IP Library › Granted Patent US 10,055,283

Granted Patent B2

US 10,055,283 · App. 15/799,943 · Granted Aug 21, 2018

Securely distributing random keys in a dispersed storage network

Inventors: Gary W. Grube (Barrington Hills, IL); Timothy W. Markison (Mesa, AZ)

Assignee: INTERNATIONAL BUSINESS MACHINES CORPORATION

G06F11/1004 G06F12/1408 H04L9/14 H04L9/3239 H04L9/3263 H04L63/061 H04L67/1097 H04L67/306 G06F2212/1052 H04L63/0428

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 10,055,283
App. No.: 15/799,943
Granted: Aug 21, 2018
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

A method includes encrypting first data segment using first encryption key (EK 1 ) to produce first encrypted data segment (DS), appending the first encrypted DS with EK 2 to produce first encrypted appended DS, and dispersed error encoding the first encrypted appended DS to produce first set of error encoded data slices (EDSs). The method further includes encrypting EK 1 using EK 2 to produce EK layer 1 , encrypting second DS using EK 3 to produce second encrypted DS, appending the second encrypted DS with EK 4 to produce second encrypted appended DS, dispersed error encoding the second encrypted appended DS to produce second set of EDSs, appending EK 3 with EK layer 1 to produce appended EK layer 1 , encrypting appended EK layer 1 using EK 4 to produce EK layer 2 , generating EK layer-final in accordance with an EK layering scheme and EK layer 2 , and dispersed error encoding EK layer-final to produce set of error encoded layered key slices.

Claims (120)

1. A method comprises:

encrypting, by a computing device of a dispersed storage network (DSN), a first data segment of a data object using a first encryption key to produce a first encrypted data segment;

appending, by the computing device, the first encrypted data segment with a second encryption key to produce a first encrypted appended data segment;

dispersed storage error encoding, by the computing device, the first encrypted appended data segment to produce a first set of error encoded data slices;

encrypting, by the computing device, the first encryption key using the second encryption key to produce a first encryption key layer;

encrypting, by the computing device, a second data segment of the data object using a third encryption key to produce a second encrypted data segment;

appending, by the computing device, the second encrypted data segment with a fourth encryption key to produce a second encrypted appended data segment;

dispersed storage error encoding, by the computing device, the second encrypted appended data segment to produce a second set of error encoded data slices;

appending, by the computing device, the third encryption key with the first encryption key layer to produce a first appended encryption key layer;

encrypting, by the computing device, the first appended encryption key layer using the fourth encryption key to produce a second encryption key layer;

generating, by the computing device, a final encryption key layer in accordance with an encryption key layering scheme and the second encryption key layer; and

dispersed storage error encoding, by the computing device, the final encryption key layer to produce a set of error encoded encryption key layer slices.

2. The method of claim 1 further comprises:

sending, by the computing device, the first and second sets of error encoded data slices to a set of storage devices of the DSN for storage therein.

3. The method of claim 2 further comprises:

sending, by the computing device, the set of error encoded layer key slices to the set of storage devices for storage therein.

4. The method of claim 1 , wherein the encryption key layering scheme comprises:

obtaining, by the computing device, an encryption key pair for a current data segment of the data object;

appending, by the computing device, a first key of the encryption key pair to a previous encryption key layer to produce an appended previous encryption key layer; and

encrypting, by the computing device, the appended previous encryption key layer using a second key of the encryption key pair to produce a current encryption key layer.

5. The method of claim 1 further comprises:

encrypting, by the computing device, a third data segment of the data object using a fifth encryption key to produce a third encrypted data segment;

appending, by the computing device, the third encrypted data segment with a sixth encryption key to produce a third encrypted appended data segment;

dispersed storage error encoding, by the computing device, the third encrypted appended data segment to produce a third set of error encoded data slices;

appending, by the computing device, the fifth encryption key with the second encryption key layer to produce a third appended encryption key layer; and

encrypting, by the computing device, the third appended encryption key layer using the sixth encryption key to produce a third encryption key layer.

