SECURELY DISTRIBUTING RANDOM KEYS IN A DISPERSED STORAGE NETWORK

• US 20180052731A1
• Filed: 10/31/2017
• Published: 02/22/2018
• Est. Priority Date: 11/28/2011
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Grube, Gary W., Markison, Timothy W.
• Granted Patent: US 10,055,283 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 11/1004 to protect a block of data words, e.g. CRC or checksum G06F11/1076 takes precedence; security arrangements for protecting computers or computer systems against unauthorized activity G06F21/00
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: H04L 2209/30 Compression, e.g. Merkle-Damgard construction
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/566 Grouping or aggregating service requests, e.g. for unified processing
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A method includes encrypting first data segment using first encryption key (EK1) to produce first encrypted data segment (DS), appending the first encrypted DS with EK2 to produce first encrypted appended DS, and dispersed error encoding the first encrypted appended DS to produce first set of error encoded data slices (EDSs). The method further includes encrypting EK1 using EK2 to produce EK layer1, encrypting second DS using EK3 to produce second encrypted DS, appending the second encrypted DS with EK4 to produce second encrypted appended DS, dispersed error encoding the second encrypted appended DS to produce second set of EDSs, appending EK3 with EK layer1 to produce appended EK layer1, encrypting appended EK layer1 using EK4 to produce EK layer2, generating EK layer-final in accordance with an EK layering scheme and EK layer2, and dispersed error encoding EK layer-final to produce set of error encoded layered key slices.

Claims

1. A method comprises:

encrypting, by a computing device of a dispersed storage network (DSN), a first data segment of a data object using a first encryption key to produce a first encrypted data segment;

appending, by the computing device, the first encrypted data segment with a second encryption key to produce a first encrypted appended data segment;

dispersed storage error encoding, by the computing device, the first encrypted appended data segment to produce a first set of error encoded data slices;

encrypting, by the computing device, the first encryption key using the second encryption key to produce a first encryption key layer;

encrypting, by the computing device, a second data segment of the data object using a third encryption key to produce a second encrypted data segment;

appending, by the computing device, the second encrypted data segment with a fourth encryption key to produce a second encrypted appended data segment;

dispersed storage error encoding, by the computing device, the second encrypted appended data segment to produce a second set of error encoded data slices;

appending, by the computing device, the third encryption key with the first encryption key layer to produce a first appended encryption key layer;

encrypting, by the computing device, the first appended encryption key layer using the fourth encryption key to produce a second encryption key layer;

generating, by the computing device, a final encryption key layer in accordance with an encryption key layering scheme and the second encryption key layer; and

dispersed storage error encoding, by the computing device, the final encryption key layer to produce a set of error encoded encryption key layer slices.

2. The method of claim 1 further comprises:

sending, by the computing device, the first and second sets of error encoded data slices to a set of storage devices of the DSN for storage therein.

3. The method of claim 2 further comprises:

sending, by the computing device, the set of error encoded layer key slices to the set of storage devices for storage therein.

4. The method of claim 1, wherein the encryption key layering scheme comprises:

obtaining, by the computing device, an encryption key pair for a current data segment of the data object;

appending, by the computing device, a first key of the encryption key pair to a previous encryption key layer to produce an appended previous encryption key layer; and

encrypting, by the computing device, the appended previous encryption key layer using a second key of the encryption key pair to produce a current encryption key layer.

5. The method of claim 1 further comprises:

encrypting, by the computing device, a third data segment of the data object using a fifth encryption key to produce a third encrypted data segment;

appending, by the computing device, the third encrypted data segment with a sixth encryption key to produce a third encrypted appended data segment;

dispersed storage error encoding, by the computing device, the third encrypted appended data segment to produce a third set of error encoded data slices;

appending, by the computing device, the fifth encryption key with the second encryption key layer to produce a third appended encryption key layer; and

encrypting, by the computing device, the third appended encryption key layer using the sixth encryption key to produce a third encryption key layer.

