SECURE SHARED VAULT WITH ENCRYPTED PRIVATE INDICES

1 . A method comprising:

receiving a store-data-object request from a requesting device, the store-data-object request including a data object and a data identifier;

storing the data object in a shared vault at a shared-vault-data-object address; and

updating an entry in a private index using a private credential associated with the requesting device, the private index includes private information identifying a storage location of the data object in a non-private shared vault, and the entry in the private index includes the data identifier.

2 . The method of claim 1 , wherein updating the entry in a private index includes:

accessing the private index using the private credential.

3 . The method of claim 1 , wherein updating the entry in a private index includes:

retrieving encoded data slices from the shared vault;

decoding the encoded data slices to recover an index node;

updating an index node to generate an updated index node;

encoding the updated index node to produce updated slices; and

storing information associated with the updated slices in the private index.

4 . The method of claim 1 , further comprising:

deriving a source name of a root index node by applying a deterministic function to the private credential.

5 . The method of claim 1 , further comprising:

choosing names of intermediate index nodes and leaf nodes to include a random component.

6 . The method of claim 1 , further comprising:

deriving names of intermediate index nodes and leaf nodes from the private credential.

7 . The method of claim 1 , further comprising:

receiving a retrieve data request including the data identifier;

extracting a shared-vault-data-object address associated with the data identifier from the private index using the private credential; and

recovering the data object from the shared vault using the shared-vault-data-object address.

8 . A distributed storage (DS) processing module comprising:

a processor;

memory coupled to the processor;

at least one network interface coupled to a requesting device and a distributed storage network (DSN) memory;

the processor configured to:

receive, via the at least one network interface, a store-data-object request from a requesting device, the store-data-object request including a data object and a data identifier;

store the data object in a shared vault at a shared-vault-data-object address, the shared vault included in the DSN memory; and

update an entry in a private index using a private credential associated with the requesting device, the entry in the private index includes the data identifier, wherein the private index is maintained in a DSN memory and includes private information identifying a storage location of the data object in a non-private shared vault.

9 . The distributed storage (DS) processing module of claim 8 , wherein the processor is further configured to:

update the entry in a private index by accessing the private index using the private credential.

10 . The distributed storage (DS) processing module of claim 8 , wherein:

the processor is configured to update the entry in a private index by:

retrieving encoded data slices from the shared vault;

decoding the encoded data slices to recover an index node;

updating an index node to generate an updated index node;

encoding the updated index node to produce updated slices; and

storing information associated with the updated slices in the private index.

11 . The distributed storage (DS) processing module of claim 8 , wherein the processor is further configured to:

derive a source name of a root index node by applying a deterministic function to the private credential.

12 . The distributed storage (DS) processing module of claim 8 , wherein the processor is further configured to:

choose names of intermediate index nodes and leaf nodes to include a random component.

13 . The distributed storage (DS) processing module of claim 8 , wherein the processor is further configured to:

derive names of intermediate index nodes and leaf nodes from the private credential.

14 . The distributed storage (DS) processing module of claim 8 , wherein the processor is further configured to:

receive a read data request including the data identifier from the requesting device;

extract a shared-vault-data-object address associated with the data identifier from the private index using the private credential; and

recover the data object from the shared vault using the shared-vault-data-object address.

15 . A distributed storage network (DSN) comprising:

a DSN memory including a processor and associated memory, the DSN memory configured to maintain a shared vault and an index vault;

the shared vault configured to provide shared storage for a plurality of different requesting devices;

the index vault configured to store a plurality of private indexes associated with the plurality of requesting device, wherein each private index includes private information identifying a storage location of data objects stored in the shared vault;

a distributed storage (DS) processing module coupled to the DSN memory, and including a second processor and associated memory, the DS processing module configured to:

receive a store-data-object request from a requesting device, the store-data-object request including a data object and a data identifier;

store the data object in a shared vault at a shared-vault-data-object address, the shared vault included in the DSN memory; and

update an entry in a private index using a private credential associated with the requesting device, the entry in the private index includes the data identifier.

16 . The distributed storage network (DSN) of claim 15 , wherein the DS processing module is further configured to:

update the entry in a private index by accessing the private index using the private credential.

17 . The distributed storage network (DSN) of claim 15 , wherein the DS processing module is further configured to:

retrieve encoded data slices from the shared vault;

decode the encoded data slices to recover an index node;

update an index node to generate an updated index node;

encode the updated index node to produce updated slices; and

store information associated with the updated slices in the private index.

18 . The distributed storage network (DSN) of claim 15 , wherein the DS processing module is further configured to:

derive a source name of a root index node by applying a deterministic function to the private credential; and

choose names of intermediate index nodes and leaf nodes to include a random component.

19 . The distributed storage network (DSN) of claim 15 , wherein the DS processing module is further configured to:

derive names of intermediate index nodes and leaf nodes from the private credential.

20 . The distributed storage network (DSN) of claim 15 , wherein the DS processing module is further configured to:

receive a read data request including the data identifier from the requesting device;

extract a shared-vault-data-object address associated with the data identifier from the private index using the private credential; and

recover the data object from the shared vault using the shared-vault-data-object address.