Deleting encoded data slices in a dispersed storage network
View Patent ↗A method begins by a dispersed storage (DS) processing module receiving a request regarding at least a portion of corresponding encoded data slices, wherein a collection of encrypted and encoded data slices of a plurality of collections of encrypted and encoded data slices includes a common data aspect, wherein encrypted and encoded data slices of the collection of encrypted and encoded data slices are produced by individually encrypting corresponding encoded data slices using a common encrypting character string and representations of the corresponding encoded data slices. The method continues with the DS processing module identifying the common encrypting character string of the corresponding encoded data slices. When the request is to delete the corresponding encoded data slices, the method continues with the DS processing module obfuscating the common encrypting character string in a local memory such that the collection of encrypted and encoded data slices are effectively incomprehensible.
1. A distributed storage (DS) unit comprises:
an interface;
a plurality of memory devices for storing, in an encrypted format, an encoded data slice from each of at least some sets of encoded data slices of a first, second, third, and fourth pluralities of sets of encoded data slices, wherein:
a first data object is dispersed storage error encoded into the first plurality of sets of encoded data slices;
a second data object is dispersed storage error encoded into the second plurality of sets of encoded data slices;
a third data object is dispersed storage error encoded into the third plurality of sets of encoded data slices;
a fourth data object is dispersed storage error encoded into the fourth plurality of sets of encoded data slices;
the first and second data objects share a first common data aspect;
the third and fourth data objects share a second common data aspect; and
encoded data slices of the first and second pluralities of sets of encoded data slices form a first collection of encoded data slices and encoded data slices of the third and fourth pluralities of sets of encoded data slices form a second collection of encoded data slices; and
a processing module operable to:
receive, via the interface, a request regarding encoded data slices of at least one of the first and second plurality of sets of encoded data slices;
identify, based on the request, a first common encrypting character string associated with the first common data aspect; and
process the request regarding the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices based on the first common encrypting character string, wherein encrypting of the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices is done based on the first common encrypting character string.
2. The DS unit of claim 1 , wherein the processing module is further operable to:
when the request is a read request regarding the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices, identify the first common encrypting character string associated with the first common data aspect;
decrypt the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices using the first common encrypting character string to recapture the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices; and
output, via the interface, the recaptured encoded data slices of the first and second plurality of sets of encoded data slices.
3. The DS unit of claim 1 , wherein the processing module is further operable to:
when the request is a write request regarding the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices, identify the first common encrypting character string associated with the first common data aspect;
encrypt the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices using the first common encrypting character string to produce the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices; and
write the at least one of the encoded data slices of the first and second plurality of sets of encoded data slices to one or more of the plurality of memory devices.
4. The DS unit of claim 1 , wherein the processing module is further operable to:
when the request is a delete request regarding the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices, identify the first common encrypting character string associated with the first common data aspect; and
obfuscate the first common encrypting character string such that the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices are effectively incomprehensible.
5. The DS unit of claim 1 , wherein the processing module is further operable to:
receive, via the interface, a request regarding the encoded data slices of the at least one of the third and fourth plurality of sets of encoded data slices;
identify, based on the request, a second common encrypting character string associated with the second common data aspect; and
process the request regarding the encoded data slices of the at least one of the third and fourth plurality of sets of encoded data slices based on the second common encrypting character string, wherein encrypting of the encoded data slices of the at least one of the third and fourth plurality of sets of encoded data slices is done based on the second common encrypting character string.
6. The DS unit of claim 1 , wherein the processing module is further operable to:
receive, via the interface, a request regarding the encoded data slices of the at least one of the first and third plurality of sets of encoded data slices, wherein the first and third data objects share a third common data aspect;
identify, based on the request, a third common encrypting character string associated with the third common data aspect; and
process the request regarding the encoded data slices of the at least one of the first and third plurality of sets of encoded data slices based on the third common encrypting character string, wherein encrypting of the encoded data slices of the at least one of the first and third plurality of sets of encoded data slices is done based on the third common encrypting character string.
7. The DS unit of claim 1 , wherein the processing module is further operable to individually encrypt the encoded data slices of at least one of the first and second plurality of sets of encoded data slices by:
transforming the first common encrypting character string and a representation of the encoded data slices of at least one of the first and second plurality of sets of encoded data slices using a deterministic function to produce an individual encryption key, wherein the representation includes one or more of distributed storage network (DSN) address, a slice name of the corresponding encoded data slice, a hash of the corresponding encoded data slice, the corresponding encoded data slice, a vault identifier (ID); and
encrypting an individual encoded data slice of the encoded data slices of at least one of the first and second plurality of sets of encoded data slices using the individual encryption key to produce an individual encrypted and encoded data slice of the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices.
