Reproducing data from obfuscated data retrieved from a dispersed storage network

• US 9,319,463 B2
• Filed: 12/01/2011
• Issued: 04/19/2016
• Est. Priority Date: 12/27/2010
• Status: Expired due to Fees

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Grube, Gary W., Markison, Timothy W.
• Primary Examiner(s): Shiferaw, Eleni
• Assistant Examiner(s): CALLAHAN, PAUL E
• Application Number:
  US13/309,469
• Publication Number:
  US 20120166813A1
• Time in Patent Office: 1,601 Days
• Field of Search: 713/162, 713/193, 726/30, 707/652, 707/770, 707/757, 714/6.24, 714/6.31, 714/52, 714/752, 711/114
• US Class Current: 1/1
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/062 Securing storage systems
• CPC Class Codes: G06F 3/064 Management of blocks
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A method begins by a processing module processing a data retrieval request that identifies data, wherein the data is stored as a plurality of sets of encoded data slices, wherein one or more encoded data slices of the plurality of sets of encoded data slices has been replaced with one or more encoded secret slices of secret data. The method continues with the processing module receiving at least a threshold number of the plurality of sets of encoded data slices and determining whether a secret data extraction process is initiated. The method continues with the processing module obtaining an inter-dispersing function to extract the one or more encoded secret slices to produce extracted encoded secret slices and decoding the extracted encoded secret slices in accordance with secret dispersed storage error encoding parameters to reproduce the secret data when the secret data extraction process is initiated.

Claims

1. A method comprises:

processing a data retrieval request that identifies data, wherein the data is stored in dispersed storage memory as a plurality of sets of encoded data slices, wherein one or more encoded data slices of the plurality of sets of encoded data slices has been replaced with one or more encoded secret data slices, and wherein the one or more encoded secret data slices represents secret data;

receiving, in response to the processing the data retrieval request, at least a threshold number of the plurality of sets of encoded data slices;

determining whether a secret data extraction process is initiated, wherein the determining whether the secret data extraction process is initiated includes at least one of;

the data retrieval request further including a request to initiate the secret data extraction process;

receiving a secret data extraction request to initiate the secret data extraction process; and

interpreting the plurality of sets of encoded data slices to identify a pattern of invalid encoded data slices;

interpreting the pattern of invalid encoded data slices as a secret data pattern; and

initiating the secret data extraction process when the secret data pattern is valid; and

when the secret data extraction process is initiated;

obtaining an inter-dispersing function to extract the one or more encoded secret slices from the plurality of sets of encoded data slices to produce extracted encoded secret slices; and

decoding the extracted encoded secret slices in accordance with secret dispersed storage error encoding parameters to reproduce the secret data.

2. The method of claim 1 further comprises:

when the secret data extraction process is not initiated and for a set of the plurality of sets of encoded data slices;

identifying an encoded secret slice of the one or more encoded secret slices as an invalid encoded data slice within the set of encoded data slices;

removing the invalid encoded data slice from the set of encoded data slices to produce an updated set of encoded data slices; and

decoding the updated set of encoded data slices in accordance with dispersed storage error encoding parameters to reproduce a data segment of the data.

3. The method of claim 1 further comprises:

when the secret data extraction process is initiated;

removing the extracted encoded secret slices from the plurality of sets of encoded data slices to produce an updated plurality of sets of encoded data slices; and

decoding the updated plurality of sets of encoded data slices in accordance with dispersed storage error encoding parameters to reproduce the data.

4. The method of claim 1, wherein the processing the data retrieval request comprises:

accessing a directory regarding a plurality of sets of slice names corresponding to the plurality of sets of encoded data slices; and

generating a plurality of sets of slice retrieval requests based on the plurality of sets of slice names.

5. The method of claim 1 further comprises:

the obtaining the inter-dispersing function including obtaining a horizontal dispersing function; and

identifying at least a secret decode threshold number of encoded secret slices of the one or more encoded secret slices within a set of the plurality of sets of encoded data slices based on the horizontal dispersing function.

6. The method of claim 1 further comprises:

the obtaining the inter-dispersing function including obtaining a vertical dispersing function; and

identifying less than a secret decode threshold number of encoded secret slices of the one or more encoded secret slices within a set of the plurality of sets of encoded data slices based on the vertical dispersing function.

