End-to-end secure data storage in a dispersed storage network
A method includes a first computing device encrypting a portion of a data matrix based on a set of encryption keys to produce an encrypted data matrix. The method further includes the first computing device sending the encrypted data matrix to a second computing device. The method further includes the second computing device dispersed storage error encoding the data matrix to produce a set of encrypted encoded data slices. The method further includes the second computing device sending the set of encrypted encoded data slices to a set of storage units of the DSN for storage therein.
1. A method comprises:
encrypting, by a first computing device of a dispersed storage network (DSN), a portion of a data matrix based on a set of encryption keys to produce an encrypted data matrix, wherein the data matrix includes data blocks of a data segment of a data object;
sending, by the first computing device, the encrypted data matrix to a second computing device of the DSN;
dispersed storage error encoding, by the second computing device, the encrypted data matrix to produce a set of encrypted encoded data slices; and
sending, by the second computing device, the set of encrypted encoded data slices to a set of storage units of the DSN for storage therein.
2. The method of claim 1 further comprises:
generating, by the first computing device, a set of temporary encryption keys as the set of encryption keys;
obtaining, by the set of storage units, the set of temporary encryption keys, wherein a first storage unit of the set of storage units obtains a first temporary encryption key of the set of temporary encryption keys;
decrypting, by the first storage unit, a first encrypted encoded data slice of the set of encrypted encoded data slices based on the first temporary encryption key to produce a first encoded data slice; and
storing, by the first storage unit, the first encoded data slice.
3. The method of claim 2 , wherein the decrypting the first encrypted encoded data slice comprises:
converting the first temporary encryption key into a first key stream; and
finite field subtracting the first key stream from the first encrypted encoded data slice to produce the first encoded data slice.
4. The method of claim 3 , wherein the finite field subtracting comprises:
exclusive ORing the first key stream with the first encrypted encoded data slice to produce the first encoded data slice.
5. The method of claim 1 , wherein the encrypting the portion of the data matrix comprises:
generating a first key stream from a first encryption key of the set of encryption keys; and
finite field adding the first key stream with a first row of the data matrix to produce a first encrypted data matrix row.
6. The method of claim 5 , wherein the finite field adding comprises:
exclusive ORing the first key stream with the first row of the data matrix to produce the first encrypted data matrix row.
7. The method of claim 1 further comprises:
generating the data matrix by:
determining a pillar width parameter, a decode threshold parameter, and an encoding function of the dispersed storage error encoding function; and
organizing the data blocks into a number of rows corresponding to the decode threshold parameter and a number of columns corresponding to a number of data blocks divided by the decode threshold parameter.
8. The method of claim 1 further comprises:
generating the portion by selecting a number of the data blocks of the data matrix as the portion.
9. The method of claim 1 further comprises:
generating, by the first computing device, the set of encryption keys.
10. A computer readable storage device comprises:
a first memory element that stores operational instructions, which, when executed by a first computing device of a dispersed storage network (DSN), causes the first computing device to:
encrypt a first portion of a data matrix based on the set of encryption keys to produce an encrypted data matrix, wherein the data matrix includes data blocks of a data segment of a data object;
send the encrypted data matrix to a second computing device of the DSN;
a second memory element that stores operational instructions, which, when executed by the second computing device, causes the second computing device to:
dispersed storage error encode the data matrix to produce a set of encrypted encoded data slices; and
send the set of encrypted encoded data slices to a set of storage units of the DSN for storage therein.
11. The computer readable storage device of claim 10 further comprises:
the first memory element further stores operational instructions, which, when executed by the first computing device, causes the first computing device to:
generate a set of temporary encryption keys as the set of encryption keys;
a third memory element that stores operational instructions, which, when executed by a storage unit of the set of storage units, causes the storage unit to:
obtain a temporary encryption key of the set of temporary encryption keys such that the set of storage units obtains the set of temporary encryption keys;
decrypt a corresponding encrypted encoded data slice of the set of encrypted encoded data slices based on the temporary encryption key to produce an encoded data slice; and
store the encoded data slice.
12. The computer readable storage device of claim 11 , wherein the third memory element stores further operational instructions which, when executed by the storage unit, causes the storage unit to decrypt the corresponding encrypted encoded data slice by:
converting the temporary encryption key into a key stream; and
finite field subtracting the key stream from the corresponding encrypted encoded data slice to produce the first encoded data slice.
13. The computer readable storage device of claim 12 , wherein the third memory element stores further operational instructions which, when executed by the storage unit, causes the storage unit to perform the finite field subtracting by:
exclusive ORing the key stream with the corresponding encrypted encoded data slice to produce the encoded data slice.
14. The computer readable storage device of claim 10 , wherein the first memory element further stores operational instructions, which, when executed by the first computing device, causes the first computing device to encrypt the data matrix by:
generating a first key stream from a first encryption key of the set of encryption keys; and
finite field adding the first key stream with a first row of the data matrix to produce a first encrypted data matrix row.
15. The computer readable storage device of claim 14 , wherein the first memory element further stores operational instructions, which, when executed by the first computing device, causes the first computing device to perform the finite field adding by:
exclusive ORing the first key stream with the first row of the data matrix to produce the first encrypted data matrix row.
16. The computer readable storage device of claim 10 , wherein the first memory element further stores operational instructions, which, when executed by the first computing device, causes the first computing device to generate the data matrix by:
determining a pillar width parameter, a decode threshold parameter, and an encoding function of the dispersed storage error encoding function; and
organizing the data blocks into a number of rows corresponding to the decode threshold parameter and a number of columns corresponding to a number of data blocks divided by the decode threshold parameter.
17. The computer readable storage device of claim 10 , wherein the first memory element further stores operational instructions, which, when executed by the first computing device, causes the first computing device to:
generate the portion by selecting a number of the data blocks of the data matrix as the portion.
18. The computer readable storage device of claim 10 , wherein the first memory element further stores operational instructions, which, when executed by the first computing device, causes the first computing device to:
generate the set of encryption keys.