SEQUENCING ENCODED DATA SLICES

• US 20110182424A1
• Filed: 11/28/2010
• Published: 07/28/2011
• Est. Priority Date: 01/28/2010
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Markison, Timothy W., Grube, Gary W.
• Granted Patent: US 8,885,821 B2
• Time in Patent Office: Days
• US Class Current: 380/43
• CPC Class Codes: G06F 11/1008 in individual solid state devices G06F11/1004 takes precedence
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2211/1028 Distributed, i.e. distributed RAID systems with parity
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/0647 Migration mechanisms
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 65/764 at the destination reformatting of additional data in video clients H04N21/4355
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04N 21/222 Secondary servers, e.g. proxy server, cable television Head-end provisioning of proxy services in data packet switching networks H04L67/56
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/8456 by decomposing the content in the time domain, e.g. in time segments
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic

Abstract

A method begins by a processing module receiving data segments of a data stream to produce received data segments. The method continues with the processing module encrypting a data segment of the received data segments to produce an encrypted data segment and dispersed storage error encoding the encrypted data segment to produce a set of encoded data slices in order of receiving the data segments. The method continues with the processing module buffering encoded data slices of sets of the encoded data slices unit to produce buffered encoded data slices and comparing a number of buffered encoded data slices to a threshold. The method continues with the processing module outputting the encoded data slices of the buffered encoded data slices based on a pseudo-random sequencing order when the number of buffered encoded data slices compares favorably to the threshold.

Claims

1. A method comprises:

receiving data segments of a data stream to produce received data segments;

in order of receiving the data segments;

encrypting a data segment of the received data segments to produce an encrypted data segment; and

dispersed storage error encoding the encrypted data segment to produce a set of encoded data slices;

buffering encoded data slices of sets of encoded data slices to produce buffered encoded data slices;

comparing a number of buffered encoded data slices to a threshold; and

when the number of buffered encoded data slices compares favorably to the threshold, outputting the encoded data slices of the buffered encoded data slices based on a pseudo-random sequencing order.

2. The method of claim 1, wherein the receiving data segments of the data stream comprises:

receiving the data stream;

determining segment sequencing information; and

sequencing the data segments in accordance with the segment sequencing information to produce the received data segments.

3. The method of claim 1, wherein the outputting the encoded data slices comprises:

converting at least one of the encoded data slices into a symbol stream in accordance with a wireless communication protocol;

converting the symbol stream into an outbound radio frequency (RF) signal in accordance with the wireless communication protocol; and

transmitting the outbound RF signal.

4. The method of claim 1 further comprises:

appending the pseudo-random sequencing order to at least one of the buffered encoded data slices;

or

dispersed storage error encoding the pseudo-random sequencing order to produce a set of encoded sequencing order slices; and

appending an encoded sequencing order slice of the set of encoded sequencing order slices to at least one of the buffered encoded data slices.

5. The method of claim 1, wherein the encrypting the data segment comprises at least one of:

encrypting the data segment utilizing an all or nothing transformation (AONT) to produce the encrypted data segment;

encrypting the data segment utilizing a stored encryption key to produce the encrypted data segment;

encrypting the data segment utilizing a random encryption key to produce the encrypted data segment;

encrypting the data segment utilizing an encryption key associated with at least one recipient to produce the encrypted data segment;

encrypting the data segment utilizing the AONT to produce an AONT encrypted data segment and encrypting the AONT encrypted data segment utilizing the stored encryption key to produce the encrypted data segment;

obfuscating the data segment utilizing an obfuscating method to produce the encrypted data segment;

selecting an encryption method based on a data type to produce a selected encryption method and encrypting the data segment utilizing the selected encryption method to produce the encrypted data segment; and

encrypting the data segment utilizing a null encryption method to produce the encrypted data segment.

6. The method of claim 1, wherein the pseudo-random sequencing order comprises at least one of:

a sequencing algorithm identifier (ID);

a segment sequencing algorithm ID;

a slice sequencing algorithm ID;

an algorithm seed;

a seed generation algorithm ID;

an encryption key;

a hash algorithm ID;

segment ordering information; and

slice ordering information.

7. The method of claim 1 further comprises:

determining the pseudo-random sequencing order based on at least one of;

a requester identifier (ID);

a vault lookup;

a data object name;

the data;

received sequencing information;

error coding dispersal storage function parameters;

executing a sequencing algorithm utilizing an algorithm seed;

a priority indicator;

a security indicator;

a performance indicator;

a list;

a command;

a predetermination; and

a message.

8. The method of claim 1 further comprises:

when the number of buffered encoded data slices compares favorably to the threshold, comparing, within a given time interval, an ingress number of encoded data slices being buffered to an egress number of encoded data slices being outputted;

when the comparing of the ingress number to the egress number is unfavorable with respect to an underflow threshold, adjusting at least one of the encrypting the data segment and the dispersed storage error encoding of the encrypted data segment such that the comparing of the ingress number to the egress number is favorable with respect to the underflow threshold; and

when the comparing of the ingress number to the egress number is unfavorable with respect to an overflow threshold, adjusting at least one of the encrypting the data segment and the dispersed storage error encoding of the encrypted data segment such that the comparing of the ingress number to the egress number is favorable with respect to the overflow threshold.

