Dispersed data storage system data encryption and encoding
View Patent ↗A computing system securely stores data to a dispersed data storage system. The computing system includes a processing module and a plurality of storage units. The processing module includes an encryptor and error encoder to encrypt and encode the data for dispersal utilizing a write command to the storage units. The storage units store the encrypted and encoded data when receiving the write command and the encrypted and encoded data.
1. A method for execution by a processing module, the method comprises:
encrypting a data segment of data using an encryption key to produce encrypted data;
encoding the encryption key to produce an encoded encryption key;
combining the encrypted data and the encoded encryption key to produce transformed data;
error encoding the transformed data to produce a set of encoded data slices, wherein the error encoding of the transformed data by the processing module further comprises:
slicing the transformed data into k data slices;
error encoding the k data slices to produce n encoded data slices; and
arranging the n encoded data slices into the set of encoded data slices; and
outputting, via a network, the set of encoded data slices to storage nodes of a dispersed storage network.
2. The method of claim 1 , wherein the encoding of the encryption key by the processing module further comprises:
performing a hash function on the encrypted data to produce a digest resultant; and
combining the encryption key and the digest resultant to produce the encoded encryption key.
3. The method of claim 1 , wherein the encoding of the encryption key by the processing module further comprises:
encoding the encryption key using a secret sharing scheme to produce a plurality of encoded key shares, wherein the encoded encryption key includes the plurality of encoded key shares.
4. The method of claim 1 , wherein the error encoding of the transformed data by the processing module further comprises:
error encoding the transformed data using a forward error correction scheme having a failure tolerance of n−k, where k is number of input symbols and n is the number of output symbols, to produce the error coded data.
5. The method of claim 1 further comprises, for execution by the processing module:
appending, prior to encrypting the data, a sentinel value to a data block or a data segment of a data file to produce the data.
6. The method of claim 1 , wherein the outputting the error coded data comprises:
generating a set of write commands to write the set of encoded data slices; and
sending the set of write commands to the storage nodes.
7. A computing device comprises:
a processing module;
memory operably coupled to the processing module; and
an input/output (IO) port, wherein the processing module is operably coupled to:
encrypt data using an encryption key to produce encrypted data;
encode the encryption key to produce an encoded encryption key;
combine the encrypted data and the encoded encryption key to produce transformed data; and
error encode the transformed data to produce a set of encoded data slices, wherein the error encoding includes:
slicing the transformed data into k data slices; and
error encoding the k data slices to produce n encoded data slices; and
arrange the n encoded data slices into the set of encoded data slices; and
the IO port is operably coupled to output the set of encoded data slices to storage nodes of a dispersed storage network.
8. The computing device of claim 7 , wherein the processing module further functions to encode the encryption key by:
performing a hash function on the encrypted data to produce a digest resultant; and
combining the encryption key and the digest resultant to produce the encoded encryption key.
9. The computing device of claim 7 , wherein the processing module further functions to encode the encryption key by:
encoding the encryption key using a secret sharing scheme to produce a plurality of encoded key shares, wherein the encoded key includes the plurality of encoded key shares.
10. The computing device of claim 7 , wherein the processing module further functions to:
append, prior to encrypting the data, a sentinel value to a data block or a data segment of a data file to produce the data.
11. The computing device of claim 7 , wherein the processing module further functions to:
generate a set of write commands to write the set of encoded data slices; and
send the set of write commands to the storage nodes via the IO port.