Distributed storage network and method for storing and retrieving encryption keys

• US 9,819,484 B2
• Filed: 08/05/2016
• Issued: 11/14/2017
• Est. Priority Date: 10/30/2009
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Resch, Jason K.
• Primary Examiner(s): Lipman, Jacob
• Application Number:
  US15/230,145
• Publication Number:
  US 20160344546A1
• Time in Patent Office: 466 Days
• Field of Search: 713167
• CPC Class Codes: G06F 11/1004 to protect a block of data words, e.g. CRC or checksum G06F11/1076 takes precedence; security arrangements for protecting computers or computer systems against unauthorized activity G06F21/00
• CPC Class Codes: G06F 11/1068 in sector programmable memories, e.g. flash disk G06F11/1072 takes precedence
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/064 Management of blocks
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: G11C 29/52 Protection of memory contents; Detection of errors in memory contents
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/23476 : by partially encrypting, e.g. encrypting the ending portion of a movie
• CPC Class Codes: H04N 21/26613 : for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4405 : involving video stream decryption
• CPC Class Codes: H04N 21/44055 : by partially decrypting, e.g. decrypting a video stream that has been partially encrypted
• CPC Class Codes: H04N 21/8456 : by decomposing the content in the time domain, e.g. in time segments

Abstract

A method for execution by a computing device of a dispersed storage network (DSN). The method begins by encrypting a data segment of a data object using a security key to produce an encrypted data segment. The method continues by dispersed storage error encoding the encrypted data segment to produce a set of encoded data slices and sending the set of encoded data slices to storage units of the DSN for storage. The method continues by encrypting the security key using an encryption key to produce an encrypted security key and dispersed storage error encoding the encrypted security key to produce a set of encoded key slices, wherein a decode threshold number of encoded key slices is needed to recover the encrypted security key. The method continues by sending the set of encoded key slices to a set of storage units of the DSN for storage therein.

Claims

1. A method for execution by a computing device of a dispersed storage network (DSN), the method comprises:

encrypting a data segment of a data object using a security key to produce an encrypted data segment;

dispersed storage error encoding the encrypted data segment to produce a set of encoded data slices;

sending the set of encoded data slices to storage units of the DSN for storage therein;

encrypting the security key using an encryption key to produce an encrypted security key;

dispersed storage error encoding the encrypted security key to produce a set of encoded key slices, wherein a decode threshold number of encoded key slices is needed to recover the encrypted security key; and

sending the set of encoded key slices to a set of storage units of the DSN for storage therein.

2. The method of claim 1 further comprises one of:

generating the encryption key based on a public key; and

generating the encryption key based on a password.

3. The method of claim 1 further comprises one of:

increasing the decode threshold to increase a level of security; and

decreasing the decode threshold to decrease a level of security.

4. The method of claim 1 further comprises:

dispersed storage error encoding the encrypted data segment using first dispersed storage error encoding parameters; and

dispersed storage error encoding the encrypted security key using second dispersed storage error encoding parameters.

5. The method of claim 1 further comprises:

the storage units being mutually exclusive of the set of storage units.

6. The method of claim 1 further comprises:

the storage units including at least one storage unit in common with the set of storage units.

7. A computing device comprises:

an interface;

memory; and

a processing module operably coupled to the memory and the interface, wherein the processing module is operable to;

encrypt a data segment of a data object using a security key to produce an encrypted data segment;

dispersed storage error encode the encrypted data segment to produce a set of encoded data slices;

send, via the interface, the set of encoded data slices to storage units of the DSN for storage therein;

encrypt the security key using an encryption key to produce an encrypted security key;

dispersed storage error encode the encrypted security key to produce a set of encoded key slices, wherein a decode threshold number of encoded key slices is needed to recover the encrypted security key; and

send, via the interface, the set of encoded key slices to a set of storage units of the DSN for storage therein.

8. The computing device of claim 7, wherein the processing module is further operable to perform one of:

generating the encryption key based on a public key; and

generating the encryption key based on a password.

9. The computing device of claim 7, wherein the processing module is further operable to perform one of:

increasing the decode threshold to increase a level of security; and

decreasing the decode threshold to decrease a level of security.

10. The computing device of claim 7, wherein the processing module is further operable to:

dispersed storage error encode the encrypted data segment using first dispersed storage error encoding parameters; and

dispersed storage error encode the encrypted security key using second dispersed storage error encoding parameters.

11. The computing device of claim 7 further comprises:

the storage units being mutually exclusive of the set of storage units.

12. The computing device of claim 7 further comprises:

the storage units including at least one storage unit in common with the set of storage units.