Retrieving access information in a dispersed storage network
View Patent ↗A method begins by a processing module obtaining a set of recovered random numbers, decoding encrypted share slices to produce a set of encrypted shares, and obtaining a set of personalized authenticating values regarding user access to data. The method continues with the processing module generating a set of hidden passwords based on the set of personalized authenticating values, generating a set of blinded passwords based on the set of hidden passwords and a set of blinded random numbers, and generating a set of passkeys based on the set of blinded passwords and the set of recovered random numbers. The method continues with the processing module generating a set of decryption keys based on the set of blinded random numbers and the set of passkeys, decrypting the set of encrypted shares to produce a set of shares, and decoding the set of shares to reproduce the data.
1. A method comprises:
decoding at least a decode threshold number of stored random number slices to produce a set of recovered random numbers;
decoding at least a decode threshold number of encrypted share slices to produce a set of encrypted shares;
obtaining a set of personalized authenticating values regarding user access to data;
generating a set of hidden passwords based on the set of personalized authenticating values;
generating a set of blinded passwords based on the set of hidden passwords and a set of blinded random numbers;
generating a set of passkeys based on the set of blinded passwords and the set of recovered random numbers;
generating a set of decryption keys based on the set of blinded random numbers and the set of passkeys;
decrypting the set of encrypted shares utilizing the set of decryption keys to produce a set of shares; and
decoding the set of shares to reproduce the data.
2. The method of claim 1 further comprises:
accessing a computing network utilizing the data.
3. The method of claim 1 , wherein the set of personalized authenticating values includes at least one of:
a user device identifier (ID);
a user ID;
a personal information number (PIN);
a badge ID;
a district ID;
a work-shift ID;
an assignment ID;
a mission ID;
a passcode;
a password;
a picture file;
a video file;
an audio file;
a retinal scan;
a facial scan;
a fingerprint scan;
a personal secret; and
a password index number.
4. The method of claim 1 , wherein the generating the set of hidden passwords comprises at least one of:
transforming the set of personalized authenticating values in accordance with a set of transformation functions to produce a set of transformed personalized authenticating values; and
for each password of the corresponding plurality of hidden passwords:
combining, in accordance with a combining function, one of the set of transformed personalized authenticating values with at least one of a constant and another one of the set of transformed personalized authenticating values to produce the password.
5. The method of claim 4 , wherein the transformation function includes at least one of:
a null function;
a concatenation function;
an inverting function;
a hashing function;
an encryption function;
a compressing function; and
a mask generating function.
6. The method of claim 4 , wherein the combining function includes at least one of:
an addition function;
a subtraction function;
a multiplication function;
a division function;
a logical exclusive OR function;
a logical OR function; and
a logical AND function.
7. The method of claim 1 further comprises:
the generating the set of blinded random numbers including:
obtaining a set of base random numbers; and
expanding each base random number of the set of base random numbers based on security parameters to produce the set of blinded random numbers; and
the generating the set of blinded passwords including:
for each blinded random number of the set of blinded random numbers, transforming a corresponding password of the set of hidden passwords utilizing a mask generating function and the blinded random number to produce a blinded password of the set of blinded passwords.
8. The method of claim 1 , wherein the generating the set of passkeys comprises at least one of:
for each blinded password of the set of blinded passwords, transforming the blinded password utilizing a modulo function based on a corresponding recovered random number of the set of recovered random numbers and security parameters to produce a passkey of the set of passkeys; and
utilizing the set of blinded passwords to access the set of passkeys.
9. The method of claim 1 , wherein the generating the set of decryption keys comprises:
generating a set of values based on the set of blinded random numbers; and
generating the set of decryption keys based on the set of values and the set of passkeys.
10. The method of claim 9 further comprises:
for each blinded random number of the set of blinded random numbers, transforming the blinded random number utilizing a modulo function based on security parameters to produce a value of the set of values.
11. The method of claim 9 , wherein the generating the set of decryption keys further comprises:
for each passkey of the set of passkeys, transforming the passkey utilizing a modulo function based on security parameters and a corresponding value of the set of values to produce a decryption key of the set of decryption keys.
12. A computer comprises:
an interface;
a memory; and
a processing module operable to:
decode at least a decode threshold number of stored random number slices to produce a set of recovered random numbers;
decode at least a decode threshold number of encrypted share slices to produce a set of encrypted shares;
obtain a set of personalized authenticating values regarding user access to data;
generate a set of hidden passwords based on the set of personalized authenticating values;
generate a set of blinded passwords based on the set of hidden passwords and a set of blinded random numbers;
generate a set of passkeys based on the set of blinded passwords and the set of recovered random numbers;
generate a set of decryption keys based on the set of blinded random numbers and the set of passkeys;
decrypt the set of encrypted shares utilizing the set of decryption keys to produce a set of shares; and
decode the set of shares to reproduce the data.
13. The computer of claim 12 , wherein the processing module further functions to:
access, via the interface, a computing network utilizing the data.
14. The computer of claim 12 , wherein the set of personalized authenticating values includes at least one of:
a user device identifier (ID);
a user ID;
a personal information number (PIN);
a badge ID;
a district ID;
a work-shift ID;
an assignment ID;
a mission ID;
a passcode;
a password;
a picture file;
a video file;
an audio file;
a retinal scan;
a facial scan;
a fingerprint scan;
a personal secret; and
a password index number.
15. The computer of claim 12 , wherein the processing module functions to generate the set of hidden passwords by at least one of:
transforming the set of personalized authenticating values in accordance with a set of transformation functions to produce a set of transformed personalized authenticating values; and
for each password of the corresponding plurality of hidden passwords:
combining, in accordance with a combining function, one of the set of transformed personalized authenticating values with at least one of a constant and another one of the set of transformed personalized authenticating values to produce the password.
16. The computer of claim 15 , wherein the transformation function includes at least one of:
a null function;
a concatenation function;
an inverting function;
a hashing function;
an encryption function;
a compressing function; and
a mask generating function.
17. The computer of claim 15 , wherein the combining function includes at least one of:
an addition function;
a subtraction function;
a multiplication function;
a division function;
a logical exclusive OR function;
a logical OR function; and
a logical AND function.
18. The computer of claim 12 , wherein the processing module further functions to:
generate the set of blinded random numbers by:
obtaining a set of base random numbers; and
expanding each base random number of the set of base random numbers based on security parameters to produce the set of blinded random numbers; and
generate the set of blinded passwords by:
for each blinded random number of the set of blinded random numbers, transforming a corresponding password of the set of hidden passwords utilizing a mask generating function and the blinded random number to produce a blinded password of the set of blinded passwords.
19. The computer of claim 12 , wherein the processing module functions to generate the set of passkeys by at least one of:
for each blinded password of the set of blinded passwords, transforming the blinded password utilizing a modulo function based on a corresponding recovered random number of the set of recovered random numbers and security parameters to produce a passkey of the set of passkeys; and
utilizing the set of blinded passwords to access the set of passkeys.
20. The computer of claim 12 , wherein the processing module functions to generate the set of decryption keys by:
generating a set of values based on the set of blinded random numbers; and
generating the set of decryption keys based on the set of values and the set of passkeys.
21. The computer of claim 20 , wherein the processing module further functions to:
for each blinded random number of the set of blinded random numbers, transforming the blinded random number utilizing a modulo function based on security parameters to produce a value of the set of values.
22. The computer of claim 20 , wherein the processing module functions to generate the set of decryption keys further by:
for each passkey of the set of passkeys, transforming the passkey utilizing a modulo function based on security parameters and a corresponding value of the set of values to produce a decryption key of the set of decryption keys.