Dispersed storage secure data decoding

• US 8,656,187 B2
• Filed: 08/26/2009
• Issued: 02/18/2014
• Est. Priority Date: 04/20/2009
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Leggette, Wesley, Resch, Jason K.
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): NGUYEN, NGOC THACH D
• Application Number:
  US12/547,753
• Publication Number:
  US 20100266119A1
• Time in Patent Office: 1,637 Days
• Field of Search: 380/28, 711/154
• US Class Current: 713/193
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes

Abstract

A method operating on a computer begins by generating a read command to read at least some of a plurality of data slices from a dispersed storage network. The method continues by receiving the at least some of the plurality of data slices. The method continues by performing a reverse information dispersal algorithm on at least some of the plurality of data slices to produce a plurality of transposed data elements. The method continues by reverse transposing the plurality of transposed data elements to recover data elements of a data segment.

Claims

1. A method operating on a computer and comprising the steps of:

generating, by a processor of the computer, a read command to read at least some of a plurality of data slices from a dispersed storage network;

de-slicing, by the processor, the at least some of the plurality of data slices using a reverse information dispersal algorithm to produce an all-or-nothing encrypted data segment; and

applying, by the processor, a reverse all-or-nothing transformation on the all-or-nothing encrypted data segment to recover a data segment, wherein the reverse all-or-nothing transformation includes;

retrieving an obfuscated encryption key and an encrypted data segment from the all-or-nothing encrypted data segment;

calculating a digest from the encrypted data segment;

recovering the encryption key from the obfuscated encryption key based on the digest; and

decrypting the encrypted data segment based on the encryption key to produce the data segment.

2. The method of claim 1 wherein the recovering the encryption key from the obfuscated encryption key based on the digest comprises:

exclusive-ORing the obfuscated encryption key and the digest to produce the encryption key.

3. The method of claim 1 further comprises:

decrypting, by the processor, the all-or-nothing encrypted data segment using a first block cipher prior to the applying the reverse all-or-nothing transformation.

4. The method of claim 1, wherein the calculating the digest from the encrypted data segment comprises:

performing a hash function on the encrypted data segment to produce the digest.

5. A computer comprising:

a network port adapted to couple with a network and receive at least some of a plurality of data slices; and

a processor coupled to said network port wherein said processor;

receives the at least some of a plurality of data slices from the network port;

de-slices the at least some of the plurality of data slices using a reverse information dispersal algorithm to produce an all-or-nothing encrypted data segment; and

applies a reverse all-or-nothing transformation on the all-or-nothing encrypted data segment to recover a data segment, wherein the reverse all-or-nothing transformation includes;

retrieving an obfuscated encryption key and an encrypted data segment from the all-or-nothing encrypted data segment;

calculating a digest from the encrypted data segment;

recovering the encryption key from the obfuscated encryption key based on the digest; and

decrypting the encrypted data segment based on the encryption key to produce the data segment.

6. The computer of claim 5, wherein the processor further functions to recover the encryption key from the obfuscated encryption key based on the digest by:

exclusive-ORing the obfuscated encryption key and the digest to produce the encryption key.

7. The computer of claim 5, wherein the processor further functions to:

decrypt the all-or-nothing encrypted data segment using a first block cipher prior to the applying the reverse all-or-nothing transformation.

8. The computer of claim 5, wherein the processor further functions to calculate the digest from the encrypted data segment by:

performing a hash function on the encrypted data segment to produce the digest.