APPLYING MULTIPLE HASH FUNCTIONS TO GENERATE MULTIPLE MASKED KEYS IN A SECURE SLICE IMPLEMENTATION

• US 20170192907A1
• Filed: 11/16/2016
• Published: 07/06/2017
• Est. Priority Date: 12/30/2015
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Resch, Jason K.
• Granted Patent: US 10,198,199 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 11/1092 Rebuilding, e.g. when physically replacing a failing disk
• CPC Class Codes: G06F 12/0684 with feedback, e.g. presence or absence of unit detected by addressing, overflow detection
• CPC Class Codes: G06F 12/0813 with a network or matrix configuration
• CPC Class Codes: G06F 12/0888 using selective caching, e.g. bypass
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 16/182 Distributed file systems
• CPC Class Codes: G06F 16/2246 Trees, e.g. B+trees
• CPC Class Codes: G06F 2212/154 Networked environment
• CPC Class Codes: G06F 2212/263 Network storage, e.g. SAN or NAS
• CPC Class Codes: G06F 3/0604 Improving or facilitating administration, e.g. storage management
• CPC Class Codes: G06F 3/0608 Saving storage space on storage systems
• CPC Class Codes: G06F 3/0611 in relation to response time
• CPC Class Codes: G06F 3/0616 in relation to life time, e.g. increasing Mean Time Between Failures [MTBF]
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/0623 in relation to content
• CPC Class Codes: G06F 3/0631 by allocating resources to storage systems
• CPC Class Codes: G06F 3/064 Management of blocks
• CPC Class Codes: G06F 3/0644 Management of space entities, e.g. partitions, extents, pools
• CPC Class Codes: G06F 3/0647 Migration mechanisms
• CPC Class Codes: G06F 3/0652 : Erasing, e.g. deleting, data cleaning, moving of data to a wastebasket
• CPC Class Codes: G06F 3/0653 : Monitoring storage devices or systems
• CPC Class Codes: G06F 3/0659 : Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/0661 : Format or protocol conversion arrangements
• CPC Class Codes: G06F 3/0665 : at area level, e.g. provisioning of virtual or logical volumes
• CPC Class Codes: G06F 3/067 : Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H03M 13/1515 : Reed-Solomon codes
• CPC Class Codes: H03M 13/3761 : using code combining, i.e. using combining of codeword portions which may have been transmitted separately, e.g. Digital Fountain codes, Raptor codes or Luby Transform [LT] codes
• CPC Class Codes: H04L 43/0852 : Delays
• CPC Class Codes: H04L 43/0876 : Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/0888 : Throughput
• CPC Class Codes: H04L 43/16 : Threshold monitoring
• CPC Class Codes: H04L 67/1097 : for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

Methods and apparatus for efficiently storing and accessing secure data are disclosed. The method of storing includes encrypting data utilizing an encryption key to produce encrypted data, performing deterministic functions on the encrypted data to produce deterministic function values, masking the encryption key utilizing the deterministic function values to produce masked keys and combining the encrypted data and the masked keys to produce a secure package. The method of accessing includes de-combining a secure package to reproduce encrypted data and masked keys, selecting a deterministic function, performing the selected deterministic function on the reproduced encrypted data to reproduce a deterministic function value, de-masking a corresponding masked key utilizing the reproduced deterministic function value to reproduce an encryption key, and decrypting the reproduced encrypted data utilizing the reproduced encryption key to reproduce data.

Claims

1. A method of storing secure data comprising:

encrypting data utilizing an encryption key to produce encrypted data;

performing a plurality of deterministic functions on the encrypted data to produce a plurality of deterministic function values;

masking the encryption key utilizing the plurality of deterministic function values to produce a plurality of masked keys; and

combining the encrypted data and the plurality of masked keys to produce a secure package.

2. The method of claim 1, wherein the plurality of deterministic function values each includes a first number of bits that is substantially the same as a second number of bits of the encryption key.

3. The method of claim 1, wherein the step of masking the encryption key utilizing the plurality of deterministic function values includes performing an exclusive OR function on the encryption key and the plurality of deterministic function values.

