Retrieving access information in a dispersed storage network

• US 8,621,580 B2
• Filed: 08/04/2011
• Issued: 12/31/2013
• Est. Priority Date: 05/19/2010
• Status: Expired due to Fees

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Resch, Jason K., Grube, Gary W., Gladwin, S. Christopher, Shirley, Thomas Franklin Jr., Markison, Timothy W.
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US13/197,998
• Publication Number:
  US 20110289565A1
• Time in Patent Office: 880 Days
• Field of Search: 726/5, 707/999.1, 709/217, 714/763
• US Class Current: 726/5
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04L 2209/04 Masking or blinding
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method begins by a processing module obtaining a set of recovered random numbers, decoding encrypted share slices to produce a set of encrypted shares, and obtaining a set of personalized authenticating values regarding user access to data. The method continues with the processing module generating a set of hidden passwords based on the set of personalized authenticating values, generating a set of blinded passwords based on the set of hidden passwords and a set of blinded random numbers, and generating a set of passkeys based on the set of blinded passwords and the set of recovered random numbers. The method continues with the processing module generating a set of decryption keys based on the set of blinded random numbers and the set of passkeys, decrypting the set of encrypted shares to produce a set of shares, and decoding the set of shares to reproduce the data.

Claims

1. A method comprises:

decoding at least a decode threshold number of stored random number slices to produce a set of recovered random numbers;

decoding at least a decode threshold number of encrypted share slices to produce a set of encrypted shares;

obtaining a set of personalized authenticating values regarding user access to data;

generating a set of hidden passwords based on the set of personalized authenticating values;

generating a set of blinded passwords based on the set of hidden passwords and a set of blinded random numbers;

generating a set of passkeys based on the set of blinded passwords and the set of recovered random numbers;

generating a set of decryption keys based on the set of blinded random numbers and the set of passkeys;

decrypting the set of encrypted shares utilizing the set of decryption keys to produce a set of shares; and

decoding the set of shares to reproduce the data.

2. The method of claim 1 further comprises:

accessing a computing network utilizing the data.

3. The method of claim 1, wherein the set of personalized authenticating values includes at least one of:

a user device identifier (ID);

a user ID;

a personal information number (PIN);

a badge ID;

a district ID;

a work-shift ID;

an assignment ID;

a mission ID;

a passcode;

a password;

a picture file;

a video file;

an audio file;

a retinal scan;

a facial scan;

a fingerprint scan;

a personal secret; and

a password index number.

4. The method of claim 1, wherein the generating the set of hidden passwords comprises at least one of:

transforming the set of personalized authenticating values in accordance with a set of transformation functions to produce a set of transformed personalized authenticating values; and

for each password of the corresponding plurality of hidden passwords;

combining, in accordance with a combining function, one of the set of transformed personalized authenticating values with at least one of a constant and another one of the set of transformed personalized authenticating values to produce the password.

5. The method of claim 4, wherein the transformation function includes at least one of:

a null function;

a concatenation function;

an inverting function;

a hashing function;

an encryption function;

a compressing function; and

a mask generating function.

6. The method of claim 4, wherein the combining function includes at least one of:

an addition function;

a subtraction function;

a multiplication function;

a division function;

a logical exclusive OR function;

a logical OR function; and

a logical AND function.

7. The method of claim 1 further comprises:

the generating the set of blinded random numbers including;

obtaining a set of base random numbers; and

expanding each base random number of the set of base random numbers based on security parameters to produce the set of blinded random numbers; and

the generating the set of blinded passwords including;

for each blinded random number of the set of blinded random numbers, transforming a corresponding password of the set of hidden passwords utilizing a mask generating function and the blinded random number to produce a blinded password of the set of blinded passwords.

8. The method of claim 1, wherein the generating the set of passkeys comprises at least one of:

for each blinded password of the set of blinded passwords, transforming the blinded password utilizing a modulo function based on a corresponding recovered random number of the set of recovered random numbers and security parameters to produce a passkey of the set of passkeys; and

utilizing the set of blinded passwords to access the set of passkeys.

