Encrypting distributed computing data
View Patent ↗A method begins by a dispersed storage (DS) processing module encoding data to produce slices and redundancy slices and selecting primary and redundancy storage and execution units. The method continues with the DS processing module assigning partial tasks to the primary storage and execution units and generating a unique key set for each of the primary storage and execution units. The method continues with the DS processing module encrypting each of the slices with a corresponding one of the unique key sets to produce encrypted slices and sending the encrypted slices and an indication of the assigned partial tasks to the primary storage and execution units for storage and execution of the assigned partial tasks on the encrypted slices. The method continues with the DS processing module sending the redundancy slices to the set of redundancy storage and execution units for storage therein.
1. A method for execution by one or more processing modules of one or more computing devices, the method comprises:
encoding data using a dispersed storage error encoding function to produce a plurality of sets of encoded data slices, wherein a set of the plurality of sets of encoded data slices includes encoded data slices and redundancy encoded data slices, wherein the encoded data slices of the plurality of sets of encoded data slices are arranged into chunksets of slices and wherein the redundancy encoded data slices of the plurality of sets of encoded data slices are arranged into chunksets of redundancy slices;
selecting a set of primary storage and execution units for the chunksets of slices and a set of redundancy storage and execution units for the chunksets of redundancy slices;
assigning partial tasks of one or more distributed computing tasks to the set of primary storage and execution units;
generating a unique key set for each of the primary storage and execution units based on at least one of: the assigned partial task for the corresponding primary storage and execution unit, information regarding the corresponding primary storage and execution unit, information regarding key generation, and a pseudo random function;
encrypting each of the chunksets of slices with a corresponding one of the unique key sets to produce chunksets of encrypted slices;
sending the chunksets of encrypted slices and an indication of the assigned partial tasks to the set of primary storage and execution units for storage of the chunksets of encrypted slices and execution of the assigned partial tasks on the chunksets of encrypted slices; and
sending the chunksets of redundancy slices to the set of redundancy storage and execution units for storage therein.
2. The method of claim 1 , wherein the indication of the assigned partial task for one of the set of primary storage and execution units comprises at least one of:
an indication that the assigned partial task was used to generate the corresponding unique key set; and
an indication as to how the assigned partial task was used to generate the corresponding unique key set.
3. The method of claim 1 , wherein the sending the indication of the assigned partial task for one of the set of primary storage and execution units comprises:
sending a corresponding assigned partial task to the one of the set of primary storage and execution units.
4. The method of claim 1 , wherein the generating the unique key set for one of the primary storage and execution units comprises:
generating a unique key that is used to encrypt the slices of the corresponding chunkset of encrypted slices.
5. The method of claim 1 , wherein the generating the unique key set for one of the primary storage and execution units comprises:
generating multiple unique keys, wherein one of the multiple unique keys is used to encrypt one or more slices of the corresponding chunkset of encrypted slices.
6. The method of claim 1 , wherein the generating the unique key set for one of the primary storage and execution units comprises:
identifying the assigned partial task for the one of the primary storage and execution units;
performing a deterministic mathematical function on bits of the assigned partial task to create a value; and
manipulating the value into the unique key set.
7. The method of claim 1 , wherein the generating the unique key set for one of the primary storage and execution units comprises:
ascertaining a public key of a public/private key pair for the one of the primary storage and execution units; and
utilizing the public key to generate the unique key set.
8. A dispersed storage (DS) module comprises:
a first module, when operable within a computing device, causes the computing device to:
encode data using a dispersed storage error encoding function to produce a plurality of sets of encoded data slices, wherein a set of the plurality of sets of encoded data slices includes encoded data slices and redundancy encoded data slices wherein the encoded data slices of the plurality of sets of encoded data slices are arranged into chunksets of slices and wherein the redundancy encoded data slices of the plurality of sets of encoded data slices are arranged into chunksets of redundancy slices;
select a set of primary storage and execution units for the chunksets of slices and a set of redundancy storage and execution units for the chunksets of redundancy slices; and
assign partial tasks of one or more distributed computing tasks to the set of primary storage and execution units;
a second module, when operable within the computing device, causes the computing device to:
generate a unique key set for each of the primary storage and execution units based on at least one of: the assigned partial task for the corresponding primary storage and execution unit, information regarding the corresponding primary storage and execution unit, information regarding key generation, and a pseudo random function; and
encrypt each of the chunksets of slices with a corresponding one of the unique key sets to produce chunksets of encrypted slices; and
a third module, when operable within the computing device, causes the computing device to:
send the chunksets of encrypted slices and an indication of the assigned partial tasks to the set of primary storage and execution units for storage of the chunksets of encrypted slices and execution of the assigned partial tasks on the chunksets of encrypted slices; and
send the chunksets of redundancy slices to the set of redundancy storage and execution units for storage therein.
9. The DS module of claim 8 , wherein the indication of the assigned partial task for one of the set of primary storage and execution units comprises at least one of:
an indication that the assigned partial task was used to generate the corresponding unique key set; and
an indication as to how the assigned partial task was used to generate the corresponding unique key set.
10. The DS module of claim 8 , wherein the third module functions to send the indication of the assigned partial task for one of the set of primary storage and execution units by:
sending a corresponding assigned partial task to the one of the set of primary storage and execution units.
11. The DS module of claim 8 , wherein the second module functions to generate the unique key set for one of the primary storage and execution units by:
generating a unique key that is used to encrypt the slices of the corresponding chunkset of encrypted slices.
12. The DS module of claim 8 , wherein the second module functions to generate the unique key set for one of the primary storage and execution units by:
generating multiple unique keys, wherein one of the multiple unique keys is used to encrypt one or more slices of the corresponding chunkset of encrypted slices.
13. The DS module of claim 8 , wherein the second module functions to generate the unique key set for one of the primary storage and execution units by:
identifying the assigned partial task for the one of the primary storage and execution units;
performing a deterministic mathematical function on bits of the assigned partial task to create a value; and
manipulating the value into the unique key set.
14. The DS module of claim 8 , wherein the second module functions to generate the unique key set for one of the primary storage and execution units by:
ascertaining a public key of a public/private key pair for the one of the primary storage and execution units; and
utilizing the public key to generate the unique key set.