De-sequencing encoded data slices

• US 8,959,366 B2
• Filed: 11/28/2010
• Issued: 02/17/2015
• Est. Priority Date: 01/28/2010
• Status: Expired due to Fees

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Grube, Gary W., Markison, Timothy W.
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US12/954,880
• Publication Number:
  US 20110185193A1
• Time in Patent Office: 1,542 Days
• Field of Search: 713/194, 713/189, 380/270
• US Class Current: 713/194
• CPC Class Codes: G06F 11/1008 in individual solid state devices G06F11/1004 takes precedence
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2211/1028 Distributed, i.e. distributed RAID systems with parity
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/0647 Migration mechanisms
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 65/764 at the destination reformatting of additional data in video clients H04N21/4355
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04N 21/222 Secondary servers, e.g. proxy server, cable television Head-end provisioning of proxy services in data packet switching networks H04L67/56
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/8456 by decomposing the content in the time domain, e.g. in time segments
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic

Abstract

A method begins by a processing module obtaining at least an ordering threshold number of encoded data slices to produce obtained encoded data slices. The method continues with the processing module ordering the obtained encoded data slices based on a pseudo-random de-sequencing order to produce a plurality of sets of encoded data slices. The method continues with the processing module dispersed storage error decoding the plurality of sets of encoded data slices to produce a plurality of encrypted data segments. The method continues with the processing module decrypting the plurality of encrypted data segments to produce a plurality of data segments. The method continues with the processing module aggregating the plurality of data segments to produce a data stream.

Claims

1. A method for execution by a processing module of a computing device, the method comprises:

receiving a data object retrieval message regarding receiving a transmission from a particular source device;

receiving, as the transmission, randomly ordered encoded slices from the particular source device;

rearranging the randomly ordered encoded slices into first randomly ordered encoded data slices corresponding to data and a set of second randomly ordered encoded data slices corresponding to auxiliary data based on de-selection information;

ordering the second randomly ordered encoded data slices into a set of encoded data slices in accordance with auxiliary data de-sequencing information;

decoding the set of encoded data slices in accordance with operational parameters to produce auxiliary data;

when the auxiliary data content corresponds to de-sequencing of the first randomly ordered encoded data slices, determining a pseudo random de-sequencing order for the first randomly ordered encoded data slices from the auxiliary data;

ordering the first randomly ordered encoded data slices based on the pseudo-random de-sequencing order to produce a plurality of sets of encoded data slices;

dispersed storage error decoding the plurality of sets of encoded data slices to produce a plurality of encrypted data segments;

decrypting the plurality of encrypted data segments to produce a plurality of data segments; and

aggregating the plurality of data segments to produce the data.

2. The method of claim 1, wherein the receiving the transmission comprises:

receiving an inbound radio frequency (RF) signal;

converting the inbound RF signal into a symbol stream in accordance with a wireless communication protocol; and

converting the symbol stream into the randomly ordered encoded slices in accordance with the wireless communication protocol.

3. The method of claim 1 further comprises:

determining the de-selection information by;

extracting information regarding operational parameters of the transmission from the data object retrieval message; and

determining de-selection information based on the operational parameters.

4. The method of claim 1, wherein the pseudo-random de-sequencing order comprises at least one of:

a de-sequencing algorithm identifier (ID);

a segment de-sequencing algorithm ID;

a slice de-sequencing algorithm ID;

an algorithm seed;

a seed generation algorithm ID;

an encryption key;

a hash algorithm ID;

segment ordering information; and

slice ordering information.

5. The method of claim 1, wherein the auxiliary data, for determining the pseudo-random de-sequencing order, comprises at least one of:

a requester identifier (ID);

a vault lookup;

a data object name;

the data;

received de-sequencing information;

error coding dispersal storage function parameters;

executing a de-sequencing algorithm utilizing an algorithm seed;

a priority indicator;

a security indicator;

a performance indicator;

a list;

a command;

a predetermination; and

a message.

6. The method of claim 1, wherein the decrypting the plurality of encrypted data segments comprises at least one of:

decrypting the plurality of encrypted data segments utilizing an all or nothing transformation (AONT) to produce the plurality of data segments;

decrypting the plurality of encrypted data segments utilizing a stored decryption key to produce the plurality of data segments;

decrypting the plurality of encrypted data segments utilizing a decryption key associated with at least one recipient to produce the plurality of data segments;

decrypting the plurality of encrypted data segments utilizing the stored encryption key to produce a plurality of AONT encrypted data segments and decrypting the plurality of AONT encrypted data segments utilizing the AONT to produce the plurality of data segments;

de-obfuscating the plurality of encrypted data segments utilizing a de-obfuscating method to produce the plurality of data segments;

selecting a decryption method based on a data type and decrypting the plurality of encrypted data segments utilizing the decryption method to produce the plurality of data segments; and

decrypting the plurality of encrypted data segments utilizing a null decryption method to produce the plurality of data segments.

7. The method of claim 1, wherein the aggregating the plurality of data segments comprises:

ordering the plurality of data segments in accordance with a data segment order of the pseudo-random de-sequencing order to produce ordered data segments; and

combining the ordered data segments to produce the data.

8. The method of claim 1 further comprises at least one of:

sending the randomly ordered encoded slices to a dispersed storage network (DSN) memory for storage therein;

sending the plurality of encoded data slices to the DSN memory for storage therein; and

dispersed storage error encoding the plurality of data segments to produce a new plurality of sets of re-encoded data slices and sending the new plurality of sets of re-encoded data slices to the DSN memory for storage therein.