6. The method of claim 1 further comprises:

dispersed storage error decoding, by the computing device, the set of error encoded encryption key layer slices to produce the final encryption key layer;

generating, by the computing device, the second encryption key layer in accordance with the encryption key layering scheme and the final encryption key layer;

dispersed storage error decoding, by the computing device, the second set of error encoded data slices to produce the second encrypted appended data segment;

splitting, by the computing device, the fourth encryption key from the second encrypted appended data segment to produce the second encrypted data segment;

decrypting, by the computing device, the second encryption key layer using the fourth encryption key to produce the first appended encryption key layer;

splitting, by the computing device, the third encryption key from the first appended encryption key layer to produce the first encryption key layer;

decrypting, by the computing device, the second encrypted data segment using the third encryption key to produce the second data segment of the data object;

dispersed error decoding, by the computing device, the first set of error encoded data slices to produce the first encrypted appended data segment;

splitting, by the computing device, the first encrypted appended data segment from the second encryption key to produce the first encrypted data segment;

decrypting, by the computing device, the first encryption key layer using the second encryption key to produce the first encryption key; and

decrypting, by the computing device, the first encrypted data segment using the first encryption key to produce the first data segment of the data object.

7. A computing device of a dispersed storage network (DSN), the computing device comprises:

an interface;

memory; and

a processing module operably coupled to the memory and the interface, wherein the processing module is operable to;

encrypt a first data segment of a data object using a first encryption key to produce a first encrypted data segment;

append the first encrypted data segment with a second encryption key to produce a first encrypted appended data segment;

dispersed storage error encode the first encrypted appended data segment to produce a first set of error encoded data slices;

encrypt the first encryption key using the second encryption key to produce a first encryption key layer;

encrypt a second data segment of the data object using a third encryption key to produce a second encrypted data segment;

append the second encrypted data segment with a fourth encryption key to produce a second encrypted appended data segment;

dispersed storage error encode the second encrypted appended data segment to produce a second set of error encoded data slices;

append the third encryption key with the first encryption key layer to produce a first appended encryption key layer;

encrypt the first appended encryption key layer using the fourth encryption key to produce a second encryption key layer;

generate a final encryption key layer in accordance with an encryption key layering scheme and the second encryption key layer; and

dispersed storage error encode the final encryption key layer to produce a set of error encoded encryption key layer slices.

8. The computing device of claim 7, wherein the processing module is further operable to:

send the first and second sets of error encoded data slices to a set of storage devices of the DSN for storage therein.

9. The computing device of claim 8, wherein the processing module is further operable to:

send the set of error encoded layer key slices to the set of storage devices for storage therein.

10. The computing device of claim 7, wherein the processing module is further operable to:

generate the encryption key layering scheme by;

obtaining an encryption key pair for a current data segment of the data object;

appending a first key of the encryption key pair to a previous encryption key layer to produce an appended previous encryption key layer; and

encrypting the appended previous encryption key layer using a second key of the encryption key pair to produce a current encryption key layer.

11. The computing device of claim 7, wherein the processing module is further operable to:

encrypt a third data segment of the data object using a fifth encryption key to produce a third encrypted data segment;

append the third encrypted data segment with a sixth encryption key to produce a third encrypted appended data segment;

dispersed storage error encode the third encrypted appended data segment to produce a third set of error encoded data slices;

append the fifth encryption key with the second encryption key layer to produce a third appended encryption key layer; and

encrypt the third appended encryption key layer using the sixth encryption key to produce a third encryption key layer.

12. The computing device of claim 7, wherein the processing module is further operable to:

dispersed storage error decode the set of error encoded encryption key layer slices to produce the final encryption key layer;

generate the second encryption key layer in accordance with the encryption key layering scheme and the final encryption key layer;

dispersed storage error decode the second set of error encoded data slices to produce the second encrypted appended data segment;

split the fourth encryption key from the second encrypted appended data segment to produce the second encrypted data segment;

decrypt the second encryption key layer using the fourth encryption key to produce the first appended encryption key layer;

split the third encryption key from the first appended encryption key layer to produce the first encryption key layer;

decrypt the second encrypted data segment using the third encryption key to produce the second data segment of the data object;

dispersed error decode the first set of error encoded data slices to produce the first encrypted appended data segment;

split the first encrypted appended data segment from the second encryption key to produce the first encrypted data segment;

decrypt the first encryption key layer using the second encryption key to produce the first encryption key; and

decrypt the first encrypted data segment using the first encryption key to produce the first data segment of the data object.