7. A method comprises:

processing a data retrieval request that identifies data, wherein the data is stored in dispersed storage memory as a plurality of sets of encoded data slices, wherein one or more encoded data slices of the plurality of sets of encoded data slices has been replaced with one or more encoded secret data slices, and wherein the one or more encoded secret data slices represents secret data;

determining whether a secret data extraction process is initiated, wherein the determining whether the secret data extraction process is initiated includes at least one of;

the data retrieval request further including a request to initiate the secret data extraction process;

receiving a secret data extraction request to initiate the secret data extraction process; and

interpreting the plurality of sets of encoded data slices to identify a pattern of invalid encoded data slices;

interpreting the pattern of invalid encoded data slices as a secret data pattern; and

initiating the secret data extraction process when the secret data pattern is valid; and

when the secret data extraction process is initiated;

obtaining an inter-dispersing function to identify the one or more encoded secret slices from the plurality of sets of encoded data slices to produce identified encoded secret slices;

retrieving at least a threshold number of the identified encoded secret slices; and

decoding the at least a threshold number of the identified encoded secret slices in accordance with secret dispersed storage error encoding parameters to reproduce the secret data.

8. The method of claim 7 further comprises:

when the secret data extraction process is not initiated and for a set of the plurality of sets of encoded data slices;

receiving at least the threshold number of the encoded data slices of the set of encoded data slices;

identifying an encoded secret slice of the one or more encoded secret slices as an invalid encoded data slice within the at least the threshold number of the encoded data slices;

removing the invalid encoded data slice from the at least the threshold number of the encoded data slices to produce an updated set of encoded data slices; and

decoding the updated set of encoded data slices in accordance with dispersed storage error encoding parameters to reproduce a data segment of the data.

9. The method of claim 7 further comprises:

the processing the data retrieval request including;

accessing a directory regarding a plurality of sets of slice names corresponding to the plurality of sets of encoded data slices; and

generating a plurality of sets of slice retrieval requests based on the plurality of sets of slice names; and

the retrieving the at least the threshold number of the identified encoded secret slices based on slice names of the plurality of sets of slices names corresponding to the one or more encoded secret slices.

10. A dispersed storage (DS) module comprises:

a first module storing operational instructions that, when operable within a computing device, causes the computing device to process a data retrieval request that identifies data, wherein the data is stored in dispersed storage memory as a plurality of sets of encoded data slices, wherein one or more encoded data slices of the plurality of sets of encoded data slices has been replaced with one or more encoded secret data slices, and wherein the one or more encoded secret data slices represents secret data;

a second module storing operational instructions that, when operable within the computing device, causes the computing device to facilitate receiving, in response to the processing the data retrieval request, at least a threshold number of the plurality of sets of encoded data slices;

a third module storing operational instructions that, when operable within the computing device, causes the computing device to determine whether a secret data extraction process is initiated, wherein the third module functions to determine whether the secret data extraction process is initiated by at least one of;

the data retrieval request further including a request to initiate the secret data extraction process;

receiving a secret data extraction request to initiate the secret data extraction process; and

interpreting the plurality of sets of encoded data slices to identify a pattern of invalid encoded data slices;

interpreting the pattern of invalid encoded data slices as a secret data pattern; and

initiating the secret data extraction process when the secret data pattern is valid; and

when the secret data extraction process is initiated;

a fourth module storing operational instructions that, when operable within the computing device, causes the computing device to obtain an inter-dispersing function to extract the one or more encoded secret slices from the plurality of sets of encoded data slices to produce extracted encoded secret slices; and

a fifth module storing operational instructions that, when operable within the computing device, causes the computing device to decode the extracted encoded secret slices in accordance with secret dispersed storage error encoding parameters to reproduce the secret data.

11. The DS module of claim 10 further comprises:

a sixth module storing operational instructions that, when operable within the computing device, causes the computing device to, when the secret data extraction process is not initiated and for a set of the plurality of sets of encoded data slices;

identify an encoded secret slice of the one or more encoded secret slices as an invalid encoded data slice within the set of encoded data slices;

remove the invalid encoded data slice from the set of encoded data slices to produce an updated set of encoded data slices; and

decode the updated set of encoded data slices in accordance with dispersed storage error encoding parameters to reproduce a data segment of the data.

