OBFUSCATION OF SEQUENCED ENCODED DATA SLICES

• US 20110182429A1
• Filed: 11/28/2010
• Published: 07/28/2011
• Est. Priority Date: 01/28/2010
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Markison, Timothy W., Grube, Gary W.
• Granted Patent: US 8,649,521 B2
• Time in Patent Office: Days
• US Class Current: 380/268
• CPC Class Codes: G06F 11/1008 in individual solid state devices G06F11/1004 takes precedence
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2211/1028 Distributed, i.e. distributed RAID systems with parity
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/0647 Migration mechanisms
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 65/764 at the destination reformatting of additional data in video clients H04N21/4355
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04N 21/222 Secondary servers, e.g. proxy server, cable television Head-end provisioning of proxy services in data packet switching networks H04L67/56
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/8456 by decomposing the content in the time domain, e.g. in time segments
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic

Abstract

A method begins by a processing module receiving data to produce received data segments. The method continues with the processing module, in order of receiving the data segments, encrypting a data segment to produce an encrypted data segment, dispersed storage error encoding the encrypted data segment to produce a set of encoded data slices, buffering at least a number of encoded data slices of the set of encoded data slices to produce first buffered encoded data slices, and buffering remaining encoded data slices of the set of encoded data slices to produce second buffered encoded data slices. The method continues with the processing module outputting the first buffered encoded data slices and, at most, some of the second buffered encoded data slices in accordance with a pseudo random output sequencing order when a number of first buffered encoded data slices compares favorably to an outputting threshold.

Claims

1. A method comprises:

receiving data segments of a data stream to produce received data segments;

in order of receiving the data segments;

encrypting a data segment of the received data segments to produce an encrypted data segment;

dispersed storage error encoding the encrypted data segment to produce a set of encoded data slices;

buffering at least a number of encoded data slices of the set of encoded data slices in accordance with a threshold setting to produce first buffered encoded data slices; and

when the threshold setting is less than a pillar width value, buffering remaining encoded data slices of the set of encoded data slices in accordance with the threshold setting to produce second buffered encoded data slices; and

when a number of first buffered encoded data slices compares favorably to an outputting threshold, outputting the first buffered encoded data slices and, at most, some of the second buffered encoded data slices in accordance with a pseudo random output sequencing order.

2. The method of claim 1 further comprises:

dispersed storage error encoding auxiliary data to produce a set of encoded auxiliary data slices;

buffering the set of encoded auxiliary data slices to produce buffered encoded auxiliary data slices; and

when the number of first buffered encoded data slices compares favorably to the outputting threshold, outputting the first buffered encoded data slices, the buffered encoded auxiliary data slices, and, at most, some of the second buffered encoded data slices in accordance with the pseudo random output sequencing order.

3. The method of claim 2 further comprises:

scrambling data utilizing a low processing utilization scrambling algorithm to produce the auxiliary data;

encrypting the data utilizing an all or nothing transformation (AONT) to produce the auxiliary data;

encrypting the data utilizing a stored encryption key to produce the auxiliary data;

encrypting the data utilizing a random encryption key to produce the auxiliary data;

encrypting the data utilizing an encryption key associated with at least one recipient to produce the auxiliary data;

encrypting the data utilizing the AONT to produce AONT encrypted auxiliary data and encrypting the AONT encrypted auxiliary data utilizing the stored encryption key to produce the auxiliary data;

obfuscating the data utilizing an obfuscating method to produce the auxiliary data;

selecting an encryption method based on a data type and encrypting the data utilizing the encryption method to produce the auxiliary data;

encrypting the data utilizing a null encryption method to produce the auxiliary data; and

replicating at least one data segment of the data stream to produce the auxiliary data.

4. The method of claim 3, wherein the data comprises at least one of:

null data;

authentication information;

a next pseudo random output sequencing order;

a pseudo random output sequencing order identifier;

a next outputting threshold;

a random number generator output;

an encryption key;

a starting point for the pseudo random output sequencing order;

a device identifier;

a data identifier;

a data type;

a data size indictor;

a priority indicator;

a security indicator; and

a performance indicator.

5. The method of claim 1, wherein the outputting the first buffered encoded data slices and, at most, some of the second buffered encoded data slices comprises at least one of:

converting the first buffered encoded data slices and, at most, some of the second buffered encoded data slices into a symbol stream in accordance with a wireless communication protocol, converting the symbol stream into an outbound radio frequency (RF) signal in accordance with the wireless communication protocol, and transmitting the outbound RF signal; and

sending the first buffered encoded data slices and, at most, some of the second buffered encoded data slices to a dispersed storage network (DSN) memory for storage therein.

