EFFICIENT AND SECURE DATA STORAGE UTILIZING A DISPERSED DATA STORAGE SYSTEM

• US 20150169897A1
• Filed: 02/27/2015
• Published: 06/18/2015
• Est. Priority Date: 04/20/2009
• Status: Abandoned Application

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Leggette, Wesley, Resch, Jason K.
• Application Number:
  US14/633,315
• Publication Number:
  US 20150169897A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 9/0618 Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes

Abstract

A method of securely storing data to a dispersed data storage system is disclosed. A data segment is arranged along the columns or rows of an appropriately sized matrix. Data slices are then created based on either the columns or the rows so that no consecutive data is stored in a data slice. Each data slice is then stored in a separate storage node.

Claims

1. A method operating on a computer, the method comprises:

applying an all-or-nothing transformation to a data segment to produce an all-or-nothing data segment;

encoding, using an information dispersal algorithm, the all-or-nothing data segment to produce a set of encoded data slices; and

generating a set of write command to write the set of encoded data slices to storage units of a dispersed storage network.

2. The method of claim 1 wherein the applying an all-or-nothing transformation comprises:

generating an encryption key;

encrypting the data segment with said encryption key to produce an encrypted data segment;

calculating a digest corresponding to the encrypted data segment;

obfuscating the encryption key by exclusive ORing said encryption key with the digest to produce an obfuscated encryption key; and

packaging the obfuscated encryption key with the encrypted data segment to produce the all-or-nothing data segment.

3. The method of claim 1 further comprises:

encrypting the data segment using a first block cipher prior to the applying of the all-or-nothing transformation.

4. The method of claim 1 further comprises:

retrieving, by a second computer, at least a decode threshold number of encoded data slices of the set of encoded data slices from the storage units;

decoding, by the second computer using the information dispersal algorithm, the at least the decode threshold number of encoded data slices to recover the all-or-nothing data segment; and

reversing, by the second computer, the all-or-nothing transformation on the recovered all-or-nothing data segment to recover the data segment.

5. The method of claim 1 further comprises:

retrieving at least a decode threshold number of encoded data slices of the set of encoded data slices from the storage units;

decoding, using the information dispersal algorithm, the at least the decode threshold number of encoded data slices to recover the all-or-nothing data segment; and

reversing the all-or-nothing transformation on the recovered all-or-nothing data segment to recover the data segment.

6. The method of claim 5, wherein the reversing the all-or-nothing transformation comprises:

separating the all-or-nothing data segment into an encrypted data segment and an obfuscated encryption key;

calculating a digest based on the encrypted data segment;

exclusive ORing the obfuscated encryption key with the digest to recover an encryption key; and

decrypting the encrypted data segment using the encryption key to recover the data segment.

7. A computer comprising:

a network port adapted to couple with a network and receive a data segment; and

a processor coupled to the network port wherein the processor;

applies an all-or-nothing transformation to the data segment to produce an all-or-nothing data segment;

encodes, using an information dispersal algorithm, the all-or-nothing data segment to produce a set of encoded data slices; and

generates a set of write commands to write the set of encoded data slices to storage nodes of a dispersed storage network.

8. The computer of claim 7, wherein the processor further functions to apply the all-or-nothing transformation by:

generating an encryption key;

encrypting said data segment with said encryption key to produce an encrypted data segment;

calculating a digest corresponding to said encrypted data segment;

obfuscating said encryption key by exclusive-ORing said encryption key with said digest to produce an obfuscated encryption key; and

packaging said obfuscated encryption key with said encrypted data segment to produce the all-or-nothing encrypted data segment.

9. The computer of claim 7, wherein the processor further functions to:

encrypt the data segment using a first block cipher prior to the applying of the all-or-nothing transformation.

10. The computer of claim 7, wherein the processor further functions to:

retrieve, via the network port, at least a decode threshold number of encoded data slices of the set of encoded data slices from the storage nodes;

decode, using the information dispersal algorithm, the at least the decode threshold number of encoded data slices to recover the all-or-nothing data segment; and

reverse the all-or-nothing transformation on the recovered all-or-nothing data segment to recover the data segment.

11. The computer of claim 10, wherein the processor further functions to reverse the all-or-nothing transformation by:

separating the all-or-nothing data segment into an encrypted data segment and an obfuscated encryption key;

calculating a digest based on the encrypted data segment;

exclusive ORing the obfuscated encryption key with the digest to recover an encryption key; and

decrypting the encrypted data segment using the encryption key to recover the data segment.