ENCRYPTING DISTRIBUTED COMPUTING DATA

• US 20130275776A1
• Filed: 06/13/2013
• Published: 10/17/2013
• Est. Priority Date: 12/12/2011
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Baptist, Andrew, Dhuse, Greg, Leggette, Wesley, Resch, Jason K.
• Granted Patent: US 9,009,567 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 2211/1028 Distributed, i.e. distributed RAID systems with parity
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates

Abstract

A method begins by a dispersed storage (DS) processing module encoding data to produce slices and redundancy slices and selecting primary and redundancy storage and execution units. The method continues with the DS processing module assigning partial tasks to the primary storage and execution units and generating a unique key set for each of the primary storage and execution units. The method continues with the DS processing module encrypting each of the slices with a corresponding one of the unique key sets to produce encrypted slices and sending the encrypted slices and an indication of the assigned partial tasks to the primary storage and execution units for storage and execution of the assigned partial tasks on the encrypted slices. The method continues with the DS processing module sending the redundancy slices to the set of redundancy storage and execution units for storage therein.

Claims

1. A method for execution by one or more processing modules of one or more computing devices, the method comprises:

encoding data using a dispersed storage error encoding function to produce a plurality of sets of encoded data slices, wherein a set of the plurality of sets of encoded data slices includes encoded data slices and redundancy encoded data slices, wherein the encoded data slices of the plurality of sets of encoded data slices are arranged into chunksets of slices and wherein the redundancy encoded data slices of the plurality of sets of encoded data slices are arranged into chunksets of redundancy slices;

selecting a set of primary storage and execution units for the chunksets of slices and a set of redundancy storage and execution units for the chunksets of redundancy slices;

assigning partial tasks of one or more distributed computing tasks to the set of primary storage and execution units;

generating a unique key set for each of the primary storage and execution units based on at least one of;

the assigned partial task for the corresponding primary storage and execution unit, information regarding the corresponding primary storage and execution unit, information regarding key generation, and a pseudo random function;

encrypting each of the chunksets of slices with a corresponding one of the unique key sets to produce chunksets of encrypted slices;

sending the chunksets of encrypted slices and an indication of the assigned partial tasks to the set of primary storage and execution units for storage of the chunksets of encrypted slices and execution of the assigned partial tasks on the chunksets of encrypted slices; and

sending the chunksets of redundancy slices to the set of redundancy storage and execution units for storage therein.

2. The method of claim 1, wherein the indication of the assigned partial task for one of the set of primary storage and execution units comprises at least one of:

an indication that the assigned partial task was used to generate the corresponding unique key set; and

an indication as to how the assigned partial task was used to generate the corresponding unique key set.

3. The method of claim 1, wherein the sending the indication of the assigned partial task for one of the set of primary storage and execution units comprises:

sending a corresponding assigned partial task to the one of the set of primary storage and execution units.

4. The method of claim 1, wherein the generating the unique key set for one of the primary storage and execution units comprises:

generating a unique key that is used to encrypt the slices of the corresponding chunkset of encrypted slices.

5. The method of claim 1, wherein the generating the unique key set for one of the primary storage and execution units comprises:

generating multiple unique keys, wherein one of the multiple unique keys is used to encrypt one or more slices of the corresponding chunkset of encrypted slices.

6. The method of claim 1, wherein the generating the unique key set for one of the primary storage and execution units comprises:

identifying the assigned partial task for the one of the primary storage and execution units;

performing a deterministic mathematical function on bits of the assigned partial task to create a value; and

manipulating the value into the unique key set.

7. The method of claim 1, wherein the generating the unique key set for one of the primary storage and execution units comprises:

ascertaining a public key of a public/private key pair for the one of the primary storage and execution units; and

utilizing the public key to generate the unique key set.

8. A dispersed storage (DS) module comprises:

a first module, when operable within a computing device, causes the computing device to;

encode data using a dispersed storage error encoding function to produce a plurality of sets of encoded data slices, wherein a set of the plurality of sets of encoded data slices includes encoded data slices and redundancy encoded data slices wherein the encoded data slices of the plurality of sets of encoded data slices are arranged into chunksets of slices and wherein the redundancy encoded data slices of the plurality of sets of encoded data slices are arranged into chunksets of redundancy slices;

select a set of primary storage and execution units for the chunksets of slices and a set of redundancy storage and execution units for the chunksets of redundancy slices; and

assign partial tasks of one or more distributed computing tasks to the set of primary storage and execution units;

a second module, when operable within the computing device, causes the computing device to;

generate a unique key set for each of the primary storage and execution units based on at least one of;

the assigned partial task for the corresponding primary storage and execution unit, information regarding the corresponding primary storage and execution unit, information regarding key generation, and a pseudo random function; and

encrypt each of the chunksets of slices with a corresponding one of the unique key sets to produce chunksets of encrypted slices; and

a third module, when operable within the computing device, causes the computing device to;

send the chunksets of encrypted slices and an indication of the assigned partial tasks to the set of primary storage and execution units for storage of the chunksets of encrypted slices and execution of the assigned partial tasks on the chunksets of encrypted slices; and

send the chunksets of redundancy slices to the set of redundancy storage and execution units for storage therein.

9. The DS module of claim 8, wherein the indication of the assigned partial task for one of the set of primary storage and execution units comprises at least one of:

an indication that the assigned partial task was used to generate the corresponding unique key set; and

an indication as to how the assigned partial task was used to generate the corresponding unique key set.

10. The DS module of claim 8, wherein the third module functions to send the indication of the assigned partial task for one of the set of primary storage and execution units by:

sending a corresponding assigned partial task to the one of the set of primary storage and execution units.

11. The DS module of claim 8, wherein the second module functions to generate the unique key set for one of the primary storage and execution units by:

generating a unique key that is used to encrypt the slices of the corresponding chunkset of encrypted slices.

12. The DS module of claim 8, wherein the second module functions to generate the unique key set for one of the primary storage and execution units by:

generating multiple unique keys, wherein one of the multiple unique keys is used to encrypt one or more slices of the corresponding chunkset of encrypted slices.

13. The DS module of claim 8, wherein the second module functions to generate the unique key set for one of the primary storage and execution units by:

identifying the assigned partial task for the one of the primary storage and execution units;

performing a deterministic mathematical function on bits of the assigned partial task to create a value; and

manipulating the value into the unique key set.

14. The DS module of claim 8, wherein the second module functions to generate the unique key set for one of the primary storage and execution units by:

ascertaining a public key of a public/private key pair for the one of the primary storage and execution units; and

utilizing the public key to generate the unique key set.