9. The method of claim 1 further comprises:

in the order of receiving the data segments;

generating a slice name for each of the encoded data slices of the set of encoded data slices to produce a set of slice names;

buffering the set of slice names to produce buffered slice names; and

when a number of buffered encoded data slices compares favorably to the threshold, outputting the slices names of the buffered slice names and the encoded data slices of the buffered encoded data slices based on the pseudo-random sequencing order.

10. The method of claim 9, wherein the generating the slice name comprises:

generating slice information for one of the set of encoded data slices; and

encrypting the slice information to produce the slice name.

11. A computer comprises:

an interface; and

a processing module operable to;

receive, via the interface, data segments of a data stream to produce received data segments;

in order of receiving the data segments;

encrypt a data segment of the received data segments to produce an encrypted data segment; and

dispersed storage error encode the encrypted data segment to produce a set of encoded data slices;

buffer encoded data slices of sets of encoded data slices to produce buffered encoded data slices;

compare a number of buffered encoded data slices to a threshold; and

output, via the interface, the encoded data slices of the buffered encoded data slices based on a pseudo-random sequencing order when the number of buffered encoded data slices compares favorably to the threshold.

12. The computer of claim 11, wherein the processing module further functions to receive the data segments of the data stream by:

receiving, via the interface, the data stream;

determining segment sequencing information; and

sequencing the data segments in accordance with the segment sequencing information to produce the received data segments.

13. The computer of claim 11, wherein the processing module further functions to output the encoded data slices by:

converting at least one of the encoded data slices into a symbol stream in accordance with a wireless communication protocol;

converting the symbol stream into an outbound radio frequency (RF) signal in accordance with the wireless communication protocol; and

transmitting the outbound RF signal.

14. The computer of claim 11, wherein the processing module further functions to:

append the pseudo-random sequencing order to at least one of the buffered encoded data slices;

or

dispersed storage error encode the pseudo-random sequencing order to produce a set of encoded sequencing order slices; and

append an encoded sequencing order slice of the set of encoded sequencing order slices to at least one of the buffered encoded data slices.

15. The computer of claim 11, wherein the processing module further functions to encrypt the data segment by at least one of:

encrypting the data segment utilizing an all or nothing transformation (AONT) to produce the encrypted data segment;

encrypting the data segment utilizing a stored encryption key to produce the encrypted data segment;

encrypting the data segment utilizing a random encryption key to produce the encrypted data segment;

encrypting the data segment utilizing an encryption key associated with at least one recipient to produce the encrypted data segment;

encrypting the data segment utilizing the AONT to produce an AONT encrypted data segment and encrypting the AONT encrypted data segment utilizing the stored encryption key to produce the encrypted data segment;

obfuscating the data segment utilizing an obfuscating method to produce the encrypted data segment;

selecting an encryption method based on a data type to produce a selected encryption method and encrypting the data segment utilizing the selected encryption method to produce the encrypted data segment; and

encrypting the data segment utilizing a null encryption method to produce the encrypted data segment.

16. The computer of claim 11, wherein the pseudo-random sequencing order comprises at least one of:

a sequencing algorithm identifier (ID);

a segment sequencing algorithm ID;

a slice sequencing algorithm ID;

an algorithm seed;

a seed generation algorithm ID;

an encryption key;

a hash algorithm ID;

segment ordering information; and

slice ordering information.

17. The computer of claim 11, wherein the processing module further functions to:

determine the pseudo-random sequencing order based on at least one of;

a requester identifier (ID);

a vault lookup;

a data object name;

the data;

received sequencing information;

error coding dispersal storage function parameters;

executing a sequencing algorithm utilizing an algorithm seed;

a priority indicator;

a security indicator;

a performance indicator;

a list;

a command;

a predetermination; and

a message.

18. The computer of claim 11, wherein the processing module further functions to:

compare, within a given time interval, an ingress number of encoded data slices being buffered to an egress number of encoded data slices being outputted when the number of buffered encoded data slices compares favorably to the threshold;

adjust at least one of the encrypting the data segment and the dispersed storage error encoding of the encrypted data segment such that the comparing of the ingress number to the egress number is favorable with respect to the underflow threshold when the comparing of the ingress number to the egress number is unfavorable with respect to an underflow threshold; and

adjust at least one of the encrypting the data segment and the dispersed storage error encoding of the encrypted data segment such that the comparing of the ingress number to the egress number is favorable with respect to the overflow threshold when the comparing of the ingress number to the egress number is unfavorable with respect to an overflow threshold.

19. The computer of claim 11, wherein the processing module further functions to:

in the order of receiving the data segments;

generate a slice name for each of the encoded data slices of the set of encoded data slices to produce a set of slice names;

buffer the set of slice names to produce buffered slice names; and

output, via the interface, the slices names of the buffered slice names and the encoded data slices of the buffered encoded data slices based on the pseudo-random sequencing order when a number of buffered encoded data slices compares favorably to the threshold.

20. The computer of claim 19, wherein the processing module further functions to generate the slice name by:

generating slice information for one of the set of encoded data slices; and

encrypting the slice information to produce the slice name.