Secure storage of secret data in a dispersed storage network

1. A method comprises:

for secure storage of a data access key of an originating device:

encrypting, by the originating device, the data access key using secret data to produce an encrypted data access key;

dispersed storage error encoding the encrypted data access key to produce a set of encoded data access key slices;

sending the set of encoded data access key slices to storage nodes of a distributed storage network (DSN) for storage therein;

transforming, by the originating device, the secret data to produce a plurality of secret data shares;

obtaining, by the originating device, unique encryption values of trusted agent modules of the DSN;

encrypting, by the originating device, the plurality of secret data shares using the unique encryption values to produce a plurality of encrypted secret data shares; and

sending, by the originating device, the plurality of encrypted secret data shares to the storage nodes for storage therein; and

for secure retrieval of the data access key:

sending, by the originating device, a secret data retrieval request to the trusted agent modules;

in response to the secret data retrieval request, recovering, by the trusted agent modules, the plurality of encrypted secret data shares from the storage nodes;

decrypting, by the trusted agent modules, the plurality of encrypted secret data shares using a decryption function corresponding to the unique encryption values to recapture the plurality of secret data shares;

sending, by the trusted agent modules, the plurality of secret data shares to the originating device;

recovering, by the originating device, the secret data from the plurality of secret data shares;

retrieving, by the originating device, at least a decode threshold number of encoded data access key slices of the set of encoded data access key slices from at least some of the storage node;

recovering, by the originating device, the encrypted data access key from the at least the decode threshold number of encoded data access key slices; and

decrypting, by the originating device, the encrypted data access key using the recovered secret data to recover the data access key.

2. The method of claim 1 , wherein the transforming the secret data comprises one or more of:

interleaving the secret data into the plurality of secret data shares;

partitioning the secret data into the plurality of secret data shares;

performing a dispersed storage error coding function on the secret data to produce the plurality of secret data shares; and

performing a secret sharing function on the secret data to produce the plurality of secret data shares.

3. The method of claim 1 , wherein the obtaining the unique encryption values comprises:

identifying, by the originating device, the trusted agent modules; and

retrieving the unique encryption values based on the identifying of the trusted agent modules.

4. The method of claim 1 , wherein the obtaining the unique encryption values comprises:

identifying, by the originating device, the trusted agent modules; and

requesting the unique encryption values from the trusted agent modules.

5. The method of claim 1 , wherein one of the unique encryption values comprises one or more of:

a random encryption key agreed to by the originating device and one of the trusted agent modules; and

a public key of a public/private key pair of the one of the trusted agent modules.

6. The method of claim 5 , wherein the decryption function comprises one of:

an inversed encryption function when the one of the unique encryption values is the random encryption key; and

a private key decryption when the one of the unique encryption values is the public key.

7. The method of claim 1 , wherein the sending the plurality of encrypted secret data shares to the storage nodes further comprises:

identifying the storage nodes based on a type of the transforming.

8. The method of claim 1 further comprises:

storing, by the originating device, association of the secret data with the trusted agent modules.

9. The method of claim 1 further comprises:

for secure storage of the secret data of the originating device:

encrypting, by the originating device, one of the plurality of secret data shares using a one of the unique encryption values associated with one of the trusted agent modules to produce one of the plurality of encrypted secret data shares; and

sending, by the originating device, the one of the plurality of encrypted secret data shares to one of the storage nodes; and

for secure retrieval of the secret data:

in response to a secret data retrieval request, retrieving, by the one of the trusted agent modules, the one of the plurality of encrypted secret data shares from the one of the storage nodes;

decrypting, by the one of the trusted agent modules, the one of the plurality of encrypted secret data shares using a decryption function corresponding to the one of the unique encryption values to recapture the one of the plurality of secret data shares; and

sending, by the one of the trusted agent modules, the one of the plurality of secret data shares to the originating device.

