DATA ENCRYPTION PARAMETER DISPERSAL

• US 20110161655A1
• Filed: 09/17/2010
• Published: 06/30/2011
• Est. Priority Date: 12/29/2009
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Abhijeet, Kumar, Dhuse, Greg, Resch, Jason K., Gladwin, S. Christopher
• Granted Patent: US 8,468,368 B2
• Time in Patent Office: Days
• US Class Current: 713/150
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method begins with a processing module obtaining encoded key slices from a plurality of user devices and decoding a threshold number of the encoded key slices utilizing a first error coding dispersal storage function to produce a key when the threshold number of the encoded key slices has been obtained. The method continues with the processing module receiving encoded data slices and decoding a threshold number of encoded data slices utilizing a second error coding dispersal storage function to produce encrypted data when the threshold number of the encoded data slices has been received. The method continues with the processing module decrypting the encrypted data utilizing the key and an encryption function to produce data.

Claims

1. A method comprises:

obtaining encoded key slices from a plurality of user devices;

when a threshold number of the encoded key slices have been obtained, decoding the threshold number of the encoded key slices utilizing a first error coding dispersal storage function to produce a key;

receiving encoded data slices;

when a threshold number of the encoded data slices have been received, decoding the threshold number of encoded data slices utilizing a second error coding dispersal storage function to produce encrypted data; and

decrypting the encrypted data utilizing the key and an encryption function to produce data.

2. The method of claim 1, wherein the obtaining the encoded key slices further comprises at least one of:

retrieving an encoded key slice of the encoded key slices from a local memory of a user device of the plurality of user devices and retrieving other encoded key slices of the encoded key slices from other user devices of the plurality of user devices; and

receiving the encoded key slices from the other user devices of the plurality of user devices.

3. The method of claim 1, wherein the receiving the encoded data slices further comprises at least one of:

receiving the encoded data slices from a dispersed storage network (DSN) memory in response to a request; and

receiving the encoded data slices from the plurality of user devices in response to a user device request.

4. The method of claim 1 further comprises:

the first error coding dispersal storage function is substantially equal to the second error coding dispersal storage function.

5. The method of claim 1 further comprises:

obtaining encoded encryption function slices; and

when a threshold number of encoded encryption function slices have been obtained, decoding the encoded encryption function slices in accordance with the first or second error coding dispersal storage function to produce the encryption function.

6. A method comprises:

obtaining a key;

encoding the key utilizing a first error coding dispersal storage function to produce a set of encoded key slices;

outputting the set of encoded key slices;

encrypting a portion of data utilizing the key in accordance with an encryption function to produce an encrypted portion of data;

encoding the encrypted portion of data utilizing a second error coding dispersal storage function to produce a set of encoded data slices; and

outputting the set of encoded data slices.

7. The method of claim 6, wherein the outputting of the encoded key slices further comprises at least one of:

storing at least one encoded key slice of the set of encoded key slices in a local memory of a user device and outputting at least one other encoded key slice of the set of encoded key slices to a second user device for storage therein; and

outputting the set of encoded key slices to a plurality of user devices for storage therein.

8. The method of claim 6, wherein the outputting the set of encoded data slices further comprises at least one of:

outputting the set of encoded data slices to a dispersed storage network (DSN) memory for storage therein; and

outputting the set of encoded data slices to a plurality of user devices for storage therein.

9. The method of claim 6 further comprises:

the first error coding dispersal storage function is substantially equal to the second error coding dispersal storage function.

10. The method of claim 6 further comprises:

encoding the encryption function using the first or second error coding dispersal storage function to produce a set of encoded encryption function slices; and

outputting the set of encoded encryption function slices to a plurality of user devices for storage therein.

11. A computer comprises:

an interface;

a local memory; and

a processing module operable to;

obtain encoded key slices from a plurality of user devices;

decode a threshold number of the encoded key slices utilizing a first error coding dispersal storage function to produce a key when the threshold number of the encoded key slices have been obtained;

receive, via the interface, encoded data slices;

decode the threshold number of the encoded data slices utilizing a second error coding dispersal storage function to produce encrypted data when the threshold number of the encoded data slices have been received; and

decrypt the encrypted data utilizing the key and an encryption function to produce data.

12. The computer of claim 11, wherein the processing module further functions to obtain the encoded key slices by at least one of:

retrieving an encoded key slice of the encoded key slices from the local memory of a user device of the plurality of user devices and retrieving, via the interface, other encoded key slices of the encoded key slices from other user devices of the plurality of user devices; and

receiving, via the interface, the encoded key slices from the other user devices of the plurality of user devices.

13. The computer of claim 11, wherein the processing module further functions to receive the encoded data slices by at least one of:

receiving, via the interface, the encoded data slices from a dispersed storage network (DSN) memory in response to a request; and

receiving, via the interface, the encoded data slices from the plurality of user devices in response to a user device request.

14. The computer of claim 11 further comprises:

the first error coding dispersal storage function is substantially equal to the second error coding dispersal storage function.

15. The computer of claim 11, wherein the processing module further functions to:

obtain encoded encryption function slices; and

decode the encoded encryption function slices in accordance with the first or second error coding dispersal storage function to produce the encryption function when a threshold number of encoded encryption function slices have been obtained.

16. A computer comprises:

an interface;

a local memory; and

a processing module operable to;

obtain a key;

encode the key utilizing a first error coding dispersal storage function to produce a set of encoded key slices;

output, via the interface, the set of encoded key slices;

encrypt a portion of data utilizing the key in accordance with an encryption function to produce an encrypted portion of data;

encode the encrypted portion of data utilizing a second error coding dispersal storage function to produce a set of encoded data slices; and

output, via the interface, the set of encoded data slices.

17. The computer of claim 16, wherein the processing module further functions to output the encoded key slices by at least one of:

storing at least one encoded key slice of the set of encoded key slices in the local memory of a user device and outputting, via the interface, at least one other encoded key slice of the set of encoded key slices to a second user device for storage therein; and

outputting, via the interface, the set of encoded key slices to a plurality of user devices for storage therein.

18. The computer of claim 16, wherein the processing module further functions to output the set of encoded data slices by at least one of:

outputting, via the interface, the set of encoded data slices to a dispersed storage network (DSN) memory for storage therein; and

outputting, via the interface, the set of encoded data slices to a plurality of user devices for storage therein.

19. The computer of claim 16 further comprises:

the first error coding dispersal storage function is substantially equal to the second error coding dispersal storage function.

20. The computer of claim 16, wherein the processing module further functions to:

encode the encryption function using the first or second error coding dispersal storage function to produce a set of encoded encryption function slices; and

output, via the interface, the set of encoded encryption function slices to a plurality of user devices for storage therein.