Dispersed data storage system data encryption and encoding

• US 8,744,071 B2
• Filed: 08/31/2009
• Issued: 06/03/2014
• Est. Priority Date: 04/20/2009
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Leggette, Wesley, Resch, Jason K.
• Primary Examiner(s): Abrishamkar, Kaveh
• Assistant Examiner(s): Alata, Ayoub
• Application Number:
  US12/551,117
• Publication Number:
  US 20100266120A1
• Time in Patent Office: 1,737 Days
• Field of Search: 380/28, 714/799, 714/E11.032
• US Class Current: 380/28
• CPC Class Codes: G06F 11/1012 using codes or arrangements adapted for a specific type of error G06F11/1048 takes precedence
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: H03M 13/15 Cyclic codes, i.e. cyclic shifts of codewords produce other codewords, e.g. codes defined by a generator polynomial, Bose-Chaudhuri-Hocquenghem [BCH] codes H03M13/17 takes precedence
• CPC Class Codes: H03M 13/1515 Reed-Solomon codes
• CPC Class Codes: H03M 13/23 using convolutional codes, e.g. unit memory codes
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 2463/062 applying encryption of the keys
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A computing system securely stores data to a dispersed data storage system. The computing system includes a processing module and a plurality of storage units. The processing module includes an encryptor and error encoder to encrypt and encode the data for dispersal utilizing a write command to the storage units. The storage units store the encrypted and encoded data when receiving the write command and the encrypted and encoded data.

Claims

1. A method for execution by a processing module, the method comprises:

encrypting a data segment of data using an encryption key to produce encrypted data;

encoding the encryption key to produce an encoded encryption key;

combining the encrypted data and the encoded encryption key to produce transformed data;

error encoding the transformed data to produce a set of encoded data slices, wherein the error encoding of the transformed data by the processing module further comprises;

slicing the transformed data into k data slices;

error encoding the k data slices to produce n encoded data slices; and

arranging the n encoded data slices into the set of encoded data slices; and

outputting, via a network, the set of encoded data slices to storage nodes of a dispersed storage network.

2. The method of claim 1, wherein the encoding of the encryption key by the processing module further comprises:

performing a hash function on the encrypted data to produce a digest resultant; and

combining the encryption key and the digest resultant to produce the encoded encryption key.

3. The method of claim 1, wherein the encoding of the encryption key by the processing module further comprises:

encoding the encryption key using a secret sharing scheme to produce a plurality of encoded key shares, wherein the encoded encryption key includes the plurality of encoded key shares.

4. The method of claim 1, wherein the error encoding of the transformed data by the processing module further comprises:

error encoding the transformed data using a forward error correction scheme having a failure tolerance of n−

k, where k is number of input symbols and n is the number of output symbols, to produce the error coded data.

5. The method of claim 1 further comprises, for execution by the processing module:

appending, prior to encrypting the data, a sentinel value to a data block or a data segment of a data file to produce the data.

6. The method of claim 1, wherein the outputting the error coded data comprises:

generating a set of write commands to write the set of encoded data slices; and

sending the set of write commands to the storage nodes.

7. A computing device comprises:

a processing module;

memory operably coupled to the processing module; and

an input/output (IO) port, wherein the processing module is operably coupled to;

encrypt data using an encryption key to produce encrypted data;

encode the encryption key to produce an encoded encryption key;

combine the encrypted data and the encoded encryption key to produce transformed data; and

error encode the transformed data to produce a set of encoded data slices, wherein the error encoding includes;

slicing the transformed data into k data slices; and

error encoding the k data slices to produce n encoded data slices; and

arrange the n encoded data slices into the set of encoded data slices; and

the IO port is operably coupled to output the set of encoded data slices to storage nodes of a dispersed storage network.

8. The computing device of claim 7, wherein the processing module further functions to encode the encryption key by:

performing a hash function on the encrypted data to produce a digest resultant; and

combining the encryption key and the digest resultant to produce the encoded encryption key.

9. The computing device of claim 7, wherein the processing module further functions to encode the encryption key by:

encoding the encryption key using a secret sharing scheme to produce a plurality of encoded key shares, wherein the encoded key includes the plurality of encoded key shares.

10. The computing device of claim 7, wherein the processing module further functions to:

append, prior to encrypting the data, a sentinel value to a data block or a data segment of a data file to produce the data.

11. The computing device of claim 7, wherein the processing module further functions to:

generate a set of write commands to write the set of encoded data slices; and

send the set of write commands to the storage nodes via the IO port.