Distributed storage network and method for storing and retrieving encryption keys

1. A method for processing an encryption key within a portion of a distributed storage network (DSN), the method comprises:

receiving an encryption key to store;

determining an encryption method;

encrypting the encryption key with the determined encryption method to produce an encrypted key;

determining a pillar width of a DSN user storage vault as a parameter of a dispersed storage error coding function;

encoding the encrypted key in accordance with the dispersed storage error coding function to produce a set of encoded encrypted key slices, wherein a number of encoded encrypted key slices in the set of encoded encrypted key slices is equal to the pillar width, wherein a decode threshold number of the encoded encrypted key slices of the set of encoded encrypted key slices is required to reconstruct the encrypted key; and

storing in a distributed manner across the DSN user storage vault the set of encoded encrypted key slices in DSN memory.

2. The method of claim 1 further comprises one or more of:

increasing the decode threshold to increase a level of security; and

decreasing the decode threshold to decrease a level of security.

3. The method of claim 1 further comprises:

performing the encrypting an encryption key for a plurality of pillars within the DSN user storage vault.

4. The method of claim 1 , wherein the determining an encryption method further comprises:

a public key method or a password method.

5. The method of claim 4 , wherein the public key method includes:

retrieving a public key from a user storage vault to use as a key for encrypting the encryption key.

6. The method of claim 4 , wherein the password method includes:

retrieving a password from the DSN user storage vault and hashing the password to produce a hashed password, wherein the password or the hashed password is used as a key for encrypting the encryption key; and

retrieving the hashed password.

7. The method of claim 1 , wherein the encryption method includes at least an encryption algorithm.

8. The method of claim 7 , wherein the encryption algorithm is based on one or more of:

user device connectivity type;

a setting of the DSN user storage vault;

a command;

an operational parameter;

availability of a public encryption key; and

availability of a password.

9. The method of claim 1 further comprising:

controlling access to the encryption key based on one or more of:

a user ID;

a system element ID; and

a permissions list lookup.

10. The method of claim 9 further comprising:

the permissions list includes one or more permissions to retrieve and store one or more of:

private encryption keys;

public encryption keys;

secret encryption keys; and

all encryption keys.

11. A method for processing encrypted data within a distributed storage network (DSN), the method comprises:

receiving a retrieve encryption key request from a requester;

determining a width of a DSN user storage vault, the width including a number of storage pillars;

determining a decode threshold number of storage pillars for successful retrieval;

retrieving, in response to the retrieve encryption key request, at least the decode threshold number of encoded encrypted key slices of a set of encoded encrypted key slices from the storage pillars of the DSN;

decoding the at least the decode threshold number of the encoded encrypted key slices to produce an encrypted encryption key;

determining a decryption method;

decrypting the encrypted encryption key with the determined decryption method to produce an encryption key; and

sending the encryption key to the requester to decrypt one or more portions of the encrypted data.

12. The method of claim 11 , wherein the decryption method includes at least a decryption algorithm based on one or more of:

user device connectivity type;

a user vault setting;

a command;

an operational parameter;

availability of a public encryption key; and

availability of a password.

13. The method of claim 11 further comprises:

a permissions list including one or more permissions to retrieve and store one or more of:

private encryption keys;

public encryption keys;

secret encryption keys; and

all encryption keys.

14. The method of claim 11 further comprises:

performing the retrieving an encrypted key for each of the storage pillars within the DSN user storage vault.

15. The method of claim 11 , wherein the retrieving is any of:

ordered;

random; and

iterative.

16. The method of claim 11 , wherein the decryption method comprises a public key method or a password method.

17. The method of claim 16 , wherein the public key method includes:

retrieving a public key from the DSN user storage vault, to use as a key for encrypting the encryption key.

18. The method of claim 16 , wherein the password method further comprises one or more of:

retrieving a password from the DSN user storage vault and hashing the password to produce a hashed password, wherein the password or the hashed password is used as a key for encrypting the encryption key; and

retrieving the hashed password.

19. A distributed storage (DS) managing unit comprises:

a first module operable to:

store an encryption key by:

receiving an encryption key to store;

determining an encryption method;

encrypting the encryption key with the determined encryption method to produce an encrypted key;

determining a pillar width of a distributed storage network (DSN) user storage vault as a parameter of a dispersed storage error coding function;

encoding the encrypted key in accordance with the dispersed storage error coding function to produce a set of encoded encrypted key slices, wherein a number of encoded encrypted key slices in the set of encoded encrypted key slices is equal to the pillar width, wherein a decode threshold number of the encoded encrypted key slices of the set of encoded encrypted key slices is required to reconstruct the encrypted key; and

storing the set of encoded encrypted key slices in DSN memory; and

a second module operable to:

retrieve an encryption key by:

receiving a retrieve encryption key request from a requester;

determining the pillar width;

determining a decode threshold number of storage pillars for successful retrieval in accordance with the dispersed storage error coding function;

retrieving, in response to the retrieve encryption key request, at least the decode threshold number of the encoded encrypted key slices of a set of encoded encrypted key slices from storage units of the DSN;

decoding the at least the decode threshold number of the encoded encrypted key slices to produce an encrypted encryption key;

determining a decryption method;

decrypting the encrypted encryption key with the determined decryption method to produce the encryption key; and

sending the encryption key to the requester to decrypt one or more portions of encrypted data.

20. The distributed storage (DS) managing unit of claim 19 further comprising:

when storing the encryption key, the determining an encryption method further comprises retrieving a public key either from the DSN user storage vault or the encryption key to store; and

when retrieving the encryption key, the determining an encryption method further comprises retrieving a private key for a user or unit, wherein the private key is retrieved either from the DSN user storage vault or the retrieve encryption key request.