4. The method of claim 1, wherein the step of combining the encrypted data and the plurality of masked keys includes appending each of the plurality of masked keys to the encrypted data.

5. The method of claim 1, further comprising dispersed storage error encoding the secure package.

6. A method of accessing secure data comprising:

de-combining a secure package to reproduce encrypted data and a plurality of masked keys;

selecting a selected deterministic function of a plurality of deterministic functions based on one or more characteristics of the plurality of deterministic functions;

performing the selected deterministic function of the plurality of deterministic functions on the encrypted data to reproduce a deterministic function value;

de-masking a masked key of the plurality of masked keys corresponding to the selected deterministic function of the plurality of deterministic functions using the deterministic function value to produce an encryption key; and

decrypting the encrypted data utilizing the encryption key to produce reproduced data.

7. The method of claim 6, wherein the step of de-combining the secure package to reproduce encrypted data and the plurality of masked keys includes de-appending the plurality of masked keys from the encrypted data.

8. The method of claim 6, wherein the one or more characteristics of the plurality of deterministic functions includes speed of execution.

9. The method of claim 6, wherein the one or more characteristics of the plurality of deterministic functions includes efficiency of operation.

10. The method of claim 6, wherein the step of de-masking the masked key of the plurality of masked keys corresponding to the selected deterministic function of the plurality of deterministic functions using the deterministic function value to produce the encryption key includes performing an exclusive OR function on the masked key of the plurality of masked keys corresponding to the selected deterministic function of the plurality of deterministic functions utilizing the deterministic function value.

11. The method of claim 6, further comprising the step of dispersed storage error decoding the secure package.

12. A dispersed storage processing unit for use in a dispersed storage network, the dispersed storage processing unit comprising:

a communications interface;

a memory; and

a computer processor;

where the memory includes instructions for causing the computer processor to;

encrypt first data utilizing a first encryption key to produce first encrypted data;

perform a first plurality of deterministic functions on the first encrypted data to produce a first plurality of deterministic function values;

mask the first encryption key utilizing the first plurality of deterministic function values to produce a first plurality of masked keys;

combine the first encrypted data and the first plurality of masked keys to produce a first secure package;

de-combine a second secure package to reproduce second encrypted data and a second plurality of masked keys;

select a selected deterministic function of a second plurality of deterministic functions based on one or more characteristics of the second plurality of deterministic functions;

perform the selected deterministic function of the second plurality of deterministic functions on the second encrypted data to reproduce a reproduced deterministic function value;

de-mask a masked key of the second plurality of masked keys corresponding to the selected deterministic function of the second plurality of deterministic functions using the reproduced deterministic function value to produce a second encryption key; and

decrypt the second encrypted data utilizing the second encryption key to produce second data.

13. The dispersed storage processing unit of claim 12, wherein the first plurality of deterministic function values each includes a first number of bits that is substantially the same as a second number of bits of the first encryption key.

14. The dispersed storage processing unit of claim 12, wherein the memory further comprises instructions for causing the computer processor to perform an exclusive OR function on first the encryption key and the first plurality of deterministic function values.

15. The dispersed storage processing unit of claim 12, wherein the memory further comprises instructions for causing the computer processor to append each of the first plurality of masked keys to the first encrypted data.

16. The dispersed storage processing unit of claim 12, wherein the memory further comprises instructions for causing the computer processor to dispersed storage error encode the first secure package.

17. The dispersed storage processing unit of claim 12, wherein the memory further comprises instructions for causing the computer processor to de-append the second plurality of masked keys from the second encrypted data.

18. The dispersed storage processing unit of claim 12, wherein the one or more characteristics of the second plurality of deterministic functions includes speed of execution.

19. The dispersed storage processing unit of claim 12, wherein the one or more characteristics of the second plurality of deterministic functions includes efficiency of operation.

20. The dispersed storage processing unit of claim 12, wherein the memory further comprises instructions for causing the computer processor to perform an exclusive OR function on the masked key of the second plurality of masked keys corresponding to the selected deterministic function of the second plurality of deterministic functions utilizing the reproduced deterministic function value.