PASSWORD AUGMENTED ALL-OR-NOTHING TRANSFORM

• US 20180247071A1
• Filed: 04/30/2018
• Published: 08/30/2018
• Est. Priority Date: 01/04/2013
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Resch, Jason K.
• Granted Patent: US 10,642,992 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/0623 in relation to content
• CPC Class Codes: G06F 3/0661 Format or protocol conversion arrangements
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 2209/04 Masking or blinding
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

A computing device includes an interface configured to interface and communicate with a dispersed storage network (DSN), a memory that stores operational instructions, and processing circuitry operably coupled to the interface and to the memory. The processing circuitry is configured to execute the operational instructions to perform various operations and functions. The computing device encrypts data using a key to generate encrypted data and processes it and a password based on a deterministic function to generate transformed data. The computing device masks the key based on a masking function based on the transformed data to generate a masked key, and then combines the encrypted data and the masked key to generate a secure package that is encoded in accordance with dispersed error encoding parameters produce a set of encoded data slices (EDSs) and transmits the set of EDSs to a plurality of storage units (SUs) to be distributedly stored therein.

Claims

1. A computing device comprising:

an interface configured to interface and communicate with a dispersed or distributed storage network (DSN);

memory that stores operational instructions; and

processing circuitry operably coupled to the interface and to the memory, wherein the processing circuitry is configured to execute the operational instructions to;

encrypt data using a key to generate encrypted data;

process the encrypted data and a password based on a deterministic function to generate transformed data;

mask the key based on a masking function based on the transformed data to generate a masked key;

combine the encrypted data and the masked key to generate a secure package;

encode the secure package in accordance with dispersed error encoding parameters produce a set of encoded data slices (EDSs), wherein the secure package is segmented into a plurality of data segments, wherein a data segment of the plurality of data segments is dispersed error encoded in accordance with the dispersed error encoding parameters to produce the set of EDSs; and

transmit, via the interface, the set of EDSs to a plurality of storage units (SUs) to be distributedly stored within the plurality of SUs and to be accessed by another computing device, wherein a decode threshold number of EDSs are needed by the another computing device to recover the data segment via the DSN.

2. The computing device of claim 1, wherein the processing circuitry is further configured to execute the operational instructions to:

mask the key based on the masking function based on the transformed data to generate the masked key including to perform an exclusive OR (XOR) function on the key and the transformed data to produce the masked key.

3. The computing device of claim 1, wherein the processing circuitry is further configured to execute the operational instructions to:

combine the encrypted data and the masked key to generate the secure package based on pre-appending the encrypted data to the masked key, post-appending the encrypted data to the masked key, inserting the encrypted data into to the masked key, inserting the masked key into the encrypted data, or interleaving the encrypted data and the masked key.

4. The computing device of claim 1, wherein the processing circuitry is further configured to execute the operational instructions to:

process the encrypted data and the password based on the deterministic function to generate the transformed data including processing the encrypted data and the password based on a hash-based message authentication code function (HMAC) to generate the transformed data.

5. The computing device of claim 1, wherein:

a read threshold number of EDSs provides for reconstruction of the data segment;

a write threshold number of EDSs provides for a successful transfer of the set of EDSs from a first at least one location in the DSN to a second at least one location in the DSN;

the set of EDSs is of pillar width and includes a pillar number of EDSs;

each of the decode threshold number, the read threshold number, and the write threshold number is less than the pillar number; and

the write threshold number is greater than or equal to the read threshold number that is greater than or equal to the decode threshold number.

6. The computing device of claim 1, wherein the computing device is located at a first premises that is remotely located from a second premises of at least one SU of the plurality of SUs within the DSN.

7. The computing device of claim 1 further comprising:

a SU of the plurality of SUs within the DSN, a wireless smart phone, a laptop, a tablet, a personal computers (PC), a work station, or a video game device.

8. The computing device of claim 1, wherein the DSN includes at least one of a wireless communication system, a wire lined communication system, a non-public intranet system, a public internet system, a local area network (LAN), or a wide area network (WAN).

