Encrypting data for storage in a dispersed storage network
View Patent ↗A method begins by a dispersed storage (DS) processing module encrypting a plurality of data segments of the data using a plurality of encryption keys to produce a plurality of encrypted data segments and generating a plurality of deterministic values from the plurality of encrypted data segments. The method continues with the DS processing module establishing a data intermingling pattern and generating a plurality of masked keys by selecting one or more of the plurality of deterministic values in accordance with the data intermingling pattern and performing a masking function on the plurality of encryption keys and the selected one or more of the plurality of deterministic values. The method continues with the DS processing module appending the plurality of masked keys to the plurality of encrypted data segments to produce a plurality of secure data packages and outputting the plurality of secure data packages.
1. A method for storing data, the method comprises:
encrypting a plurality of data segments of the data using a plurality of encryption keys to produce a plurality of encrypted data segments;
generating a plurality of deterministic values from the plurality of encrypted data segments using one or more deterministic functions;
establishing a data intermingling pattern for the plurality of encrypted data segments;
generating a plurality of masked keys by:
selecting one or more of the plurality of deterministic values in accordance with the data intermingling pattern; and
performing a masking function on the plurality of encryption keys and the selected one or more of the plurality of deterministic values;
appending the plurality of masked keys to the plurality of encrypted data segments in accordance with the data intermingling pattern to produce a plurality of secure data packages; and
outputting the plurality of secure data packages for storage.
2. The method of claim 1 , wherein the establishing the data intermingling pattern comprises:
a first selection pattern to select the one or more of the plurality of deterministic values;
a second selection pattern for associating each of the plurality of encryption keys with at least one corresponding one of the selected one or more of the plurality of deterministic values; and
a third selection pattern for associating each of the plurality of encrypted data segments with at least one corresponding one of the plurality of masked keys, wherein each of the first, second, and third selection pattern is based on one or more of a pseudorandom sequence based on a seed number, a predetermination, hard coding, a previous first, second, or third selection pattern, and a segment number mapping.
3. The method of claim 1 , wherein the outputting the plurality of secure data packages comprises:
performing a dispersed storage error encoding function on the plurality of secure data packages to produce a plurality of sets of encoded data slices; and
outputting the plurality of sets of encoded data slices.
4. The method of claim 1 , wherein the one or more deterministic functions comprises one or more of:
a hash function;
a mask generating function; and
a hash-based message authentication code (HMAC) function, wherein the one or more deterministic functions is selected in accordance with the data intermingling pattern.
5. The method of claim 1 further comprises:
generating the plurality of encryption keys using a plurality of random key generation functions.
6. A method for retrieving stored data, the method comprises:
retrieving a plurality of secure data packages;
establishing a data intermingling pattern for the plurality of secure data packages;
segregating the plurality of secure data packages in accordance with the data intermingling pattern to produce a plurality of masked keys and a plurality of encrypted data segments;
generating a plurality of deterministic values from the plurality of encrypted data segments using one or more deterministic functions;
performing a masking function on the plurality of masked keys and the plurality of deterministic values in accordance with the data intermingling pattern to produce a plurality of encryption keys; and
decrypting the plurality of encrypted data segments using the plurality of encryption keys to produce a plurality of data segments of the stored data.
7. The method of claim 6 , wherein the establishing the data intermingling pattern comprises:
a first selection pattern to select the one or more of the plurality of deterministic values;
a second selection pattern for associating each of the plurality of encryption keys with at least one corresponding one of the plurality of deterministic values; and
a third selection pattern for associating each of the plurality of encrypted data segments with at least one corresponding one of the plurality of encryption keys, wherein each of the first, second, and third selection pattern is based on one or more of a pseudorandom sequence based on a seed number, a predetermination, hard coding, a previous first, second, or third selection pattern, and a segment number mapping.
8. The method of claim 6 , wherein the retrieving the plurality of secure data packages comprises:
retrieving a plurality of sets of encoded data slices; and
performing a dispersed storage error decoding function on the plurality of sets of encoded data slices to produce the plurality of secure data packages.
9. The method of claim 6 , wherein the one or more deterministic functions comprises one or more of:
a hash function;
a mask generating function; and
a hash-based message authentication code (HMAC) function, wherein the one or more deterministic functions is selected in accordance with the data intermingling pattern.