13. A computer readable memory comprises:

a first memory element that stores operational instructions that, when executed by a computing device of a dispersed storage network (DSN), causes the computing device to;

encrypt a first data segment of a data object using a first encryption key to produce a first encrypted data segment;

append the first encrypted data segment with a second encryption key to produce a first encrypted appended data segment;

dispersed storage error encode the first encrypted appended data segment to produce a first set of error encoded data slices;

encrypt the first encryption key using the second encryption key to produce a first encryption key layer;

encrypt a second data segment of the data object using a third encryption key to produce a second encrypted data segment;

append the second encrypted data segment with a fourth encryption key to produce a second encrypted appended data segment;

dispersed storage error encode the second encrypted appended data segment to produce a second set of error encoded data slices;

append the third encryption key with the first encryption key layer to produce a first appended encryption key layer;

encrypt the first appended encryption key layer using the fourth encryption key to produce a second encryption key layer;

generate a final encryption key layer in accordance with an encryption key layering scheme and the second encryption key layer; and

dispersed storage error encode the final encryption key layer to produce a set of error encoded encryption key layer slices.

14. The computer readable memory of claim 13, wherein a second memory element that stores operational instructions that, when executed by the computing device, causes the computing device to:

send the first and second sets of error encoded data slices to a set of storage devices of the DSN for storage therein.

15. The computer readable memory of claim 14, wherein the second memory element further stores operational instructions that, when executed by the computing device, causes the computing device to:

send the set of error encoded layer key slices to the set of storage devices for storage therein.

16. The computer readable memory of claim 13, wherein the first memory element further stores operational instructions that, when executed by the computing device, causes the computing device to:

generate the encryption key layering scheme by;

obtaining an encryption key pair for a current data segment of the data object;

appending a first key of the encryption key pair to a previous encryption key layer to produce an appended previous encryption key layer; and

encrypting the appended previous encryption key layer using a second key of the encryption key pair to produce a current encryption key layer.

17. The computer readable memory of claim 13, wherein the first memory element further stores operational instructions that, when executed by the computing device, causes the computing device to:

encrypt a third data segment of the data object using a fifth encryption key to produce a third encrypted data segment;

append the third encrypted data segment with a sixth encryption key to produce a third encrypted appended data segment;

dispersed storage error encode the third encrypted appended data segment to produce a third set of error encoded data slices;

append the fifth encryption key with the second encryption key layer to produce a third appended encryption key layer; and

encrypt the third appended encryption key layer using the sixth encryption key to produce a third encryption key layer.

18. The computer readable memory of claim 13, wherein the first memory element further stores operational instructions that, when executed by the computing device, causes the computing device to:

dispersed storage error decode the set of error encoded encryption key layer slices to produce the final encryption key layer;

generate the second encryption key layer in accordance with the encryption key layering scheme and the final encryption key layer;

dispersed storage error decode the second set of error encoded data slices to produce the second encrypted appended data segment;

split the fourth encryption key from the second encrypted appended data segment to produce the second encrypted data segment;

decrypt the second encryption key layer using the fourth encryption key to produce the first appended encryption key layer;

split the third encryption key from the first appended encryption key layer to produce the first encryption key layer;

decrypt the second encrypted data segment using the third encryption key to produce the second data segment of the data object;

dispersed error decode the first set of error encoded data slices to produce the first encrypted appended data segment;

split the first encrypted appended data segment from the second encryption key to produce the first encrypted data segment;

decrypt the first encryption key layer using the second encryption key to produce the first encryption key; and

decrypt the first encrypted data segment using the first encryption key to produce the first data segment of the data object.