Dispersed storage network secure hierarchical file directory
View Patent ↗A method includes creating a file directory entry in a directory file of a secure hierarchical file directory system for a file. The file directory entry includes a path name, an encryption access control list, and a source name. The file is encrypted with a key and the key is encrypted with each public key of user devices authorized to access the file. The encryption access control list includes identities of the set of user devices and the set of object content keys. The method further includes encrypting the directory file using a second key. The method further includes generating second object content keys based on the second key and public keys of second user devices authorized to access the directory file. The method further includes creating a next level directory file entry in a next higher directory file of the secure hierarchical file directory system for the directory file.
1. A method for execution by a processing module to generate a secure hierarchical file directory system, the method comprises:
creating a file directory entry in a directory file of the secure hierarchical file directory system for a file, wherein the file directory entry includes a path name for the file, an encryption access control list, and a source name of the file, wherein the file is encrypted with a key, wherein the key is encrypted with each public key of a set of user devices that is authorized to access the file to produce a set of object content keys, and wherein the encryption access control list includes identities of the set of user devices and the set of object content keys;
encrypting the directory file using a second key to produce an encrypted directory file;
generating a second set of object content keys based on the second key and public keys of a second set of user devices authorized to access the directory file; and
creating a next level directory file entry in a next higher directory file of the secure hierarchical file directory system for the directory file, wherein the next level file directory entry includes a next level path name for the file directory, a second encryption access control list, and a second source name of the file directory, and wherein the second encryption access control list includes the second set of object content keys and identities of the second set of user devices, wherein the second set of user devices includes the first set of user devices.
2. The method of claim 1 further comprises:
dispersed storage error encoding the encrypted file to produce a plurality of sets of encoded data slices;
generating a plurality of sets of slice names for the plurality of sets of encoded data slices based on the source name of the file; and
sending, based on the plurality of sets of slice names, the plurality of sets of encoded data slices to storage units for storage therein.
3. The method of claim 1 further comprises:
dispersed storage error encoding the encrypted directory file to produce a set of encoded data slices;
generating a sets of slice names for the set of encoded data slices based on the source name of the directory file; and
sending, based on the set of slice names, the set of encoded data slices to storage units for storage therein.
4. The method of claim 1 further comprises:
encrypting the next level directory file using a third key to produce a second encrypted directory file;
generating a third set of object content keys based on the third key and public keys of a third set of user devices authorized to access the next level directory file; and
creating a subsequent next level directory file entry in a subsequent next higher directory file of the secure hierarchical file directory system for the next level directory file, wherein the subsequent next level file directory entry includes a subsequent next level path name for the next level file directory, a third encryption access control list, and a third source name of the next level file directory, and wherein the third encryption access control list includes identities of the third set of user devices and the third set of object content keys, wherein the third set of user devices includes the second set of user devices.
5. A dispersed storage (DS) module comprises:
a processing system including a processing module and a memory, wherein the processing system is configured to:
create a file directory entry in a directory file of the secure hierarchical file directory system for a file, wherein the file directory entry includes a path name for the file, an encryption access control list, and a source name of the file, wherein the file is encrypted with a key, wherein the key is encrypted with each public key of a set of user devices that is authorized to access the file to produce a set of object content keys, and wherein the encryption access control list includes identities of the set of user devices and the set of object content keys;
encrypt the directory file using a second key to produce an encrypted directory file;
generate a second set of object content keys based on the second key and public keys of a second set of user devices authorized to access the directory file; and
create a next level directory file entry in a next higher directory file of the secure hierarchical file directory system for the directory file, wherein the next level file directory entry includes a next level path name for the file directory, a second encryption access control list, and a second source name of the file directory, and wherein the second encryption access control list includes the second set of object content keys and identities of the second set of user devices, wherein the second set of user devices includes the first set of user devices.
6. The DS module of claim 5 , wherein the processing system functions to:
dispersed storage error encode the encrypted file to produce a plurality of sets of encoded data slices;
generate a plurality of sets of slice names for the plurality of sets of encoded data slices based on the source name of the file; and
send, based on the plurality of sets of slice names, the plurality of sets of encoded data slices to storage units for storage therein.
7. The DS module of claim 5 , wherein the processing system functions to:
dispersed storage error encode the encrypted directory file to produce a set of encoded data slices;
generate a sets of slice names for the set of encoded data slices based on the source name of the directory file; and
send, based on the set of slice names, the set of encoded data slices to storage units for storage therein.
8. The DS module of claim 5 wherein the processing system is further configured to:
encrypt the next level directory file using a third key to produce a second encrypted directory file;
generate a third set of object content keys based on the third key and public keys of a third set of user devices authorized to access the next level directory file; and
create a subsequent next level directory file entry in a subsequent next higher directory file of the secure hierarchical file directory system for the next level directory file, wherein the subsequent next level file directory entry includes a subsequent next level path name for the next level file directory, a third encryption access control list, and a third source name of the next level file directory, and wherein the third encryption access control list includes identities of the third set of user devices and the third set of object content keys, wherein the third set of user devices includes the second set of user devices.