DISTRIBUTED STORAGE NETWORK AND METHOD FOR ENCRYPTING AND DECRYPTING DATA USING HASH FUNCTIONS

• US 20130124875A1
• Filed: 01/08/2013
• Published: 05/16/2013
• Est. Priority Date: 10/30/2009
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Resch, Jason K.
• Granted Patent: US 9,009,491 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 11/1004 to protect a block of data words, e.g. CRC or checksum G06F11/1076 takes precedence; security arrangements for protecting computers or computer systems against unauthorized activity G06F21/00
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 69/04 Protocols for data compression, e.g. ROHC
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A DS processing unit includes a grid module and a DSN interface. The grid module is operable to encrypt a data segment and to decrypt an encrypted data segment. To encrypt the data segment, the grid module partitions the data segment into portions and encrypts the portions using encryption keys generated from other portions to produce encrypted portions. The grid module then dispersed storage error encodes the encrypted portions to produce a set of encoded data slices, which the DSN interface outputs to a DSN. The DSN interface also receives a set of encoded data slices, which the grid module disperse storage error decodes to produce the encrypted data segment. The grid module then partitions the encrypted data segment into encrypted data portions and decrypts the encrypted data portions using decryption keys generated from other encrypted data portions to produce decrypted portions of a recovered data segment.

Claims

1. A method for processing a data segment within a portion of a distributed storage network, the method comprising:

partitioning the data segment into a plurality of portions;

entering a loop that includes;

generating an encryption key based on a portion of the plurality of portions or on an encrypted portion;

encrypting another portion of the plurality of portions using the encryption key to produce another encrypted portion;

when at least one portion of the plurality of portions is to be encrypted, repeating the loop for one of the at least one portion of the plurality of portions, wherein the other encrypted portion is the encrypted portion for generating the encryption key; and

exiting the loop when the plurality of portions have been encrypted into a plurality of encrypted portions;

dispersed storage error encoding the plurality of encrypted portions to produce a set of encoded data slices; and

outputting the set of encoded data slices for store in the distributed storage network.

2. The method of claim 1, wherein generating the encryption key comprises:

for a first pass through the loop;

generating a hash value from the portion using a hash function; and

generating the encryption key based on the hash value; and

for subsequent passes through the loop;

generating another hash value from the encrypted portion using the hash function or a second hash function; and

generating the encryption key based on the other hash value.

3. The method of claim 2 further comprises:

setting the encryption key to the hash value or to the other hash value.

4. The method of claim 2 further comprises:

combining the hash value or the other hash value with a second value to produce a combined value; and

generating the encryption key based on the combined value.

5. The method of claim 1 further comprises:

partitioning the data segment as one of a plurality of data segments in accordance with a partitioning scheme.

6. The method of claim 1 further comprises at least one of:

utilizing an encryption function for each pass through the loop to encrypt the other portion; and

utilizing different encryption functions for at least some passes through the loop to encrypt the other portion.

7. A method for processing an encrypted data segment within a portion of a distributed storage network, the method comprising:

dispersed storage error decoding a set of encoded data slices to produce the encrypted data segment;

partitioning the encrypted data segment into a plurality of encrypted portions;

entering a loop that includes;

generating an encryption key based on an encrypted portion of the plurality of encrypted portions or on a decrypted portion;

decrypting another encrypted portion of the plurality of encrypted portions using the encryption key to produce another decrypted portion;

when at least one portion of the plurality of encrypted portions is to be decrypted, repeating the loop for one of the at least one encrypted portion of the plurality of encrypted portions, wherein the other decrypted portion is the decrypted portion for generating the encryption key; and

exiting the loop when the plurality of encrypted portions have been decrypted into a plurality of decrypted portions; and

combining the plurality of decrypted portions to produce a decrypted data segment.

8. The method of claim 7, wherein generating the encryption key comprises:

for a first pass through the loop;

generating a hash value from the encrypted portion using a hash function; and

generating the encryption key based on the hash value; and

for subsequent passes through the loop;

generating another hash value from the decrypted portion using the hash function or a second hash function; and

generating the encryption key based on the other hash value.

9. The method of claim 8 further comprises:

setting the encryption key to the hash value or to the other hash value.