8. The DS unit of claim 1 , wherein the first common encrypting character string includes one or more of:
a random number, a series of characters, a passcode, and a random string of characters.
9. A method for execution by a storage unit, the method comprises:
storing, in an encrypted format, an encoded data slice from each of at least some sets of encoded data slices of a first, second, third, and fourth pluralities of sets of encoded data slices, wherein:
a first data object is dispersed storage error encoded into the first plurality of sets of encoded data slices;
a second data object is dispersed storage error encoded into the second plurality of sets of encoded data slices;
a third data object is dispersed storage error encoded into the third plurality of sets of encoded data slices;
a fourth data object is dispersed storage error encoded into the fourth plurality of sets of encoded data slices;
the first and second data objects share a first common data aspect;
the third and fourth data objects share a second common data aspect; and
encoded data slices of the first and second pluralities of sets of encoded data slices form a first collection of encoded data slices and encoded data slices of the third and fourth pluralities of sets of encoded data slices form a second collection of encoded data slices; and
receiving a request regarding encoded data slices of at least one of the first and second plurality of sets of encoded data slices;
identifying, based on the request, a first common encrypting character string associated with the first common data aspect; and
processing the request regarding the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices based on the first common encrypting character string, wherein encrypting of the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices is done based on the first common encrypting character string.
10. The method of claim 9 further comprises:
when the request is a read request regarding the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices, identifying the first common encrypting character string associated with the first common data aspect;
decrypting the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices using the first common encrypting character string to recapture the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices; and
outputting the recaptured encoded data slices of the first and second plurality of sets of encoded data slices.
11. The method of claim 9 further comprises:
when the request is a write request regarding the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices, identifying the first common encrypting character string associated with the first common data aspect;
encrypting the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices using the first common encrypting character string to produce the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices; and
writing the at least one of the encoded data slices of the first and second plurality of sets of encoded data slices to one or more of a plurality of memory devices.
12. The method of claim 9 further comprises:
when the request is a delete request regarding the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices, identifying the first common encrypting character string associated with the first common data aspect; and
obfuscating the first common encrypting character string such that the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices are effectively incomprehensible.
13. The method of claim 9 further comprises:
receiving a request regarding the encoded data slices of the at least one of the third and fourth plurality of sets of encoded data slices;
identifying, based on the request, a second common encrypting character string associated with the second common data aspect; and
processing the request regarding the encoded data slices of the at least one of the third and fourth plurality of sets of encoded data slices based on the second common encrypting character string, wherein encrypting of the encoded data slices of the at least one of the third and fourth plurality of sets of encoded data slices is done based on the second common encrypting character string.
14. The method of claim 9 further comprises:
receiving a request regarding the encoded data slices of the at least one of the first and third plurality of sets of encoded data slices, wherein the first and third data objects share a third common data aspect;
identifying a third common encrypting character string associated with the third common data aspect; and
processing the request regarding the encoded data slices of the at least one of the first and third plurality of sets of encoded data slices based on the third common encrypting character string, wherein encrypting of the encoded data slices of the at least one of the first and third plurality of sets of encoded data slices is done based on the third common encrypting character string.
15. The method of claim 9 further comprises individually encrypting the encoded data slices of at least one of the first and second plurality of sets of encoded data slices by:
transforming the first common encrypting character string and a representation of the encoded data slices of at least one of the first and second plurality of sets of encoded data slices using a deterministic function to produce an individual encryption key, wherein the representation includes one or more of distributed storage network (DSN) address, a slice name of the corresponding encoded data slice, a hash of the corresponding encoded data slice, the corresponding encoded data slice, a vault identifier (ID); and
encrypting an individual encoded data slice of the encoded data slices of at least one of the first and second plurality of sets of encoded data slices using the individual encryption key to produce an individual encrypted and encoded data slice of the encoded data slices of the at least one of the first and second plurality of sets of encoded data slices.
16. The method of claim 9 , wherein the first common encrypting character string includes one or more of:
a random number, a series of characters, a passcode, and a random string of characters.