10. A dispersed storage (DS) module comprises:
a first module, when operable within a computing device, causes the computing device to:
encrypt a plurality of data segments of the data using a plurality of encryption keys to produce a plurality of encrypted data segments;
a second module, when operable within the computing device, causes the computing device to:
generate a plurality of deterministic values from the plurality of encrypted data segments using one or more deterministic functions;
a third module, when operable within the computing device, causes the computing device to:
establish a data intermingling pattern for the plurality of encrypted data segments;
a fourth module, when operable within the computing device, causes the computing device to:
generate a plurality of masked keys by:
selecting one or more of the plurality of deterministic values in accordance with the data intermingling pattern; and
performing a masking function on the plurality of encryption keys and the selected one or more of the plurality of deterministic values;
a fifth module, when operable within the computing device, causes the computing device to:
append the plurality of masked keys to the plurality of encrypted data segments in accordance with the data intermingling pattern to produce a plurality of secure data packages; and
a sixth module, when operable within the computing device, causes the computing device to:
output the plurality of secure data packages for storage.
11. The DS module of claim 10 , wherein the third module functions to establish the data intermingling pattern by:
a first selection pattern to select the one or more of the plurality of deterministic values;
a second selection pattern for associating each of the plurality of encryption keys with at least one corresponding one of the selected one or more of the plurality of deterministic values; and
a third selection pattern for associating each of the plurality of encrypted data segments with at least one corresponding one of the plurality of masked keys, wherein each of the first, second, and third selection pattern is based on one or more of a pseudorandom sequence based on a seed number, a predetermination, hard coding, a previous first, second, or third selection pattern, and a segment number mapping.
12. The DS module of claim 10 , wherein the sixth module functions to output the plurality of secure data packages by:
performing a dispersed storage error encoding function on the plurality of secure data packages to produce a plurality of sets of encoded data slices; and
outputting the plurality of sets of encoded data slices.
13. The DS module of claim 10 , wherein the one or more deterministic functions comprises one or more of:
a hash function;
a mask generating function; and
a hash-based message authentication code (HMAC) function, wherein the one or more deterministic functions is selected in accordance with the data intermingling pattern.
14. The DS module of claim 10 further comprises:
the first module further functions to generate the plurality of encryption keys using a plurality of random key generation functions.
15. A dispersed storage (DS) module comprises:
a first module, when operable within a computing device, causes the computing device to:
retrieve a plurality of secure data packages;
a second module, when operable within the computing device, causes the computing device to:
establish a data intermingling pattern for the plurality of secure data packages;
a third module, when operable within the computing device, causes the computing device to:
segregate the plurality of secure data packages in accordance with the data intermingling pattern to produce a plurality of masked keys and a plurality of encrypted data segments;
a fourth module, when operable within the computing device, causes the computing device to:
generate a plurality of deterministic values from the plurality of encrypted data segments using one or more deterministic functions;
a fifth module, when operable within the computing device, causes the computing device to:
perform a masking function on the plurality of masked keys and the plurality of deterministic values in accordance with the data intermingling pattern to produce a plurality of encryption keys; and
a sixth module, when operable within the computing device, causes the computing device to:
decrypt the plurality of encrypted data segments using the plurality of encryption keys to produce a plurality of data segments of the stored data.
16. The DS module of claim 15 , wherein the second module functions to establish the data intermingling pattern by:
a first selection pattern to select the one or more of the plurality of deterministic values;
a second selection pattern for associating each of the plurality of encryption keys with at least one corresponding one of the plurality of deterministic values; and
a third selection pattern for associating each of the plurality of encrypted data segments with at least one corresponding one of the plurality of masked keys, wherein each of the first, second, and third selection pattern is based on one or more of a pseudorandom sequence based on a seed number, a predetermination, hard coding, a previous first, second, or third selection pattern, and a segment number mapping.
17. The DS module of claim 15 , wherein the first module functions to retrieve the plurality of secure data packages by:
retrieving a plurality of sets of encoded data slices; and
performing a dispersed storage error decoding function on the plurality of sets of encoded data slices to produce the plurality of secure data packages.
18. The DS module of claim 15 , wherein the one or more deterministic functions comprises one or more of:
a hash function;
a mask generating function; and
a hash-based message authentication code (HMAC) function, wherein the one or more deterministic functions is selected in accordance with the data intermingling pattern.