10. A secret data storage facilitating system, wherein the system comprises:

an originating device that includes:

an interface;

memory; and

a processing module; and

a set of trusted agent modules, wherein a trusted agent module of the set of trusted agent modules includes:

an agent interface;

an agent memory; and

an agent processing module, wherein

for secure storage of a data access key of the originating device, the processing module of the originating device is operable to:

encrypt a data access key using secret data to produce an encrypted data access key;

dispersed storage error encode the encrypted data access key to produce a set of encoded data access key slices;

send the set of encoded data access key slices to storage nodes of a distributed storage network (DSN) for storage therein;

transform the secret data to produce a plurality of secret data shares;

obtain unique encryption values of the set of trusted agent modules;

encrypt the plurality of secret data shares using the unique encryption values to produce a plurality of encrypted secret data shares; and

send, via the interface, the plurality of encrypted secret data shares to the storage nodes of the DSN for storage therein; and

for secure retrieval of the data access key:

the processing module of the originating device is operable to send, via the interface, a secret data retrieval request to the set of trusted agent modules;

in response to the secret data retrieval request, the agent processing module of the trusted agent module is operable to:

recover, via the agent interface, one of the plurality of encrypted secret data shares from one of the storage nodes;

decrypt the one of the plurality of encrypted secret data shares using a decryption function corresponding to a unique encryption value of the trusted agent module to recapture the one of the plurality of secret data shares; and

send, via the agent interface, the one of the plurality of secret data shares to the originating device;

the processing module of the originating device is further operable to:

recover the secret data from the plurality of secret data shares;

retrieve, via the interface, at least a decode threshold number of encoded data access key slices of the set of encoded data access key slices from at least some of the storage node;

recover the encrypted data access key from the at least the decode threshold number of encoded data access key slices; and

decrypt the encrypted data access key using the recovered secret data to recover the data access key.

11. The system of claim 10 , wherein the processing module of the originating device functions to transform the secret data by one or more of:

interleaving the secret data into the plurality of secret data shares;

partitioning the secret data into the plurality of secret data shares;

performing a dispersed storage error coding function on the secret data to produce the plurality of secret data shares; and

performing a secret sharing function on the secret data to produce the plurality of secret data shares.

12. The system of claim 10 , wherein the processing module of the originating device functions to obtain the unique encryption values by:

identifying, by the originating device, the trusted agent modules; and

retrieving the unique encryption values based on the identifying of the trusted agent modules.

13. The system of claim 10 , wherein the processing module of the originating device functions to obtain the unique encryption values by:

identifying, by the originating device, the trusted agent modules; and

requesting the unique encryption values from the trusted agent modules.

14. The system of claim 10 , wherein one of the unique encryption values comprises one or more of:

a random encryption key agreed to by the originating device and one of the trusted agent modules; and

a public key of a public/private key pair of the one of the trusted agent modules.

15. The system of claim 14 , wherein the decryption function comprises one of:

an inversed encryption function when the one of the unique encryption values is the random encryption key; and

a private key decryption when the one of the unique encryption values is the public key.

16. The system of claim 10 , wherein the agent processing module of the trusted agent module further functions to send the plurality of encrypted secret data shares to the storage nodes by:

identifying the storage nodes based on a type of the transforming.

17. The system of claim 10 further comprises:

the processing module of the originating device is further operable to store association of the secret data with the trusted agent modules.

18. The system of claim 10 further comprises:

for secure storage of the secret data of the originating device, the processing module of the originating device is further operable to:

encrypt one of the plurality of secret data shares using a one of the unique encryption values associated with one of the trusted agent modules to produce one of the plurality of encrypted secret data shares; and

send, via the interface, the one of the plurality of encrypted secret data shares to one of the storage nodes; and

for secure retrieval of the secret data, an agent processing module of the one of the trusted agent modules is operable to:

in response to a secret data retrieval request, retrieve the one of the plurality of encrypted secret data shares from the one of the storage nodes;

decrypt the one of the plurality of encrypted secret data shares using a decryption function corresponding to the one of the unique encryption values to recapture the one of the plurality of secret data shares; and

sending the one of the plurality of secret data shares to the originating device.