9. The method of claim 1, wherein aggregating the plurality of data segments comprises:

ordering a plurality of randomly ordered data segments in accordance with the pseudo-random de-sequencing order to produce the plurality of data segments; and

aggregating the plurality of data segments to produce the at least one data stream.

10. The method of claim 1, wherein aggregating the plurality of data segments comprises:

ordering the plurality of data segments into a first plurality of data segment and a second plurality of data segments in accordance with the pseudo-random de-sequencing order;

aggregating the first plurality of data segments to produce a first data stream of the data; and

aggregating the second plurality of data segments to produce a second data stream of the data.

11. A computer comprises:

an interface; and

a processing module operable to;

receive a data object retrieval message regarding receiving a transmission from a particular source device;

receive, as the transmission, randomly ordered encoded slices from the particular source device;

rearrange the randomly ordered encoded slices into first randomly ordered encoded data slices corresponding to data and second randomly ordered encoded data slices corresponding to auxiliary data based on de-selection information;

order the second randomly ordered encoded data slices into a set of encoded data slices in accordance with auxiliary data de-sequencing information;

decode the set of encoded data slices in accordance with operational parameters to produce auxiliary data;

when the auxiliary data content corresponds to de-sequencing of the first randomly ordered encoded data slices, determine a pseudo random de-sequencing order for the first randomly ordered encoded data slices from the auxiliary data;

order the first randomly ordered encoded data slices based on the pseudo-random de-sequencing order to produce a plurality of sets of encoded data slices;

dispersed storage error decode the plurality of sets of encoded data slices to produce a plurality of encrypted data segments;

decrypt the plurality of encrypted data segments to produce a plurality of data segments; and

aggregate the plurality of data segments to produce the data.

12. The computer of claim 11, wherein the processing module further functions to receive the transmission by:

receiving an inbound radio frequency (RF) signal;

converting the inbound RF signal into a symbol stream in accordance with a wireless communication protocol; and

converting the symbol stream into the randomly ordered encoded slices in accordance with the wireless communication protocol.

13. The computer of claim 11, wherein the processing module further functions to determine the de-selection information by:

extracting information regarding operational parameters of the transmission from the data object retrieval message; and

determining de-selection information based on the operational parameters.

14. The computer of claim 11, wherein the pseudo-random de-sequencing order comprises at least one of:

a de-sequencing algorithm identifier (ID);

a segment de-sequencing algorithm ID;

a slice de-sequencing algorithm ID;

an algorithm seed;

a seed generation algorithm ID;

an encryption key;

a hash algorithm ID;

segment ordering information; and

slice ordering information.

15. The computer of claim 11, wherein the auxiliary data comprises at least one of:

a requester identifier (ID);

a vault lookup;

a data object name;

the data;

received de-sequencing information;

error coding dispersal storage function parameters;

executing a de-sequencing algorithm utilizing an algorithm seed;

a priority indicator;

a security indicator;

a performance indicator;

a list;

a command;

a predetermination; and

a message.

16. The computer of claim 11, wherein the processing module further functions to decrypt the plurality of encrypted data segments by at least one of:

decrypting the plurality of encrypted data segments utilizing an all or nothing transformation (AONT) to produce the plurality of data segments;

decrypting the plurality of encrypted data segments utilizing a stored decryption key to produce the plurality of data segments;

decrypting the plurality of encrypted data segments utilizing a decryption key associated with at least one recipient to produce the plurality of data segments;

decrypting the plurality of encrypted data segments utilizing the stored encryption key to produce a plurality of AONT encrypted data segments and decrypting the plurality of AONT encrypted data segments utilizing the AONT to produce the plurality of data segments;

de-obfuscating the plurality of encrypted data segments utilizing a de-obfuscating method to produce the plurality of data segments;

selecting a decryption method based on a data type and decrypting the plurality of encrypted data segments utilizing the decryption method to produce the plurality of data segments; and

decrypting the plurality of encrypted data segments utilizing a null decryption method to produce the plurality of data segments.

17. The computer of claim 11, wherein the processing module further functions to aggregate the plurality of data segments by:

ordering the plurality of data segments in accordance with a data segment order of the pseudo-random de-sequencing order to produce ordered data segments; and

combining the ordered data segments to produce the data.

18. The computer of claim 11, wherein the processing module further functions to:

send, via the interface, the randomly ordered encoded slices to a dispersed storage network (DSN) memory for storage therein;

send, via the interface, the plurality of encoded data slices to the DSN memory for storage therein; and

dispersed storage error encode the plurality of data segments to produce a new plurality of sets of re-encoded data slices and send, via the interface, the new plurality of sets of re-encoded data slices to the DSN memory for storage therein.

19. The computer of claim 11, wherein the processing module further functions to aggregate the plurality of data segments by:

ordering a plurality of randomly ordered data segments in accordance with the pseudo-random de-sequencing order to produce the plurality of data segments; and

aggregating the plurality of data segments to produce the at least one data stream.

20. The computer of claim 11, wherein the processing module further functions to aggregate the plurality of data segments by:

ordering the plurality of data segments into a first plurality of data segment and a second plurality of data segments in accordance with the pseudo-random de-sequencing order;

aggregating the first plurality of data segments to produce a first data stream of the data; and

aggregating the second plurality of data segments to produce a second data stream of the data.