Encrypting segmented data in a distributed computing system
A method begins by a dispersed storage (DS) processing module segmenting a data partition into a plurality of data segments. For a data segment of the plurality of data segments, the method continues with the DS processing module dividing the data segment into a set of data sub-segments and generating a set of sub keys for the set of data sub-segments based on a master key. The method continues with the DS processing module encrypting the set of data sub-segments using the set of sub keys to produce a set of encrypted data sub-segments and aggregating the set of encrypted data sub-segments into encrypted data. The method continues with the DS processing module generating a masked key based on the encrypted data and the master key and combining the encrypted data and the masked key to produce an encrypted data segment.
1. A method for execution by a processing system including a processor and a memory, and wherein the method comprises:
segmenting, via the processing system, a data partition into a plurality of data segments; and
for each of at least some data segments of the plurality of data segments:
dividing, via the processing system, the data segment into a set of data sub-segments;
generating, via the processing system, a set of sub keys for the set of data sub-segments based on a master key, wherein the generating the set of sub keys comprises:
generating a first sub key of the set of sub keys by performing a deterministic function on the master key and a descriptor of a first data sub-segment of the set of data sub-segments; and
generating a second sub key of the set of sub keys by performing the deterministic function on the master key and a descriptor of a second data sub-segment of the set of data sub-segments;
encrypting, via the processing system, the set of data sub-segments using the set of sub keys to produce a set of encrypted data sub-segments;
aggregating, via the processing system, the set of encrypted data sub-segments into encrypted data;
generating, via the processing system, a masked key based on the encrypted data and the master key; and
combining, via the processing system, the encrypted data and the masked key to produce an encrypted data segment, wherein encryption of the data partition includes encrypted data segments for the each of the at least some of the data segments, wherein the combining the encrypted data and the masked key includes at least one of: interleaving the masked key with the encrypted data to produce the encrypted data segment; appending the masked key to the encrypted data to produce the encrypted data segment; or distributing, in accordance with a pattern, portions of the masked key within the encrypted data to produce the encrypted data segment.
2. The method of claim 1 , further comprises:
dividing the data segment into the set of data sub-segments based a decode threshold of a dispersed storage error encoding function; and
encoding the encrypted data segment in accordance with the dispersed storage error encoding function to produce a set of encoded data slices.
3. The method of claim 1 , wherein the generating the masked key comprises:
performing a deterministic function on the encrypted data to produce transformed data; and
performing a masking function on the master key using the transformed data to produce the masked key.
4. The method of claim 1 , further comprises:
for another data segment of the plurality of data segments:
dividing the other data segment into a second set of data sub-segments;
generating a second set of sub keys for the second set of data sub-segments based on the master key;
encrypting the second set of data sub-segments using the second set of sub keys to produce a second set of encrypted data sub-segments;
aggregating the second set of encrypted data sub-segments into second encrypted data;
generating a second masked key based on the second encrypted data and the master key; and
combining the second encrypted data and the second masked key to produce a second encrypted data segment.
5. The method of claim 4 further comprises:
generating a first slice group from a first encrypted data sub-segment of the encrypted data segment and a first encrypted data sub-segment of the second encrypted data segment; and
generating a second slice group from a second encrypted data sub-segment of the encrypted data segment and a second encrypted data sub-segment of the second encrypted data segment.
6. The method of claim 1 , further comprises:
obtaining a first master key for a first data segment of the plurality of data segments; and
obtaining a second master key for a second data segment of the plurality of data segments.
7. A method for execution by a processing system including a processor and a memory, and wherein the method comprises:
segmenting, via the processing system, a data partition into a plurality of data segments; and
for a data segment of the plurality of data segments:
dividing, via the processing system, the data segment into a set of data sub-segments;
generating, via the processing system, a set of sub keys for the set of data sub-segments based on a master key, wherein the generating the set of sub keys comprises:
generating a first sub key of the set of sub keys by performing at least one of a mathematical function and a logical function on the master key, a descriptor of a first data sub-segment of the set of data sub-segments, and a first shared secret; and
generating a second sub key of the set of sub keys by performing at least one of the mathematical function and the logical function on the master key, a descriptor of a second data sub-segment of the set of data sub-segments, and a second shared secret;
encrypting, via the processing system, the set of data sub-segments using the set of sub keys to produce a set of encrypted data sub-segments,
aggregating, via the processing system, the set of encrypted data sub-segments into encrypted data;
generating, via the processing system, a masked key based on the encrypted data and the master key; and
combining, via the processing system, the encrypted data and the masked key to produce an encrypted data segment, wherein encryption of the data partition includes encrypted data segments for the each of the at least some of the data segments, wherein the combining the encrypted data and the masked key includes at least one of: interleaving the masked key with the encrypted data to produce the encrypted data segment; appending the masked key to the encrypted data to produce the encrypted data segment; or distributing, in accordance with a pattern, portions of the masked key within the encrypted data to produce the encrypted data segment.
