Distributed storage with auxiliary data interspersal and method for use therewith

• US 10,282,564 B2
• Filed: 08/05/2014
• Issued: 05/07/2019
• Est. Priority Date: 01/28/2010
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Gladwin, S. Christopher, Templeton, Chuck Wilson, Resch, Jason K., Grube, Gary W.
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US14/452,182
• Publication Number:
  US 20140344645A1
• Time in Patent Office: 1,736 Days
• Field of Search: 713194, 713193, 380 28, 380268, 380279
• CPC Class Codes: G06F 11/1008 in individual solid state devices G06F11/1004 takes precedence
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2211/1028 Distributed, i.e. distributed RAID systems with parity
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/0647 Migration mechanisms
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 65/764 at the destination reformatting of additional data in video clients H04N21/4355
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04N 21/222 Secondary servers, e.g. proxy server, cable television Head-end provisioning of proxy services in data packet switching networks H04L67/56
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/8456 by decomposing the content in the time domain, e.g. in time segments
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic

Abstract

A data segment is encrypted to produce an encrypted data segment. The encrypted data segment is dispersed storage error encoded to produce a set of encoded data slices. Auxiliary data is dispersed storage error encoded to produce a set of encoded auxiliary data slices. A sequence of output slices is generated to obscure the set of encoded data slices by interspersing the set of encoded auxiliary data slices within the set of encoded data slices.

Claims

1. A method comprising:

receiving a data segment of a data stream;

encrypting the data segment to produce an encrypted data segment;

dispersed storage error encoding the encrypted data segment to produce a set of encoded data slices, wherein a threshold number of the encoded data slices of the set of encoded data slices are needed to recover the encrypted data segment;

dispersed storage error encoding auxiliary data to produce a set of encoded auxiliary data slices;

generating a sequence of output slices to obscure the set of encoded data slices by interspersing the set of encoded auxiliary data slices within the set of encoded data slices; and

sending the sequence of output slices for storage in a distributed storage network (DSN).

2. The method of claim 1 wherein the interspersing of the set of encoded auxiliary data slices within the set of encoded data slices is in accordance with a pseudo random output sequencing order.

3. The method of claim 1 wherein the auxiliary data is encrypted via an encryption methodology used to encrypt the encrypted data segment.

4. The method of claim 1 wherein the auxiliary data is encrypted via an all or nothing transformation and the encrypted data segment is encrypted via an all or nothing transformation.

5. The method of claim 1 further comprising:

reordering the set of encoded data slices prior to generating the sequence of output slices.

6. The method of claim 1, wherein the auxiliary data comprises at least one of:

null data;

authentication information;

a next pseudo random output sequencing order;

a pseudo random output sequencing order identifier;

a next outputting threshold;

a random number generator output;

an encryption key;

a starting point for the pseudo random output sequencing order;

a device identifier;

a data identifier;

a data type;

a data size indicator;

a priority indicator;

a security indicator;

or

a performance indicator.

7. The method of claim 6 further comprising:

reordering the set of encoded auxiliary data slices prior to generating the sequence of output slices.

8. A dispersed storage and task (DST) processing unit comprises:

at least one module, when operable within a computing device, that causes the computing device to;

receive a data segment of a data stream;

encrypt the data segment to produce an encrypted data segment;

dispersed storage error encode the encrypted data segment to produce a set of encoded data slices, wherein a threshold number of the encoded data slices of the set of encoded data slices are needed to recover the encrypted data segment;

dispersed storage error encode auxiliary data to produce a set of encoded auxiliary data slices;

generate a sequence of output slices to obscure the set of encoded data slices by interspersing the set of encoded auxiliary data slices within the set of encoded data slices; and

send the sequence of output slices for storage in a distributed storage network (DSN).

9. The DST processing unit of claim 8 wherein the interspersing of the set of encoded auxiliary data slices within the set of encoded data slices is in accordance with a pseudo random output sequencing order.

10. The DST processing unit of claim 8 wherein the auxiliary data is encrypted via an encryption methodology used to encrypt the encrypted data segment.

11. The DST processing unit of claim 8 wherein the auxiliary data is encrypted via an all or nothing transformation and the encrypted data segment is encrypted via an all or nothing transformation.

12. The DST processing unit of claim 8 wherein the at least one module, when operable within the computing device, further causes the computing device to:

reorder the set of encoded data slices prior to generating the sequence of output slices.

13. The DST processing unit of claim 8 wherein the auxiliary data comprises at least one of:

null data;

authentication information;

a next pseudo random output sequencing order;

a pseudo random output sequencing order identifier;

a next outputting threshold;

a random number generator output;

an encryption key;

a starting point for the pseudo random output sequencing order;

a device identifier;

a data identifier;

a data type;

a data size indicator;

a priority indicator;

a security indicator;

or

a performance indicator.

14. The DST processing unit of claim 13 wherein the at least one module, when operable within the computing device, further causes the computing device to:

reorder the set of encoded auxiliary data slices prior to generating the sequence of output slices.

15. A computer readable storage medium comprises:

at least one memory section that stores operational instructions that, when executed by one or more processing modules of one or more computing devices of a dispersed storage network (DSN), causes the one or more computing devices to;

receive a data segment of a data stream;

encrypt the data segment to produce an encrypted data segment;

dispersed storage error encode the encrypted data segment to produce a set of encoded data slices;

dispersed storage error encode auxiliary data to produce a set of encoded auxiliary data slices;

generate a sequence of output slices to obscure the set of encoded data slices by interspersing the set of encoded auxiliary data slices within the set of encoded data slices; and

send the sequence of output slices for storage in a distributed storage network (DSN).

16. The computer readable storage medium of claim 15 wherein the interspersing of the set of encoded auxiliary data slices within the set of encoded data slices is in accordance with a pseudo random output sequencing order.

17. The computer readable storage medium of claim 15 wherein the auxiliary data is encrypted via an encryption methodology used to encrypt the encrypted data segment.

18. The computer readable storage medium of claim 15 wherein the auxiliary data is encrypted via an all or nothing transformation and the encrypted data segment is encrypted via an all or nothing transformation.

19. The computer readable storage medium of claim 15 wherein the operational instructions, when executed by the one or more processing modules of the one or more computing devices of the dispersed storage network (DSN), further causes the one or more computing devices to:

reorder the set of encoded data slices prior to generating the sequence of output slices.

20. The computer readable storage medium of claim 15 wherein the auxiliary data comprises at least one of:

null data;

authentication information;

a next pseudo random output sequencing order;

a pseudo random output sequencing order identifier;

a next outputting threshold;

a random number generator output;

an encryption key;

a starting point for the pseudo random output sequencing order;

a device identifier;

a data identifier;

a data type;

a data size indicator;

a priority indicator;

a security indicator;

or

a performance indicator.