9. A computing device comprising:

an interface configured to interface and communicate with a dispersed or distributed storage network (DSN);

memory that stores operational instructions; and

processing circuitry operably coupled to the interface and to the memory, wherein the processing circuitry is configured to execute the operational instructions to;

encrypt data using a key to generate encrypted data;

process the encrypted data and a password based on a deterministic function to generate transformed data including processing the encrypted data and the password based on a hash-based message authentication code function (HMAC) to generate the transformed data;

mask the key based on a masking function based on the transformed data to generate a masked key including to perform an exclusive OR (XOR) function on the key and the transformed data to produce the masked key;

combine the encrypted data and the masked key to generate a secure package;

encode the secure package in accordance with dispersed error encoding parameters produce a set of encoded data slices (EDSs), wherein the secure package is segmented into a plurality of data segments, wherein a data segment of the plurality of data segments is dispersed error encoded in accordance with the dispersed error encoding parameters to produce the set of EDSs; and

transmit, via the interface, the set of EDSs to a plurality of storage units (SUs) to be distributedly stored within the plurality of SUs and to be accessed by another computing device, wherein a decode threshold number of EDSs are needed by the another computing device to recover the data segment via the DSN.

10. The computing device of claim 9, wherein the processing circuitry is further configured to execute the operational instructions to:

combine the encrypted data and the masked key to generate the secure package based on pre-appending the encrypted data to the masked key, post-appending the encrypted data to the masked key, inserting the encrypted data into to the masked key, inserting the masked key into the encrypted data, or interleaving the encrypted data and the masked key.

11. The computing device of claim 9, wherein:

a read threshold number of EDSs provides for reconstruction of the data segment;

a write threshold number of EDSs provides for a successful transfer of the set of EDSs from a first at least one location in the DSN to a second at least one location in the DSN;

the set of EDSs is of pillar width and includes a pillar number of EDSs;

each of the decode threshold number, the read threshold number, and the write threshold number is less than the pillar number; and

the write threshold number is greater than or equal to the read threshold number that is greater than or equal to the decode threshold number.

12. The computing device of claim 9 further comprising:

a SU of the plurality of SUs within the DSN, a wireless smart phone, a laptop, a tablet, a personal computers (PC), a work station, or a video game device.

13. The computing device of claim 9, wherein the DSN includes at least one of a wireless communication system, a wire lined communication system, a non-public intranet system, a public internet system, a local area network (LAN), or a wide area network (WAN).

14. A method for execution by a computing device, the method comprising:

encrypting data using a key to generate encrypted data;

processing the encrypted data and a password based on a deterministic function to generate transformed data;

masking the key based on a masking function based on the transformed data to generate a masked key;

combining the encrypted data and the masked key to generate a secure package;

encoding the secure package in accordance with dispersed error encoding parameters produce a set of encoded data slices (EDSs), wherein the secure package is segmented into a plurality of data segments, wherein a data segment of the plurality of data segments is dispersed error encoded in accordance with the dispersed error encoding parameters to produce the set of EDSs; and

transmitting, via an interface of the computing device that is configured to interface and communicate with a dispersed or distributed storage network (DSN), the set of EDSs to a plurality of storage units (SUs) to be distributedly stored within the plurality of SUs and to be accessed by another computing device, wherein a decode threshold number of EDSs are needed by the another computing device to recover the data segment via the DSN.

15. The method of claim 14 further comprising:

masking the key based on the masking function based on the transformed data to generate the masked key including performing an exclusive OR (XOR) function on the key and the transformed data to produce the masked key.

16. The method of claim 14 further comprising:

combining the encrypted data and the masked key to generate the secure package based on pre-appending the encrypted data to the masked key, post-appending the encrypted data to the masked key, inserting the encrypted data into to the masked key, inserting the masked key into the encrypted data, or interleaving the encrypted data and the masked key.

17. The method of claim 14 further comprising:

processing the encrypted data and the password based on the deterministic function to generate the transformed data including processing the encrypted data and the password based on a hash-based message authentication code function (HMAC) to generate the transformed data.

18. The method of claim 14, wherein:

a read threshold number of EDSs provides for reconstruction of the data segment;

a write threshold number of EDSs provides for a successful transfer of the set of EDSs from a first at least one location in the DSN to a second at least one location in the DSN;

the set of EDSs is of pillar width and includes a pillar number of EDSs;

each of the decode threshold number, the read threshold number, and the write threshold number is less than the pillar number; and

the write threshold number is greater than or equal to the read threshold number that is greater than or equal to the decode threshold number.

19. The method of claim 14, wherein the computing device includes a SU of the plurality of SUs within the DSN, a wireless smart phone, a laptop, a tablet, a personal computers (PC), a work station, or a video game device.

20. The method of claim 14, wherein the DSN includes at least one of a wireless communication system, a wire lined communication system, a non-public intranet system, a public internet system, a local area network (LAN), or a wide area network (WAN).