DISPERSED DATA STORAGE SYSTEM DATA ENCRYPTION AND ENCODING

• US 20100266120A1
• Filed: 08/31/2009
• Published: 10/21/2010
• Est. Priority Date: 04/20/2009
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: LEGGETTE, WESLEY, RESCH, JASON K.
• Granted Patent: US 8,744,071 B2
• Time in Patent Office: Days
• US Class Current: 380/28
• CPC Class Codes: G06F 11/1012 using codes or arrangements adapted for a specific type of error G06F11/1048 takes precedence
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: H03M 13/15 Cyclic codes, i.e. cyclic shifts of codewords produce other codewords, e.g. codes defined by a generator polynomial, Bose-Chaudhuri-Hocquenghem [BCH] codes H03M13/17 takes precedence
• CPC Class Codes: H03M 13/1515 Reed-Solomon codes
• CPC Class Codes: H03M 13/23 using convolutional codes, e.g. unit memory codes
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A computing system securely stores data to a dispersed data storage system. The computing system includes a processing module and a plurality of storage units. The processing module includes an encryptor and error encoder to encrypt and encode the data for dispersal utilizing a write command to the storage units. The storage units store the encrypted and encoded data when receiving the write command and the encrypted and encoded data.

Claims

1. A method for execution by a processing module, the method comprises:

encrypting data using an encryption key to produce encrypted data;

encoding the encryption key to produce an encoded encryption key;

combining the encrypted data and the encoded encryption key to produce transformed data; and

error encoding the transformed data to produce error coded data.

2. The method of claim 1, wherein the encoding of the encryption key by the processing module further comprises:

performing a hash function on the encrypted data to produce a digest resultant; and

combining the encryption key and the digest resultant to produce the encoded encryption key.

3. The method of claim 1, wherein the encoding of the encryption key by the processing module further comprises:

encoding the encryption key using a secret sharing scheme to produce a plurality of encoded key shares, wherein the encoded encryption key includes the plurality of encoded key shares.

4. The method of claim 1, wherein the error encoding of the transformed data by the processing module further comprises:

error encoding the transformed data using a forward error correction scheme having a failure tolerance of n−

k, where k is number of input symbols and n is the number of output symbols, to produce the error coded data.

5. The method of claim 1, wherein the error encoding of the transformed data by the processing module further comprises:

slicing the transformed data into k data slices;

error encoding (n−

k) data slices of the k data slices to produce (n−

k) encoded data slices, wherein n is a number of slices of the error coded data; and

outputting at least some of the (n−

k) encoded data slices and the k data slices as the error coded data.

6. The method of claim 1 further comprises, for execution by the processing module:

appending, prior to encrypting the data, a sentinel value to a data block or a data segment of a data file to produce the data.

7. The method of claim 1 further comprises, for execution by the processing module:

generating a write command to write a plurality of slices of the error coded data to a plurality of storage nodes.

8. A method for execution by a processing module, the method comprises:

encrypting data using an encryption key to produce encrypted data;

generating transformed data based on the encrypted data, the encryption key, and a transformation scheme;

slicing the transformed data into a plurality of data slices; and

error coding at least some of the plurality of data slices to produce a plurality of error coded data slices.

9. The method of claim 8, wherein the error coding of the at least some of the plurality of data slices by the processing module further comprises:

slicing the transformed data into k data slices;

error encoding (n−

k) data slices of the k data slices to produce (n−

k) encoded data slices, wherein n is a number of slices of the output encoded slices; and

outputting at least some of the (n−

k) encoded data slices and the k data slices as the output encoded slices.

10. The method of claim 8, wherein the error encoding of the at least some of the plurality of data slices by the processing module further comprises:

error encoding the at least some of the plurality of data slices using a forward error correction scheme having a failure tolerance of n−

k, where k is number of input symbols and n is the number of output symbols, to produce the error coded data slices.

11. The method of claim 8, wherein the generating transformed data by the processing module further comprises:

performing an all-or-nothing transformation on at least one of the encrypted data and the encryption key to produce the transformed data.

12. The method of claim 8 further comprises, for execution by the processing module:

appending, prior to encrypting the data, a sentinel value to a data block or a data segment of a data file to produce the data.

13. The method of claim 8 further comprises, for execution by the processing module:

generating a write command to write the plurality of error coded data slices and remaining ones of the plurality of data slices to a plurality of storage nodes.

14. A computing device comprises:

a processing module;

memory operably coupled to the processing module; and

an input/output (IO) port, wherein the processing module is operably coupled to;

encrypt data using an encryption key to produce encrypted data;

encode the encryption key to produce an encoded encryption key;

combine the encrypted data and the encoded encryption key to produce transformed data; and

error encode the transformed data to produce error coded data, and the IO port is operably coupled to output the error coded data.

15. The computing device of claim 14, wherein the processing module further functions to encode the encryption key by:

performing a hash function on the encrypted data to produce a digest resultant; and

combining the encryption key and the digest resultant to produce the encoded encryption key.

16. The computing device of claim 14, wherein the processing module further functions to encode the encryption key by:

encoding the encryption key using a secret sharing scheme to produce a plurality of encoded key shares, wherein the encoded key includes the plurality of encoded key shares.

17. The computing device of claim 14 further comprises:

the processing module error encoding the transformed data by;

slicing the transformed data into k data slices; and

error encoding (n−

k) data slices of the k data slices to produce (n−

k) encoded data slices, wherein n is a number of slices of the encoded data; and

the IO port outputting at least some of the (n−

k) encoded data slices and the k data slices as the error coded data.

18. The computing device of claim 14, wherein the processing module further functions to

append, prior to encrypting the data, a sentinel value to a data block or a data segment of a data file to produce the data.

19. The computing device of claim 14, wherein the processing module further functions to:

generate a write command to write a plurality of slices of the error coded data to a plurality of storage nodes.

20. A computing device comprises:

a processing module;

memory operably coupled to the processing module; and

an input/output (IO) port, wherein the processing module is operably coupled to;

encrypt data using an encryption key to produce encrypted data;

generate transformed data based on the encrypted data, the encryption key, and a transformation scheme; and

slice the transformed data into a plurality of data slices; and

error code at least some of the plurality of data slices to produce a plurality of error coded data slices; and

the IO port outputs the plurality of error coded data slices.

21. The computing device of claim 20 further comprises:

the processing module further functioning to;

slice the transformed data into k data slices; and

error encode (n−

k) data slices of the k data slices to produce (n−

k) encoded data slices, wherein n is a number of slices of the output encoded slices; and

the IO port further functioning to output at least some of the (n−

k) encoded data slices and the k data slices as the output encoded slices.

22. The computing device of claim 20, wherein the processing module further functions to error encode the at least some of the plurality of data slices by:

error encoding the at least some of the plurality of data slices using a forward error correction scheme having a failure tolerance of n−

k, where k is number of input symbols and n is the number of output symbols, to produce the error coded data slices.

23. The computing device of claim 20, wherein the processing module further functions to generate transformed data by:

performing an all-or-nothing transformation on at least one of the encrypted data and the encryption key to produce the transformed data.

24. The computing device of claim 20, wherein the processing module further functions to:

append, prior to encrypting the data, a sentinel value to a data block or a data segment of a data file to produce the data.

25. The computing device of claim 20, wherein the processing module further functions to:

generate a write command to write the plurality of error coded data slices and remaining ones of the plurality of data slices to a plurality of storage nodes.