing efficiency of operation.

9. The dispersed storage processing unit of claim 1, wherein the memory further comprises instructions for causing the computer processor to perform an exclusive OR function on the masked key of the second plurality of masked keys corresponding to the selected deterministic function of the second plurality of deterministic functions utilizing the reproduced deterministic function value.