System And Method For Secure Storage Of Data

• US 20090103723A1
• Filed: 10/19/2007
• Published: 04/23/2009
• Est. Priority Date: 10/19/2007
• Status: Abandoned Application

• Current Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Madison, Carl T., Martin, Charles R.
• Application Number:
  US11/875,715
• Publication Number:
  US 20090103723A1
• Time in Patent Office: Days
• US Class Current: 380/44
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method of securely storing a data item including obtaining the data item; translating the data item into a first plurality of data blocks using an erasure code associated with a rate; and storing at least a subset of the first plurality of data blocks, where a size of the subset exceeds a product of the rate and a size of the first plurality of data blocks.

Claims

1. A method of securely storing a data item comprising:

obtaining the data item;

translating the data item into a first plurality of data blocks using an erasure code associated with a rate; and

storing at least a subset of the first plurality of data blocks, wherein a size of the subset exceeds a product of the rate and a size of the first plurality of data blocks.

2. The method of claim 1, wherein translating the data item comprises partitioning the data item based on the erasure code prior to applying the erasure code.

3. The method of claim 1, wherein each data block in the subset is stored on a separate storage device.

4. The method of claim 1, wherein the erasure code is at least one selected from a group consisting of a suboptimal erasure code and an optimal erasure code.

5. The method of claim 1, further comprising:

combining the data item with metadata prior to encoding the first plurality of data blocks, wherein the data item is an encryption key.

6. The method of claim 1, further comprising:

retrieving a second plurality of data blocks from the subset after storing at least the subset, wherein a size of the second plurality of data blocks equals the product; and

recovering the data item from the second plurality of data blocks using the erasure code.

7. The method of claim 1, further comprising:

retrieving a second plurality of data blocks from the subset after storing at least the subset wherein a size of the second plurality of data blocks exceeds the product; and

recovering the data item from the second plurality of data blocks using the erasure code.

8. The method of claim 6, further comprising:

using an encryption key to perform at least one selected from a group consisting of encrypting the data item prior to translating the data item and decrypting the data item after recovering the data item.

9. A computer readable medium storing instructions to securely store a data item, the instructions comprising functionality to:

obtain the data item;

translate the data item into a first plurality of data blocks using an erasure code associated with a rate; and

store at least a subset of the first plurality of data blocks, wherein a size of the subset exceeds a product of the rate and a size of the first plurality of data blocks.

10. The computer readable medium of claim 9, wherein the instructions for translating the data item further comprise functionality to partition the data item based on the erasure code prior to applying the erasure code.

11. The computer readable medium of claim 9, the instructions further comprising functionality to:

combine the data item with metadata prior to encoding the first plurality of data blocks, wherein the data item is an encryption key.

12. The computer readable medium of claim 9, wherein each data block in the subset is stored on a separate storage device.

13. The computer readable medium of claim 9, wherein the subset of the plurality of data blocks is retrieved from at least one of the plurality of storage devices.

14. The computer readable medium of claim 9, further comprising:

retrieving a second plurality of data blocks from the subset after storing at least the subset, wherein a size of the second plurality of data blocks equals the product; and

recovering the data item from the second plurality of data blocks using the erasure code.

15. The computer readable medium of claim 9, further comprising:

retrieving a second plurality of data blocks from the subset after storing at least the subset, wherein a size of the second plurality of data blocks exceeds the product; and

recovering the data item from the second plurality of data blocks using the erasure code.

16. A system for securely storing a data item comprising:

a translation module configured to translate the data item into a first plurality of data blocks using an erasure code associated with a rate; and

a plurality of storage devices operatively connected to the translation module and configured to store at least a subset of the first plurality of data blocks, wherein a size of the subset exceeds a product of the rate and a size of the first plurality of data blocks.

17. The system of claim 16, further comprising:

a recovery module operatively connected to the plurality of storage devices and configured to retrieve a second plurality of data blocks from the plurality of storage devices to recover the data item.

18. The system of claim 17, wherein a size of the second plurality of data blocks equals the product.

19. The system of claim 16, further comprising:

a key generation module operatively connected to the translation module and configured to generate an encryption key to encrypt the data item prior to translating the data item.

20. The system of claim 16, wherein each of the plurality of storage devices stores at most one data block of the subset.