12. The DS module of claim 10 further comprises:

a sixth module storing operational instructions that, when operable within the computing device, causes the computing device to, when the secret data extraction process is initiated;

remove the extracted encoded secret slices from the plurality of sets of encoded data slices to produce an updated plurality of sets of encoded data slices; and

decode the updated plurality of sets of encoded data slices in accordance with dispersed storage error encoding parameters to reproduce the data.

13. The DS module of claim 10, wherein the first module further stores operational instructions that, when operable within the computing device, causes the computing device to process the data retrieval request by:

accessing a directory regarding a plurality of sets of slice names corresponding to the plurality of sets of encoded data slices; and

generating a plurality of sets of slice retrieval requests based on the plurality of sets of slice names.

14. The DS module of claim 10, wherein the fourth module further stores operational instructions that, when operable within the computing device, causes the computing device to:

obtain the inter-dispersing function by obtaining a horizontal dispersing function; and

identify at least a secret decode threshold number of encoded secret slices of the one or more encoded secret slices within a set of the plurality of sets of encoded data slices based on the horizontal dispersing function.

15. The DS module of claim 10, wherein the fourth module further stores operational instructions that, when operable within the computing device, causes the computing device to:

obtain the inter-dispersing function by obtaining a vertical dispersing function; and

identify less than a secret decode threshold number of encoded secret slices of the one or more encoded secret slices within a set of the plurality of sets of encoded data slices based on the vertical dispersing function.

16. A dispersed storage (DS) module comprises:

a first module storing operational instructions that, when operable within a computing device, causes the computing device to process a data retrieval request that identifies data, wherein the data is stored in dispersed storage memory as a plurality of sets of encoded data slices, wherein one or more encoded data slices of the plurality of sets of encoded data slices has been replaced with one or more encoded secret data slices, and wherein the one or more encoded secret data slices represents secret data;

a second module storing operational instructions that, when operable within the computing device, causes the computing device to determine whether a secret data extraction process is initiated, wherein the second module functions to determine whether the secret data extraction process is initiated by at least one of;

the data retrieval request further including a request to initiate the secret data extraction process;

receiving a secret data extraction request to initiate the secret data extraction process; and

interpreting the plurality of sets of encoded data slices to identify a pattern of invalid encoded data slices;

interpreting the pattern of invalid encoded data slices as a secret data pattern; and

initiating the secret data extraction process when the secret data pattern is valid; and

when the secret data extraction process is initiated;

a third module for obtaining an inter-dispersing function to identify the one or more encoded secret slices from the plurality of sets of encoded data slices to produce identified encoded secret slices;

a fourth module storing operational instructions that, when operable within the computing device, causes the computing device to retrieve at least a threshold number of the identified encoded secret slices; and

a fifth module storing operational instructions that, when operable within the computing device, causes the computing device to decode the at least a threshold number of the identified encoded secret slices in accordance with secret dispersed storage error encoding parameters to reproduce the secret data.

17. The DS module of claim 16 further comprises:

a sixth module storing operational instructions that, when operable within the computing device, causes the computing device to, when the secret data extraction process is not initiated and for a set of the plurality of sets of encoded data slices;

receive at least the threshold number of the encoded data slices of the set of encoded data slices;

identify an encoded secret slice of the one or more encoded secret slices as an invalid encoded data slice within the at least the threshold number of the encoded data slices;

remove the invalid encoded data slice from the at least the threshold number of the encoded data slices to produce an updated set of encoded data slices; and

decode the updated set of encoded data slices in accordance with dispersed storage error encoding parameters to reproduce a data segment of the data.

18. The DS module of claim 16 further comprises:

the first module further stores operational instructions that, when operable within the computing device, causes the computing device to process the data retrieval request by;

accessing a directory regarding a plurality of sets of slice names corresponding to the plurality of sets of encoded data slices; and

generating a plurality of sets of slice retrieval requests based on the plurality of sets of slice names; and

the fourth module further stores operational instructions that, when operable within the computing device, causes the computing device to retrieve the at least the threshold number of the identified encoded secret slices based on slice names of the plurality of sets of slices names corresponding to the one or more encoded secret slices.