8. The method of claim 7 , further comprises:
dividing the data segment into the set of data sub-segments based a decode threshold of a dispersed storage error encoding function; and
encoding the encrypted data segment in accordance with the dispersed storage error encoding function to produce a set of encoded data slices.
9. The method of claim 7 , wherein the generating the masked key comprises:
performing a deterministic function on the encrypted data to produce transformed data; and
performing a masking function on the master key using the transformed data to produce the masked key.
10. The method of claim 7 further comprises:
for another data segment of the plurality of data segments:
dividing the other data segment into a second set of data sub-segments;
generating a second set of sub keys for the second set of data sub-segments based on the master key;
encrypting the second set of data sub-segments using the second set of sub keys to produce a second set of encrypted data sub-segments;
aggregating the second set of encrypted data sub-segments into second encrypted data;
generating a second masked key based on the second encrypted data and the master key; and
combining the second encrypted data and the second masked key to produce a second encrypted data segment.
11. The method of claim 7 further comprises:
obtaining a first master key for a first data segment of the plurality of data segments; and
obtaining a second master key for a second data segment of the plurality of data segments.
12. A method for execution by a processing system including a processor and a memory, and wherein the method comprises:
segmenting, via the processing system, a data partition into a plurality of data segments; and
for a data segment of the plurality of data segments:
dividing, via the processing system, the data segment into a set of data sub-segments;
generating, via the processing system, a set of sub keys for the set of data sub-segments based on a master key;
encrypting, via the processing system, the set of data sub-segments using the set of sub keys to produce a set of encrypted data sub-segments;
aggregating, via the processing system, the set of encrypted data sub-segments into encrypted data;
generating, via the processing system, a masked key based on the encrypted data and the master key; and
combining, via the processing system, the encrypted data and the masked key to produce an encrypted data segment, wherein encryption of the data partition includes encrypted data segments for the each of the at least some of the data segments, wherein the combining the encrypted data and the masked key includes at least one of: interleaving the masked key with the encrypted data to produce the encrypted data segment; appending the masked key to the encrypted data to produce the encrypted data segment; or distributing, in accordance with a pattern, portions of the masked key within the encrypted data to produce the encrypted data segment;
for another data segment of the plurality of data segments:
dividing the other data segment into a second set of data sub-segments;
generating a second set of sub keys for the second set of data sub-segments based on the master key;
encrypting the second set of data sub-segments using the second set of sub keys to produce a second set of encrypted data sub-segments;
aggregating the second set of encrypted data sub-segments into second encrypted data;
generating a second masked key based on the second encrypted data and the master key; and
combining the second encrypted data and the second masked key to produce a second encrypted data segment;
generating a first slice group from a first encrypted data sub-segment of the encrypted data segment and a first encrypted data sub-segment of the second encrypted data segment; and
generating a second slice group from a second encrypted data sub-segment of the encrypted data segment and a second encrypted data sub-segment of the second encrypted data segment.
13. The method of claim 12 , further comprises:
dividing the data segment into the set of data sub-segments based a decode threshold of a dispersed storage error encoding function; and
encoding the encrypted data segment in accordance with the dispersed storage error encoding function to produce a set of encoded data slices.
14. The method of claim 12 , wherein the generating the set of sub keys comprises:
generating a first sub key of the set of sub keys by performing a deterministic function on the master key and a descriptor of a first data sub-segment of the set of data sub-segments; and
generating a second sub key of the set of sub keys by performing the deterministic function on the master key and a descriptor of a second data sub-segment of the set of data sub-segments.
15. The method of claim 12 , wherein the generating the set of sub keys comprises:
generating a first sub key of the set of sub keys by performing at least one of a mathematical function and a logical function on the master key, a descriptor of a first data sub-segment of the set of data sub-segments, and a first shared secret; and
generating a second sub key of the set of sub keys by performing at least one of the mathematical function and the logical function on the master key, a descriptor of a second data sub-segment of the set of data sub-segments, and a second shared secret.
16. The method of claim 12 , wherein the generating the masked key comprises:
performing a deterministic function on the encrypted data to produce transformed data; and
performing a masking function on the master key using the transformed data to produce the masked key.