10. The method of claim 8 further comprises:

combining the hash value or the other hash value with a second value to produce a combined value; and

generating the encryption key based on the combined value.

11. The method of claim 7 further comprises:

partitioning the encrypted data segment as one of a plurality of encrypted data segments in accordance with a partitioning scheme.

12. The method of claim 7 further comprises at least one of:

utilizing a decryption function for each pass through the loop to decrypt the other encrypted portion; and

utilizing different decryption functions for at least some passes through the loop to decrypt the other encrypted portion.

13. A distributed storage (DS) processing unit comprises:

a grid module operable to;

encrypt a data segment by;

partitioning the data segment into a plurality of portions;

encrypting the plurality of portions using encryption keys generated from other portions of the plurality of portions to produce a plurality of encrypted portions; and

dispersed storage error encode the plurality of encrypted portions to produce a set of encoded data slices; and

decrypt an encrypted data segment by;

disperse storage error decode a retrieved set of encoded data slices to produce the encrypted data segment;

partitioning the encrypted data segment into a plurality of encrypted data portions;

decrypting the plurality of encrypted data portions using decryption keys generated from other encrypted data portions to produce a plurality of decrypted portions; and

a distributed storage network (DSN) interface operable to;

output the set of encoded data slices to a DSN; and

receive the retrieved set of encoded data slices from the DSN.

14. The DS processing unit of claim 13, wherein the grid module is further operable to encrypt the data segment by:

entering a loop that includes;

generating a unique encryption key based on a portion of the plurality of portions or on an encrypted portion;

encrypting another portion of the plurality of portions using the unique encryption key to produce another encrypted portion;

when at least one portion of the plurality of portions is to be encrypted, repeating the loop for one of the at least one portion of the plurality of portions, wherein the other encrypted portion is the encrypted portion for generating the unique encryption key; and

exiting the loop when the plurality of portions have been encrypted into a plurality of encrypted portions, wherein the encryption keys includes the unique encryption keys generated while executing the loop.

15. The DS processing unit of claim 14, wherein the grid module is further operable to generate the unique encryption key by:

for a first pass through the loop;

generating a hash value from the portion using a hash function; and

generating the unique encryption key based on the hash value; and

for subsequent passes through the loop;

generating another hash value from the encrypted portion using the hash function or a second hash function; and

generating the unique encryption key based on the other hash value.

16. The DS processing unit of claim 15, wherein the grid module is further operable to generate the unique encryption key by at least one of:

setting the unique encryption key to the hash value or to the other hash value; and

combining the hash value or the other hash value with a second value to produce a combined value and generating the unique encryption key based on the combined value.

17. The DS processing unit of claim 13, wherein the grid module is further operable to decrypt the encrypted data segment by:

entering a loop that includes;

generating a unique decryption key based on an encrypted portion of the plurality of encrypted portions or on a decrypted portion;

decrypting another encrypted portion of the plurality of encrypted portions using the unique decryption key to produce another decrypted portion;

when at least one portion of the plurality of encrypted portions is to be decrypted, repeating the loop for one of the at least one encrypted portion of the plurality of encrypted portions, wherein the other decrypted portion is the decrypted portion for generating the unique decryption key; and

exiting the loop when the plurality of encrypted portions have been decrypted into a plurality of decrypted portions.

18. The DS processing unit of claim 17, wherein the grid module is further operable to generate the unique decryption key by:

for a first pass through the loop;

generating a hash value from the portion using a hash function; and

generating the unique decryption key based on the hash value; and

for subsequent passes through the loop;

generating another hash value from the encrypted portion using the hash function or a second hash function; and

generating the unique decryption key based on the other hash value.

19. The DS processing unit of claim 18, wherein the grid module is further operable to generate the unique encryption key by at least one of:

setting the unique decryption key to the hash value or to the other hash value; and

combining the hash value or the other hash value with a second value to produce a combined value and generating the unique decryption key based on the combined value.

20. The DS processing unit of claim 18, wherein the grid module is further operable to:

partition the data segment as one of a plurality of data segments in accordance with a partitioning scheme; and

partition the encrypted data segment as one of a plurality of encrypted data segments in accordance with the partitioning scheme.