Dispersed data storage system data decoding and decryption

• US 10,447,474 B2
• Filed: 08/31/2009
• Issued: 10/15/2019
• Est. Priority Date: 04/20/2009
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Pure Storage, Inc.
• Inventors: Leggette, Wesley, Resch, Jason K.
• Primary Examiner(s): Decady, Albert
• Assistant Examiner(s): Ahmed, Enam
• Application Number:
  US12/551,145
• Publication Number:
  US 20100269008A1
• Time in Patent Office: 3,697 Days
• Field of Search: 714746
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2109 Game systems
• CPC Class Codes: H03M 13/15 Cyclic codes, i.e. cyclic shifts of codewords produce other codewords, e.g. codes defined by a generator polynomial, Bose-Chaudhuri-Hocquenghem [BCH] codes H03M13/17 takes precedence
• CPC Class Codes: H03M 13/1515 Reed-Solomon codes
• CPC Class Codes: H03M 13/23 using convolutional codes, e.g. unit memory codes
• CPC Class Codes: H04L 1/0057 Block codes H04L1/0061, H04L1/0064 take precedence
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A computing system retrieves securely stored encrypted and encoded data from a dispersed data storage system. The computing system includes a processing module and a plurality of storage units. The processing module includes an error decoder and a decryptor and to decode and decrypt the encrypted and encoded data retrieved from the dispersed data storage system utilizing a read command to the storage units. The storage units retrieve the encrypted and encoded data and send the encrypted and encoded data to the processing module when receiving the read command.

Claims

1. A method for execution by a processing module, the method comprises:

receiving, via a network interface, error coded data;

decoding the error coded data using an error coding scheme to produce transformed data;

partitioning the transformed data into an encoded encryption key for decoding encrypted data included in the transformed data and the encrypted data;

performing a hash function on the encrypted data to produce a digest resultant;

combining the digest resultant with the encoded encryption key to generate combined key data;

decoding the combined key data to recover an encryption key; and

decrypting the encrypted data using the encryption key to recover data.

2. The method of claim 1, wherein the decoding the error coded data by the processing module further comprises:

receiving at least k number of error coded data slices; and

error decoding the at least k number of error coded data slices using a forward error correction scheme having a failure tolerance of n−

k to produce n decoded data slices of the transformed data.

3. The method of claim 1, wherein the decoding the error coded data by the processing module further comprises:

receiving at least k of (n−

k) encoded data slices and k data slices as the error coded data;

error decoding at least k of the (n−

k) data slices and the k data slices to produce n decoded data slices, wherein k is a threshold number; and

de-slicing the n decoded data slices to produce the transformed data.

4. The method of claim 1, wherein the decoding the encoded encryption key by the processing module further comprises:

decoding a plurality of encoded key shares of the encoded encryption key using a secret sharing scheme to recover the encryption key.

5. The method of claim 1 further comprises, for execution by the processing module:

extracting a sentinel value from the data;

verifying accuracy of the sentinel value; and

when the sentinel value is accurate, indicating that the data is accurate.

6. A computing device comprises:

a processing module;

memory operably coupled to the processing module; and

an input/output (TO) port operably coupled to receive error coded data, wherein the processing module is operably coupled to;

decode the error coded data using an error coding scheme to produce transformed data;

partition the transformed data into an encoded encryption key for decoding encrypted data included in the transformed data and the encrypted data;

perform a hash function on the encrypted data to produce a digest resultant;

combine the digest resultant with the encoded encryption key to generate combined key data;

decode the combined key data to recover an encryption key; and

decrypt the encrypted data using the encryption key to recover data.

7. The computing device of claim 6 further comprises:

the IO port operably coupled to receive at least k number of error coded data slices; and

the processing module operably coupled to error decode the at least k number of error coded data slices using a forward error correction scheme having a failure tolerance of n−

k to produce n decoded data slices of the transformed data.

8. The computing device of claim 6 further comprises:

the IO port operably coupled to receive at least k of (n−

k) encoded data slices and the k data slices as the error coded data; and

the processing module operably coupled to;

error decode at least k of the (n−

k) data slices and the k data slices to produce n decoded data slices, wherein k is a threshold number; and

de-slice the n decoded data slices to produce the transformed data.

9. The computing device of claim 6, wherein the processing module further functions to decode the encoded encryption key by:

decoding a plurality of encoded key shares of the encoded encryption key using a secret sharing scheme to recover the encryption key.

10. The computing device of claim 6, wherein the processing module further functions to:

extract a sentinel value from the data;

verify accuracy of the sentinel value; and

when the sentinel value is accurate, indicate that the data is accurate.