6. The method of claim 1 further comprises:

on a data segment by data segment basis, determining the threshold setting based on at least one of;

a lookup;

an available channel bandwidth indicator;

a channel power indicator;

a security indicator;

a performance indicator;

a random number;

a real time clock value; and

an environmental condition indicator.

7. The method of claim 1 further comprises:

buffering at least a number of encoded data slices of the set of encoded data slices in accordance with a first value of the threshold setting to produce first buffered encoded data slices; and

discarding a second number of encoded data slices of the set of encoded data slices in accordance with a second value of the threshold setting, wherein the second value is greater than the pillar width value less a decode threshold value.

8. A computer comprises:

an interface;

a memory; and

a processing module operable to;

receive, via the interface, data segments of a data stream to produce received data segments;

in order of receiving the data segments;

encrypt a data segment of the received data segments to produce an encrypted data segment;

dispersed storage error encode the encrypted data segment to produce a set of encoded data slices;

buffer, in the memory, at least a number of encoded data slices of the set of encoded data slices in accordance with a threshold setting to produce first buffered encoded data slices; and

buffer, in the memory, remaining encoded data slices of the set of encoded data slices in accordance with the threshold setting to produce second buffered encoded data slices when the threshold setting is less than a pillar width value; and

output, via the interface, the first buffered encoded data slices, from the memory, and, at most, some of the second buffered encoded data slices, from the memory, in accordance with a pseudo random output sequencing order when a number of first buffered encoded data slices compares favorably to an outputting threshold.

9. The computer of claim 8, wherein the processing module further functions to:

dispersed storage error encode auxiliary data to produce a set of encoded auxiliary data slices;

buffer, in the memory, the set of encoded auxiliary data slices to produce buffered encoded auxiliary data slices; and

output, via the interface, the first buffered encoded data slices, from the memory, the buffered encoded auxiliary data slices, from the memory, and, at most, some of the second buffered encoded data slices, from the memory, in accordance with the pseudo random output sequencing order when the number of first buffered encoded data slices compares favorably to the outputting threshold.

10. The computer of claim 9, wherein the processing module further functions to:

scramble data utilizing a low processing utilization scrambling algorithm to produce the auxiliary data;

encrypt the data utilizing an all or nothing transformation (AONT) to produce the auxiliary data;

encrypt the data utilizing a stored encryption key to produce the auxiliary data;

encrypt the data utilizing a random encryption key to produce the auxiliary data;

encrypt the data utilizing an encryption key associated with at least one recipient to produce the auxiliary data;

encrypt the data utilizing the AONT to produce AONT encrypted auxiliary data and encrypt the AONT encrypted auxiliary data utilizing the stored encryption key to produce the auxiliary data;

obfuscate the data utilizing an obfuscating method to produce the auxiliary data;

select an encryption method based on a data type and encrypt the data utilizing the encryption method to produce the auxiliary data;

encrypt the data utilizing a null encryption method to produce the auxiliary data; and

replicate at least one data segment of the data stream to produce the auxiliary data.

11. The computer of claim 9, wherein the data comprises at least one of:

null data;

authentication information;

a next pseudo random output sequencing order;

a pseudo random output sequencing order identifier;

a next outputting threshold;

a random number generator output;

an encryption key;

a starting point for the pseudo random output sequencing order;

a device identifier;

a data identifier;

a data type;

a data size indictor;

a priority indicator;

a security indicator; and

a performance indicator.

12. The computer of claim 8, wherein the processing module further functions to output the first buffered encoded data slices and, at most, some of the second buffered encoded data slices by at least one of:

converting the first buffered encoded data slices, from the memory, and, at most, some of the second buffered encoded data slices, from the memory, into a symbol stream in accordance with a wireless communication protocol, converting the symbol stream into an outbound radio frequency (RF) signal in accordance with the wireless communication protocol, and transmitting the outbound RF signal; and

sending, via the interface, the first buffered encoded data slices, from the memory, and, at most, some of the second buffered encoded data slices, from the memory, to a dispersed storage network (DSN) memory for storage therein.

13. The computer of claim 8, wherein the processing module for the functions to:

on a data segment by data segment basis, determine the threshold setting based on at least one of;

a lookup;

an available channel bandwidth indicator;

a channel power indicator;

a security indicator;

a performance indicator;

a random number;

a real time clock value; and

an environmental condition indicator.

14. The computer of claim 8, wherein the processing module further functions to:

buffer, in the memory at least a number of encoded data slices of the set of encoded data slices in accordance with a first value of the threshold setting to produce first buffered encoded data slices; and

discard a second number of encoded data slices of the set of encoded data slices in accordance with a second value of the threshold setting, wherein the second value is greater than the pillar width value less a decode threshold value.