RETRIEVING ACCESS INFORMATION IN A DISPERSED STORAGE NETWORK

• US 20140115334A1
• Filed: 12/30/2013
• Published: 04/24/2014
• Est. Priority Date: 05/19/2010
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Resch, Jason K., Grube, Gary W., Gladwin, S. Christopher, Shirley, Thomas Franklin Jr., Markison, Timothy W.
• Granted Patent: US 9,094,402 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04L 2209/04 Masking or blinding
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method begins by a processing module obtaining a set of recovered random numbers, decoding encrypted share slices to produce a set of encrypted shares, and obtaining a set of personalized authenticating values regarding user access to data. The method continues with the processing module generating a set of hidden passwords based on the set of personalized authenticating values, generating a set of blinded passwords based on the set of hidden passwords and a set of blinded random numbers, and generating a set of passkeys based on the set of blinded passwords and the set of recovered random numbers. The method continues with the processing module generating a set of decryption keys based on the set of blinded random numbers and the set of passkeys, decrypting the set of encrypted shares to produce a set of shares, and decoding the set of shares to reproduce the data.

Claims

1. A method for execution by a computing device for highly secure access to a dispersed storage network (DSN), the method comprises:

for a access request to the DSN, retrieving access information by;

retrieving a plurality of sets of encoded share slices and a plurality of sets of encoded random number slices from memory of the DSN;

dispersed storage error decoding the plurality of sets of encoded share slices to produce a set of encrypted shares;

dispersed storage error decoding the plurality of sets of encoded random number slice to produce a plurality of random numbers;

obtaining one or more personalized authenticating values regarding user access to the DSN;

processing the one or more personalized authenticating values and the plurality of random numbers to produce a set of decryption keys;

decrypting the set of encrypted shares using the set of decryption keys to produce a set of shares; and

processing the set of shares to recover the access information; and

utilizing the recovered access information to process the access request to the DSN.

2. The method of claim 1 further comprises:

identifying, in accordance with security parameters, the plurality of sets of encoded share slices and the plurality of sets of encoded random number slices;

sending a first set of retrieval requests to the memory of the DSN regarding the plurality of sets of encoded share slices; and

sending a second set of retrieval requests to the memory of the DSN regarding the plurality of sets of encoded random number slices.

3. The method of claim 1, wherein the processing the one or more personalized authenticating values and the plurality of random numbers to produce the set of decryption keys comprises:

generating a set of hidden passwords based on the one or more personalized authenticating values;

generating a set of blinded passwords based on the set of hidden passwords and a set of blinded random numbers;

generating a set of passkeys based on the set of blinded passwords and the set of recovered random numbers; and

generating the set of decryption keys based on the set of blinded random numbers and the set of passkeys.

4. The method of claim 3, wherein the generating the set of hidden passwords comprises at least one of:

transforming the set of personalized authenticating values in accordance with a set of transformation functions to produce a set of transformed personalized authenticating values; and

for each password of the corresponding plurality of hidden passwords;

combining, in accordance with a combining function, one of the set of transformed personalized authenticating values with at least one of a constant and another one of the set of transformed personalized authenticating values to produce the password.

5. The method of claim 3, wherein the generating the set of decryption keys comprises:

generating a set of values based on the set of blinded random numbers; and

generating the set of decryption keys based on the set of values and the set of passkeys.

6. The method of claim 1, wherein the processing the set of shares to recover the access information comprises at least one of:

utilizing a Shamir secret sharing algorithm to decode the set of shares to recover the access information; and

dispersed storage error decoding the set of shares to recover the access information.

7. A computing device comprises:

an interface;

memory; and

a processing module operably coupled to the interface and the memory, wherein the processing module is operable to;

for a access request to the DSN, retrieve access information by;

retrieving, via the interface, a plurality of sets of encoded share slices and a plurality of sets of encoded random number slices from memory of the DSN;

dispersed storage error decoding the plurality of sets of encoded share slices to produce a set of encrypted shares;

dispersed storage error decoding the plurality of sets of encoded random number slice to produce a plurality of random numbers;

obtaining one or more personalized authenticating values regarding user access to the DSN;

processing the one or more personalized authenticating values and the plurality of random numbers to produce a set of decryption keys;

decrypting the set of encrypted shares using the set of decryption keys to produce a set of shares; and

processing the set of shares to recover the access information; and

utilize the recovered access information to process the access request to the DSN.

