DISPERSED DATA STORAGE SYSTEM DATA DECODING AND DECRYPTION

• US 20100269008A1
• Filed: 08/31/2009
• Published: 10/21/2010
• Est. Priority Date: 04/20/2009
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: LEGGETTE, WESLEY, RESCH, JASON K.
• Granted Patent: US 10,447,474 B2
• Time in Patent Office: Days
• US Class Current: 714/752
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2109 Game systems
• CPC Class Codes: H03M 13/15 Cyclic codes, i.e. cyclic shifts of codewords produce other codewords, e.g. codes defined by a generator polynomial, Bose-Chaudhuri-Hocquenghem [BCH] codes H03M13/17 takes precedence
• CPC Class Codes: H03M 13/1515 Reed-Solomon codes
• CPC Class Codes: H03M 13/23 using convolutional codes, e.g. unit memory codes
• CPC Class Codes: H04L 1/0057 Block codes H04L1/0061, H04L1/0064 take precedence
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 2463/062 applying encryption of the keys
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A computing system retrieves securely stored encrypted and encoded data from a dispersed data storage system. The computing system includes a processing module and a plurality of storage units. The processing module includes an error decoder and a decryptor and to decode and decrypt the encrypted and encoded data retrieved from the dispersed data storage system utilizing a read command to the storage units. The storage units retrieve the encrypted and encoded data and send the encrypted and encoded data to the processing module when receiving the read command.

Claims

1. A method for execution by a processing module, the method comprises:

decoding error coded data using an error coding scheme to produce transformed data;

recovering encrypted data and an encoded encryption key from the transformed data;

decoding the encoded encryption key to recover an encryption key; and

decrypting the encrypted data using the encryption key to recover data.

2. The method of claim 1, wherein the decoding the error coded data by the processing module further comprises:

receiving at least k number of error coded data slices; and

error decoding the at least k number of error coded data slices using a forward error correction scheme having a failure tolerance of n-k to produce n decoded data slices of the transformed data.

3. The method of claim 1, wherein the decoding the error coded data by the processing module further comprises:

receiving at least k of (n-k) encoded data slices and k data slices as the error coded data;

error decoding at least k of the (n-k) data slices and the k data slices to produce n decoded data slices, wherein k is a threshold number; and

de-slicing the n decoded data slices to produce the transformed data.

4. The method of claim 1, wherein the recovering of the encrypted data and the encoded encryption key by the processing module further comprises:

partitioning the transformed data into the encoded encryption key and the encrypted data.

5. The method of claim 4, wherein the decoding the encoded encryption key by the processing module further comprises:

performing a hash function on the encrypted data to produce a digest resultant; and

combining the digest resultant with the encoded encryption key to recover the encryption key.

6. The method of claim 4, wherein the decoding the encoded encryption key by the processing module further comprises:

decoding a plurality of encoded key shares of the encoded encryption key using a secret sharing scheme to recover the encryption key.

7. The method of claim 1 further comprises, for execution by the processing module:

extracting a sentinel value from the data;

verifying accuracy of the sentinel value; and

when the sentinel value is accurate, indicating that the data is accurate.

8. A method for execution by a processing module, the method comprises:

error decoding a plurality of error coded data slices to produce a plurality of data slices;

de-slicing the plurality of data slices to produce transformed data;

recovering encrypted data and an encryption key from the transformed data based on a transformation scheme; and

decrypting the encrypted data using the encryption key to recover data.

9. The method of claim 8, wherein the error decoding of the plurality of error coded data slices by the processing module further comprises:

receiving at least k of (n-k) encoded data slices and k data slices as the plurality of error encoded data slices; and

error decoding at least k of the (n-k) data slices and the k data slices to produce n decoded data slices as the plurality of data slices, wherein k is a threshold number.

10. The method of claim 8, wherein the error decoding of the plurality of error coded data slices by the processing module further comprises:

error decoding the plurality of error coded data slices using a forward error correction scheme having a failure tolerance of n-k to produce n decoded data slices as the plurality of data slices.

11. The method of claim 8, wherein the recovering encrypted data and an encryption key by the processing module further comprises:

performing an all-or-nothing transformation on the transformed data to recover the encrypted data and the encryption key.

12. The method of claim 8 further comprises, for execution by the processing module:

extracting a sentinel value from the data;

verifying accuracy of the sentinel value; and

when the sentinel value is accurate, indicating that the data is accurate.

13. A computing device comprises:

a processing module;

memory operably coupled to the processing module; and

an input/output (IO) port operably coupled to receive error coded data, wherein the processing module is operably coupled to;

decode the error coded data using an error coding scheme to produce transformed data;

recover encrypted data and an encoded encryption key from the transformed data;

decode the encoded encryption key to recover an encryption key; and

decrypt the encrypted data using the encryption key to recover data.

14. The computing device of claim 13 further comprises;

the IO port operably coupled to receive at least k number of error coded data slices; and

the processing module operably coupled to error decode the at least k number of error coded data slices using a forward error correction scheme having a failure tolerance of n-k to produce n decoded data slices of the transformed data.

15. The computing device of claim 13 further comprises:

the IO port operably coupled to receive at least k of (n-k) encoded data slices and the k data slices as the error coded data; and

the processing module operably coupled to;

error decode at least k of the (n-k) data slices and the k data slices to produce n decoded data slices, wherein k is a threshold number; and

de-slice the n decoded data slices to produce the transformed data.

16. The computing device of claim 13, wherein the processing module further functions to recover the encrypted data and the encoded encryption key by:

partitioning the transformed data into the encoded encryption key and the encrypted data.

17. The computing device of claim 16, wherein the processing module further functions to decode the encoded encryption key by:

performing a hash function on the encrypted data to produce a digest resultant; and

combining the digest resultant with the encoded encryption key to recover the encryption key.

18. The computing device of claim 13, wherein the processing module further functions to decode the encoded encryption key by:

decoding a plurality of encoded key shares of the encoded encryption key using a secret sharing scheme to recover the encryption key.

19. The computing device of claim 13, wherein the processing module further functions to:

extract a sentinel value from the data;

verify accuracy of the sentinel value; and

when the sentinel value is accurate, indicate that the data is accurate.

20. A computing device comprises:

a processing module;

memory operably coupled to the processing module; and

an input/output (IO) port operably coupled to receive a plurality of error coded data slices, wherein the processing module is operably coupled to;

error decode the plurality of error coded data slices to produce a plurality of data slices;

de-slice the plurality of data slices to produce transformed data;

recover encrypted data and an encryption key from the transformed data based on a transformation scheme; and

decrypt the encrypted data using the encryption key to recover data.

21. The computing device of claim 20, wherein the processing module further functions to error decode the plurality of error coded data slices by:

receiving at least k of (n-k) encoded data slices and k data slices as the plurality of error encoded data slices; and

error decoding at least k of the (n-k) data slices and the k data slices to produce n decoded data slices as the plurality of data slices, wherein k is a threshold number.

22. The computing device of claim 20, wherein the processing module further functions to error decode the plurality of error coded data slices by:

error decoding the plurality of error coded data slices using a forward error correction scheme having a failure tolerance of n-k to produce n decoded data slices as the plurality of data slices.

23. The computing device of claim 20, wherein the processing module further functions to recover encrypted data and an encryption key by the processing module further comprises:

performing an all-or-nothing transformation on the transformed data to recover the encrypted data and the encryption key.

24. The computing device of claim 20, wherein the processing module further functions to:

extract a sentinel value from the data;

verify accuracy of the sentinel value; and

when the sentinel value is accurate, indicate that the data is accurate.