Cryptographic key storage in a dispersed storage network

1. A method for execution by one or more processing modules of a storage unit of a dispersed storage network (DSN), the storage unit including a local key, the method comprises:

receiving a slice access request from a requesting entity;

identifying the type of the slice access request as a key slice access request, wherein the key slice access request includes at least one of a request to store a key slice or a request to recover a key slice for rebuilding;

in response to determining that the key slice access request includes a request to store a key slice received in conjunction with the key slice access request:

encrypting the key slice using the local key of the storage unit to produce an encrypted key slice; and

storing the encrypted key slice in a memory of the storage unit; and

in response to determining that the key slice access request includes a request to recover a key slice for rebuilding, wherein the key slice is stored as an encrypted key slice in a memory of the storage unit:

recovering the encrypted key slice from the memory of the storage unit;

decrypting the encrypted key slice using the local key of the storage unit to produce a decrypted key slice; and

encoding the decrypted key slice in accordance with a zero information gain (ZIG) format to generate a ZIG representation of the decrypted key slice for provision to the requesting entity.

2. The method of claim 1 , wherein the key slice access request includes at least one of a request to store a key slice, a request to recover a key slice, or a request to recover a key slice for rebuilding, the method further comprises:

in response to determining that the key slice access request includes a request to recover a key slice, wherein the key slice is stored as an encrypted key slice in a memory of the storage unit:

recovering the encrypted key slice from the memory of the storage unit; and

decrypting the encrypted key slice using the local key of the storage unit to produce a decrypted key slice.

3. The method of claim 1 , wherein encoding the decrypted key slice in accordance with a zero information gain (ZIG) format to generate a ZIG representation of the decrypted key slice comprises:

obtaining an encoding matrix utilized to generate a related key slice to be recovered;

generating a decoding matrix based on the encoding matrix;

matrix multiplying the decoding matrix by the decrypted key slice to produce a vector; and

matrix multiplying the vector by a row of the encoding matrix corresponding to the related key slice to be recovered to produce the ZIG representation of the decrypted key slice.

4. The method of claim 3 , wherein the generating the decoding matrix comprises:

reducing the encoding matrix to produce a square matrix that exclusively includes rows associated with a selected decode threshold number of related key slices; and

inverting the square matrix to produce the decoding matrix.

5. The method of claim 1 , wherein identifying the type of the slice access request as a key slice access request includes at least one of:

matching a slice name to a slice name range of a set of slice name ranges and associated types;

extracting an indicator from the slice access request; or

inferring the type of the slice access request based on the identity of the requesting entity.

6. The method of claim 1 , wherein the key slice is one of a set of key slices 1-n generated by encoding a key using a dispersed storage error encoding function, and wherein the key can be recreated from a decode threshold number of key slices of the set of key slices 1-n.

7. The method of claim 1 , wherein the key slice is stored in a portion of the memory of the storage unit that is configured as part of a key region of a vault having a designated addressing namespace within the DSN.

8. The method of claim 1 , wherein the local key of the storage unit is a key of a set of related keys stored in respective storage units of a set of storage units of the DSN.

9. A method for execution by one or more processing modules of a storage unit of a dispersed storage network (DSN), the storage unit including a local key, the method comprises:

receiving a slice access request;

determining that the type of the slice access request includes a request to store a key slice;

receiving the key slice for storage, wherein the key slice is one of a set of key slices 1-n generated by encoding a key using a dispersed storage error encoding function, and wherein the key can be recreated from a decode threshold number of key slices of the set of key slices 1-n;

encrypting the key slice using the local key of the storage unit to produce an encrypted key slice;

storing the encrypted key slice in a memory of the storage unit;

receiving a second slice access request;

in response to the second slice access request, recovering the encrypted key slice from the memory of the storage unit;

decrypting the encrypted key slice using the local key of the storage unit to produce a decrypted key slice; and

encoding the decrypted key slice with a zero information gain (ZIG) format to generate a ZIG representation of the decrypted key slice.

10. The method of claim 9 , wherein determining that the type of the slice access request includes a request to store a key slice includes at least one of:

matching a slice name to a slice name range of a set of slice name ranges and associated types;

extracting an indicator from the slice access request; or

inferring the type of the slice access request based on an identity of a requesting entity.

11. The method of claim 9 , wherein the key slice is included in the slice access request.

12. The method of claim 9 , wherein storing the encrypted key slice in a memory of the storage unit includes storing the encrypted key slice in a portion of the memory that is configured as part of a key region of a vault having a designated addressing namespace with the DSN.

13. The method of claim 9 , wherein the local key of the storage unit is a key of a set of related keys stored in respective storage units of a set of storage units of the DSN.

14. The method of claim 9 further comprises:

determining that the type of the second slice access request includes a request to recover a key slice for rebuilding.

15. A storage unit of a dispersed storage network (DSN), the storage unit comprises:

a network interface;

a local memory, the local memory including a local key;

a memory device; and

a processing module operably coupled to the network interface, the local memory, and the memory device, wherein the processing module is configured to:

receive, via the network interface, a slice access request from a requesting entity;

identify the type of the slice access request as a key slice access request, wherein the key slice access request includes at least one of a request to store a key slice or a request to recover a key slice for rebuilding;

in response to determining that the key slice access request includes a request to store a key slice received in conjunction with the key slice access request:

encrypt the key slice using the local key to produce an encrypted key slice; and

store the encrypted key slice in the memory device; and

in response to determining that the key slice access request includes a request to recover a key slice for rebuilding, the key slice stored as an encrypted key slice in the memory device:

recover the encrypted key slice from the memory device;

decrypt the encrypted key slice using the local key to produce a decrypted key slice; and

encode the decrypted key slice in accordance with a zero information gain (ZIG) format to generate a ZIG representation of the decrypted key slice for provision to the requesting entity.

16. The storage unit of claim 15 , wherein the key slice access request includes at least one of a request to store a key slice, a request to recover a key slice, or a request to recover a key slice for rebuilding, and wherein the processing module is further configured to:

in response to determining that the key slice access request includes a request to recover a key slice, wherein the key slice is stored as an encrypted key slice in the memory device:

recover the encrypted key slice from the memory device; and

decrypt the encrypted key slice using the local key to produce a decrypted key slice.

17. The storage unit of claim 15 , wherein identifying the type of the slice access request as a key slice access request includes at least one of:

matching a slice name to a slice name range of a set of slice name ranges and associated types;

extracting an indicator from the slice access request; or

inferring the type of the slice access request based on the identity of the requesting entity.

18. The storage unit of claim 15 , wherein the key slice is one of a set of key slices 1-n generated by encoding a key using a dispersed storage error encoding function, and wherein the key can be recreated from a decode threshold number of key slices of the set of key slices 1-n.

19. The storage unit of claim 15 , wherein the key slice is stored in a portion of the memory device that is configured as part of a key region of a vault having a designated addressing namespace within the DSN.

20. The storage unit of claim 15 , wherein the local key is a key of a set of related keys stored in respective storage units of a set of storage units of the DSN.