Dispersed storage secure data decoding
View Patent ↗A method operating on a computer begins by generating a read command to read at least some of a plurality of data slices from a dispersed storage network. The method continues by receiving the at least some of the plurality of data slices. The method continues by performing a reverse information dispersal algorithm on at least some of the plurality of data slices to produce a plurality of transposed data elements. The method continues by reverse transposing the plurality of transposed data elements to recover data elements of a data segment.
1. A method operating on a computer and comprising the steps of:
generating, by a processor of the computer, a read command to read at least some of a plurality of data slices from a dispersed storage network;
de-slicing, by the processor, the at least some of the plurality of data slices using a reverse information dispersal algorithm to produce an all-or-nothing encrypted data segment; and
applying, by the processor, a reverse all-or-nothing transformation on the all-or-nothing encrypted data segment to recover a data segment, wherein the reverse all-or-nothing transformation includes:
retrieving an obfuscated encryption key and an encrypted data segment from the all-or-nothing encrypted data segment;
calculating a digest from the encrypted data segment;
recovering the encryption key from the obfuscated encryption key based on the digest; and
decrypting the encrypted data segment based on the encryption key to produce the data segment.
2. The method of claim 1 wherein the recovering the encryption key from the obfuscated encryption key based on the digest comprises:
exclusive-ORing the obfuscated encryption key and the digest to produce the encryption key.
3. The method of claim 1 further comprises:
decrypting, by the processor, the all-or-nothing encrypted data segment using a first block cipher prior to the applying the reverse all-or-nothing transformation.
4. The method of claim 1 , wherein the calculating the digest from the encrypted data segment comprises:
performing a hash function on the encrypted data segment to produce the digest.
5. A computer comprising:
a network port adapted to couple with a network and receive at least some of a plurality of data slices; and
a processor coupled to said network port wherein said processor:
receives the at least some of a plurality of data slices from the network port;
de-slices the at least some of the plurality of data slices using a reverse information dispersal algorithm to produce an all-or-nothing encrypted data segment; and
applies a reverse all-or-nothing transformation on the all-or-nothing encrypted data segment to recover a data segment, wherein the reverse all-or-nothing transformation includes:
retrieving an obfuscated encryption key and an encrypted data segment from the all-or-nothing encrypted data segment;
calculating a digest from the encrypted data segment;
recovering the encryption key from the obfuscated encryption key based on the digest; and
decrypting the encrypted data segment based on the encryption key to produce the data segment.
6. The computer of claim 5 , wherein the processor further functions to recover the encryption key from the obfuscated encryption key based on the digest by:
exclusive-ORing the obfuscated encryption key and the digest to produce the encryption key.
7. The computer of claim 5 , wherein the processor further functions to:
decrypt the all-or-nothing encrypted data segment using a first block cipher prior to the applying the reverse all-or-nothing transformation.
8. The computer of claim 5 , wherein the processor further functions to calculate the digest from the encrypted data segment by:
performing a hash function on the encrypted data segment to produce the digest.