9. The method of claim 1, wherein the generating the set of decryption keys comprises:

generating a set of values based on the set of blinded random numbers; and

generating the set of decryption keys based on the set of values and the set of passkeys.

10. The method of claim 9 further comprises:

for each blinded random number of the set of blinded random numbers, transforming the blinded random number utilizing a modulo function based on security parameters to produce a value of the set of values.

11. The method of claim 9, wherein the generating the set of decryption keys further comprises:

for each passkey of the set of passkeys, transforming the passkey utilizing a modulo function based on security parameters and a corresponding value of the set of values to produce a decryption key of the set of decryption keys.

12. A computer comprises:

an interface;

a memory; and

a processing module operable to;

decode at least a decode threshold number of stored random number slices to produce a set of recovered random numbers;

decode at least a decode threshold number of encrypted share slices to produce a set of encrypted shares;

obtain a set of personalized authenticating values regarding user access to data;

generate a set of hidden passwords based on the set of personalized authenticating values;

generate a set of blinded passwords based on the set of hidden passwords and a set of blinded random numbers;

generate a set of passkeys based on the set of blinded passwords and the set of recovered random numbers;

generate a set of decryption keys based on the set of blinded random numbers and the set of passkeys;

decrypt the set of encrypted shares utilizing the set of decryption keys to produce a set of shares; and

decode the set of shares to reproduce the data.

13. The computer of claim 12, wherein the processing module further functions to:

access, via the interface, a computing network utilizing the data.

14. The computer of claim 12, wherein the set of personalized authenticating values includes at least one of:

a user device identifier (ID);

a user ID;

a personal information number (PIN);

a badge ID;

a district ID;

a work-shift ID;

an assignment ID;

a mission ID;

a passcode;

a password;

a picture file;

a video file;

an audio file;

a retinal scan;

a facial scan;

a fingerprint scan;

a personal secret; and

a password index number.

15. The computer of claim 12, wherein the processing module functions to generate the set of hidden passwords by at least one of:

transforming the set of personalized authenticating values in accordance with a set of transformation functions to produce a set of transformed personalized authenticating values; and

for each password of the corresponding plurality of hidden passwords;

combining, in accordance with a combining function, one of the set of transformed personalized authenticating values with at least one of a constant and another one of the set of transformed personalized authenticating values to produce the password.

16. The computer of claim 15, wherein the transformation function includes at least one of:

a null function;

a concatenation function;

an inverting function;

a hashing function;

an encryption function;

a compressing function; and

a mask generating function.

17. The computer of claim 15, wherein the combining function includes at least one of:

an addition function;

a subtraction function;

a multiplication function;

a division function;

a logical exclusive OR function;

a logical OR function; and

a logical AND function.

18. The computer of claim 12, wherein the processing module further functions to:

generate the set of blinded random numbers by;

obtaining a set of base random numbers; and

expanding each base random number of the set of base random numbers based on security parameters to produce the set of blinded random numbers; and

generate the set of blinded passwords by;

for each blinded random number of the set of blinded random numbers, transforming a corresponding password of the set of hidden passwords utilizing a mask generating function and the blinded random number to produce a blinded password of the set of blinded passwords.

19. The computer of claim 12, wherein the processing module functions to generate the set of passkeys by at least one of:

for each blinded password of the set of blinded passwords, transforming the blinded password utilizing a modulo function based on a corresponding recovered random number of the set of recovered random numbers and security parameters to produce a passkey of the set of passkeys; and

utilizing the set of blinded passwords to access the set of passkeys.

20. The computer of claim 12, wherein the processing module functions to generate the set of decryption keys by:

generating a set of values based on the set of blinded random numbers; and

generating the set of decryption keys based on the set of values and the set of passkeys.

21. The computer of claim 20, wherein the processing module further functions to:

for each blinded random number of the set of blinded random numbers, transforming the blinded random number utilizing a modulo function based on security parameters to produce a value of the set of values.

22. The computer of claim 20, wherein the processing module functions to generate the set of decryption keys further by:

for each passkey of the set of passkeys, transforming the passkey utilizing a modulo function based on security parameters and a corresponding value of the set of values to produce a decryption key of the set of decryption keys.