8. The computing device of claim 7, wherein the processing module is further operable to:

identify, in accordance with security parameters, the plurality of sets of encoded share slices and the plurality of sets of encoded random number slices;

send, via the interface, a first set of retrieval requests to the memory of the DSN regarding the plurality of sets of encoded share slices; and

send, via the interface, a second set of retrieval requests to the memory of the DSN regarding the plurality of sets of encoded random number slices.

9. The computing device of claim 7, wherein the processing module is further operable to process the one or more personalized authenticating values and the plurality of random numbers to produce the set of decryption keys by:

generating a set of hidden passwords based on the one or more personalized authenticating values;

generating a set of blinded passwords based on the set of hidden passwords and a set of blinded random numbers;

generating a set of passkeys based on the set of blinded passwords and the set of recovered random numbers; and

generating the set of decryption keys based on the set of blinded random numbers and the set of passkeys.

10. The computing device of claim 9, wherein the processing module is further operable to generate the set of hidden passwords by at least one of:

transforming the set of personalized authenticating values in accordance with a set of transformation functions to produce a set of transformed personalized authenticating values; and

for each password of the corresponding plurality of hidden passwords;

combining, in accordance with a combining function, one of the set of transformed personalized authenticating values with at least one of a constant and another one of the set of transformed personalized authenticating values to produce the password.

11. The computing device of claim 9, wherein the processing module is further operable to generate the set of decryption keys by:

generating a set of values based on the set of blinded random numbers; and

generating the set of decryption keys based on the set of values and the set of passkeys.

12. The computing device of claim 7, wherein the processing module is further operable to process the set of shares to recover the access information by at least one of:

utilizing a Shamir secret sharing algorithm to decode the set of shares to recover the access information; and

dispersed storage error decoding the set of shares to recover the access information.

13. A computer readable storage device comprises:

a first section that stores operational instructions that, when executed by a computing device, causes the computing device to, for a access request to the DSN, retrieve access information by;

retrieving, via the interface, a plurality of sets of encoded share slices and a plurality of sets of encoded random number slices from memory of the DSN;

dispersed storage error decoding the plurality of sets of encoded share slices to produce a set of encrypted shares;

dispersed storage error decoding the plurality of sets of encoded random number slice to produce a plurality of random numbers;

obtaining one or more personalized authenticating values regarding user access to the DSN;

processing the one or more personalized authenticating values and the plurality of random numbers to produce a set of decryption keys;

decrypting the set of encrypted shares using the set of decryption keys to produce a set of shares; and

processing the set of shares to recover the access information; and

a second section that stores operational instructions that, when executed by a computing device, causes the computing device to utilize the recovered access information to process the access request to the DSN.

14. The computer readable storage device of claim 13, wherein the first section further stores operational instructions that, when executed by a computing device, causes the computing device to:

identify, in accordance with security parameters, the plurality of sets of encoded share slices and the plurality of sets of encoded random number slices;

send, via the interface, a first set of retrieval requests to the memory of the DSN regarding the plurality of sets of encoded share slices; and

send, via the interface, a second set of retrieval requests to the memory of the DSN regarding the plurality of sets of encoded random number slices.

15. The computer readable storage device of claim 13, wherein the first section further stores operational instructions that, when executed by a computing device, causes the computing device to process the one or more personalized authenticating values and the plurality of random numbers to produce the set of decryption keys by:

generating a set of hidden passwords based on the one or more personalized authenticating values;

generating a set of blinded passwords based on the set of hidden passwords and a set of blinded random numbers;

generating a set of passkeys based on the set of blinded passwords and the set of recovered random numbers; and

generating the set of decryption keys based on the set of blinded random numbers and the set of passkeys.

16. The computer readable storage device of claim 15, wherein the first section further stores operational instructions that, when executed by a computing device, causes the computing device to generate the set of hidden passwords by at least one of:

transforming the set of personalized authenticating values in accordance with a set of transformation functions to produce a set of transformed personalized authenticating values; and

for each password of the corresponding plurality of hidden passwords;

combining, in accordance with a combining function, one of the set of transformed personalized authenticating values with at least one of a constant and another one of the set of transformed personalized authenticating values to produce the password.

17. The computer readable storage device of claim 15, wherein the first section further stores operational instructions that, when executed by a computing device, causes the computing device to generate the set of decryption keys by:

generating a set of values based on the set of blinded random numbers; and

generating the set of decryption keys based on the set of values and the set of passkeys.

18. The computer readable storage device of claim 13, wherein the first section further stores operational instructions that, when executed by a computing device, causes the computing device to process the set of shares to recover the access information by at least one of:

utilizing a Shamir secret sharing algorithm to decode the set of shares to recover the access information; and

dispersed storage error decoding the set of shares to recover the access information.