End-to-end secure data storage in a dispersed storage network

1. A method comprises:

generating, by a first computing device of a dispersed storage network (DSN), a set of encryption keys;

encrypting, by the first computing device, a data matrix based on the set of encryption keys to produce an encrypted data matrix, wherein the data matrix includes data blocks of a data segment of a data object;

sending, by the first computing device, the encrypted data matrix to a second computing device of the DSN;

dispersed storage error encoding, by the second computing device, the data matrix to produce a set of encrypted encoded data slices; and

sending, by the second computing device, the set of encrypted encoded data slices to a set of storage units of the DSN for storage therein.

2. The method of claim 1 further comprises:

generating, by the first computing device, a set of temporary encryption keys as the set of encryption keys;

obtaining, by the set of storage units, the set of temporary encryption keys, wherein a first storage unit of the set of storage units obtains a first temporary encryption key of the set of temporary encryption keys;

decrypting, by the first storage unit, a first encrypted encoded data slice of the set of encrypted encoded data slices based on the first temporary encryption key to produce a first encoded data slice; and

storing, by the first storage unit, the first encoded data slice.

3. The method of claim 2 , wherein the decrypting the first encrypted encoded data slice comprises:

converting the first temporary encryption key into a first key stream; and

finite field subtracting the first key stream from the first encrypted encoded data slice to produce the first encoded data slice.

4. The method of claim 3 , wherein the finite field subtracting comprises:

exclusive ORing the first key stream with the first encrypted encoded data slice to produce the first encoded data slice.

5. The method of claim 1 , wherein the encrypting the data matrix comprises:

generating a first key stream from a first encryption key of the set of encryption keys; and

finite field adding the first key stream with a first row of the data matrix to produce a first encrypted data matrix row.

6. The method of claim 5 , wherein the finite field adding comprises:

exclusive ORing the first key stream with the first row of the data matrix to produce the first encrypted data matrix row.

7. The method of claim 1 further comprises:

generating the data matrix by:

determining a pillar width parameter, a decode threshold parameter, and an encoding function of the dispersed storage error encoding function; and

organizing the data blocks into a number of rows corresponding to the decode threshold parameter and a number of columns corresponding to the number of data blocks divided by the decode threshold parameter.

8. A computer readable memory comprises:

a first memory element that stores operational instructions, which, when executed by a first computing device of a dispersed storage network (DSN), causes the first computing device to:

generate a set of encryption keys;

encrypt a data matrix based on the set of encryption keys to produce an encrypted data matrix, wherein the data matrix includes data blocks of a data segment of a data object;

send the encrypted data matrix to a second computing device of the DSN;

a second memory element that stores operational instructions, which, when executed by the second computing device, causes the second computing device to:

dispersed storage error encode the data matrix to produce a set of encrypted encoded data slices; and

send the set of encrypted encoded data slices to a set of storage units of the DSN for storage therein.

9. The computer readable memory of claim 8 further comprises:

the first memory element further stores operational instructions, which, when executed by the first computing device, causes the first computing device to:

generate a set of temporary encryption keys as the set of encryption keys;

a third memory element that stores operational instructions, which, when executed by a storage unit of the set of storage units, causes the storage unit to:

obtain a temporary encryption key of the set of temporary encryption keys such that the set of storage units obtains the set of temporary encryption keys;

decrypt a corresponding encrypted encoded data slice of the set of encrypted encoded data slices based on the temporary encryption key to produce an encoded data slice; and

store the encoded data slice.

10. The computer readable memory of claim 9 , wherein the decrypting the corresponding encrypted encoded data slice comprises:

converting the temporary encryption key into a key stream; and

finite field subtracting the key stream from the corresponding encrypted encoded data slice to produce the first encoded data slice.

11. The computer readable memory of claim 10 , wherein the finite field subtracting comprises:

exclusive ORing the key stream with the corresponding encrypted encoded data slice to produce the encoded data slice.

12. The computer readable memory of claim 8 , wherein the first memory element further stores operational instructions, which, when executed by the first computing device, causes the first computing device to encrypt the data matrix by:

generating a first key stream from a first encryption key of the set of encryption keys; and

finite field adding the first key stream with a first row of the data matrix to produce a first encrypted data matrix row.

13. The computer readable memory of claim 12 , wherein the finite field adding comprises:

exclusive ORing the first key stream with the first row of the data matrix to produce the first encrypted data matrix row.

14. The computer readable memory of claim 8 , wherein the first memory element further stores operational instructions, which, when executed by the first computing device, causes the first computing device to:

generate the data matrix by:

determining a pillar width parameter, a decode threshold parameter, and an encoding function of the dispersed storage error encoding function; and

organizing the data blocks into a number of rows corresponding to the decode threshold parameter and a number of columns corresponding to the number of data blocks divided by the decode threshold parameter.