6. The method of claim 1 further comprises:

dispersed storage error decoding, by the computing device, the set of error encoded encryption key layer slices to produce the final encryption key layer;

generating, by the computing device, the second encryption key layer in accordance with the encryption key layering scheme and the final encryption key layer;

dispersed storage error decoding, by the computing device, the second set of error encoded data slices to produce the second encrypted appended data segment;

splitting, by the computing device, the fourth encryption key from the second encrypted appended data segment to produce the second encrypted data segment;

decrypting, by the computing device, the second encryption key layer using the fourth encryption key to produce the first appended encryption key layer;

splitting, by the computing device, the third encryption key from the first appended encryption key layer to produce the first encryption key layer;

decrypting, by the computing device, the second encrypted data segment using the third encryption key to produce the second data segment of the data object;

dispersed error decoding, by the computing device, the first set of error encoded data slices to produce the first encrypted appended data segment;

splitting, by the computing device, the first encrypted appended data segment from the second encryption key to produce the first encrypted data segment;

decrypting, by the computing device, the first encryption key layer using the second encryption key to produce the first encryption key; and

decrypting, by the computing device, the first encrypted data segment using the first encryption key to produce the first data segment of the data object.

7. A computing device of a dispersed storage network (DSN), the computing device comprises:

an interface;

memory; and

a processing module operably coupled to the memory and the interface, wherein the processing module is configured to:

encrypt a first data segment of a data object using a first encryption key to produce a first encrypted data segment;

append the first encrypted data segment with a second encryption key to produce a first encrypted appended data segment;

dispersed storage error encode the first encrypted appended data segment to produce a first set of error encoded data slices;

encrypt the first encryption key using the second encryption key to produce a first encryption key layer;

encrypt a second data segment of the data object using a third encryption key to produce a second encrypted data segment;

append the second encrypted data segment with a fourth encryption key to produce a second encrypted appended data segment;

dispersed storage error encode the second encrypted appended data segment to produce a second set of error encoded data slices;

append the third encryption key with the first encryption key layer to produce a first appended encryption key layer;

encrypt the first appended encryption key layer using the fourth encryption key to produce a second encryption key layer;

generate a final encryption key layer in accordance with an encryption key layering scheme and the second encryption key layer; and

dispersed storage error encode the final encryption key layer to produce a set of error encoded encryption key layer slices.

8. The computing device of claim 7 , wherein the processing module is further configured to:

send the first and second sets of error encoded data slices to a set of storage devices of the DSN for storage therein.

9. The computing device of claim 8 , wherein the processing module is further configured to:

send the set of error encoded layer key slices to the set of storage devices for storage therein.

10. The computing device of claim 7 , wherein the processing module is further configured to:

generate the encryption key layering scheme by:

obtaining an encryption key pair for a current data segment of the data object;

appending a first key of the encryption key pair to a previous encryption key layer to produce an appended previous encryption key layer; and

encrypting the appended previous encryption key layer using a second key of the encryption key pair to produce a current encryption key layer.

11. The computing device of claim 7 , wherein the processing module is further configured to:

encrypt a third data segment of the data object using a fifth encryption key to produce a third encrypted data segment;

append the third encrypted data segment with a sixth encryption key to produce a third encrypted appended data segment;

dispersed storage error encode the third encrypted appended data segment to produce a third set of error encoded data slices;

append the fifth encryption key with the second encryption key layer to produce a third appended encryption key layer; and

encrypt the third appended encryption key layer using the sixth encryption key to produce a third encryption key layer.

12. The computing device of claim 7 , wherein the processing module is further configured to:

dispersed storage error decode the set of error encoded encryption key layer slices to produce the final encryption key layer;

generate the second encryption key layer in accordance with the encryption key layering scheme and the final encryption key layer;

dispersed storage error decode the second set of error encoded data slices to produce the second encrypted appended data segment;

split the fourth encryption key from the second encrypted appended data segment to produce the second encrypted data segment;

decrypt the second encryption key layer using the fourth encryption key to produce the first appended encryption key layer;

split the third encryption key from the first appended encryption key layer to produce the first encryption key layer;

decrypt the second encrypted data segment using the third encryption key to produce the second data segment of the data object;

dispersed error decode the first set of error encoded data slices to produce the first encrypted appended data segment;

split the first encrypted appended data segment from the second encryption key to produce the first encrypted data segment;

decrypt the first encryption key layer using the second encryption key to produce the first encryption key; and

decrypt the first encrypted data segment using the first encryption key to produce the first data segment of the data object.

13. A computer readable memory comprises:

a first memory element that stores operational instructions that, when executed by a computing device of a dispersed storage network (DSN), causes the computing device to: