DISPERSED STORAGE SECURE DATA DECODING

• US 20100266119A1
• Filed: 08/26/2009
• Published: 10/21/2010
• Est. Priority Date: 04/20/2009
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: LEGGETTE, WESLEY, RESCH, JASON K.
• Granted Patent: US 8,656,187 B2
• Time in Patent Office: Days
• US Class Current: 380/28
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes

Abstract

A method operating on a computer begins by generating a read command to read at least some of a plurality of data slices from a dispersed storage network. The method continues by receiving the at least some of the plurality of data slices. The method continues by performing a reverse information dispersal algorithm on at least some of the plurality of data slices to produce a plurality of transposed data elements. The method continues by reverse transposing the plurality of transposed data elements to recover data elements of a data segment.

Claims

1. A method operating on a computer, the method comprises:

generating a read command to read at least some of a plurality of data slices from a dispersed storage network;

receiving the at least some of the plurality of data slices;

performing a reverse information dispersal algorithm on at least some of the plurality of data slices to produce a plurality of transposed data elements; and

reverse transposing the plurality of transposed data elements to recover data elements of a data segment.

2. The method of claim 1 further comprises:

performing the reverse information dispersal algorithm on a row by row basis of a j rows by k columns matrix of the plurality of transposed data elements; and

re-arranging the plurality of transposed data elements of the j rows by k columns matrix to produce the data elements.

3. The method of claim 1 further comprises:

decrypting the data segment to produce decrypted data segments.

4. The method of claim 3 wherein the decrypting utilizes an encryption algorithm selected from the group of a 3-way algorithm, an AES algorithm, an Anubis algorithm, a Blowfish algorithm, a BMGL algorithm, a CAST algorithm, a CRYPTON algorithm, a CS-Cipher algorithm, a DEAL algorithm, a DES algorithm, a DESede algorithm, a DESX algorithm, a DFC algorithm, a DFCv2 algorithm, a Diamond2 algorithm, an E2 algorithm, a FROG algorithm, a GOST algorithm, a HPC-1 algorithm, a HPC-2 algorithm, an ICE algorithm, an IDEA algorithm, an ISAAC algorithm, a JEROBOAM algorithm, a LEVIATHAN algorithm, a LOKI91 algorithm, a LOKI97 algorithm, a MAGENTA algorithm, a MARS algorithm, a MDC algorithm, a MISTY1 algorithm, a MISTY2 algorithm, a Noekeon algorithm, a Noekeon Direct algorithm, a Panama algorithm, a Rainbow algorithm, a RC2 algorithm, a RC4 algorithm, a RC4-drop algorithm, a RC5 algorithm, a Rijndael algorithm, a SAFER-K algorithm, a SAFER-SK algorithm, a SAFER+ algorithm, a SAFER++ algorithm, a SAFER++-64 algorithm, a Sapphire-II algorithm, a Scream algorithm, a Scream-F algorithm, a SEAL-3.0 algorithm, a Serpent algorithm, a SHARK algorithm, a SKIPJACK algorithm, a SNOW algorithm, a SOBER algorithm, a SPEED algorithm, a Square algorithm, a TEA algorithm, a Twofish algorithm, a WAKE-CFB algorithm, a WiderWake4+1 algorithm, a WiderWake4+3 algorithm, a PBE-PKCS5 algorithm, and a PBE-PKCS12 algorithm.

5. A method operating on a computer and comprising the steps of:

generating a read command to read at least some of a plurality of data slices from a dispersed storage network;

de-slicing the at least some of the plurality of data slices using a reverse information dispersal algorithm to produce an all-or-nothing encrypted data segment; and

applying a reverse all-or-nothing transformation on the all-or-nothing encrypted data segment to recover a data segment.

6. The method of claim 5 wherein the applying the reverse all-or-nothing transformation comprises the steps of:

de-packaging an obfuscated encryption key and an encrypted data segment from an all-or-nothing encrypted data segment;

calculating a digest corresponding to said encrypted data segment;

de-obfuscating the obfuscated encryption key by exclusive-ORing the obfuscated encryption key and the digest to produce an encryption key; and

decrypting the encrypted data segment based on the encryption key to produce the data segment.

7. The method of claim 5 further comprises decrypting the all-or-nothing encrypted data segment using a first block cipher prior to the applying the reverse all-or-nothing transformation.

8. A computer comprising:

a network port adapted to couple with a network and receive at least some of a plurality of data slices; and

a processor coupled to said network port wherein said processor;

receives the at least some of the plurality of data slices from the network port;

performs a reverse information dispersal algorithm on at least some of the plurality of data slices to produce a plurality of transposed data elements; and

reverse transposes the plurality of transposed data elements to recover data elements of a data segment.

9. The computer of claim 8, wherein the processor further functions to:

perform the reverse information dispersal algorithm on a row by row basis of a j rows by k columns matrix of the plurality of transposed data elements; and

re-arrange the plurality of transposed data elements of the j rows by k columns matrix to produce the data elements.

10. The computer of claim 8, wherein the processor further functions to decrypt the data segment to produce a decrypted data segment.

11. A computer comprising:

a network port adapted to couple with a network and receive at least some of a plurality of data slices; and

a processor coupled to said network port wherein said processor;

receives the at least some of a plurality of data slices from the network port;

de-slices the at least some of the plurality of data slices using a reverse information dispersal algorithm to produce an all-or-nothing encrypted data segment; and

applies a reverse all-or-nothing transformation on the all-or-nothing encrypted data segment to recover a data segment.

12. The computer of claim 11, wherein the processor further functions to apply the reverse all-or-nothing transformation by:

de-packages an obfuscated encryption key and an encrypted data segment from the all-or-nothing encrypted data segment;

calculates a digest corresponding to said encrypted data segment;

de-obfuscates the obfuscated encryption key by exclusive-ORing the obfuscated encryption key and the digest to produce an encryption key; and

decrypts the encrypted data segment based on the encryption key to produce the data segment.