IP Library Granted Patent US 10,613,776
Granted Patent B2
US 10,613,776 · App. 16/193,064 · Granted Apr 7, 2020

Appyling multiple hash functions to generate multiple masked keys in a secure slice implementation

Inventor: Jason K. Resch (Chicago, IL)
Assignee: PURE STORAGE, INC.
G06F3/0619G06F3/064G06F3/0608G06F3/0611G06F3/0616G06F3/0623G06F3/0644G06F3/0647G06F3/0652G06F3/0653G06F3/0659G06F3/0661G06F12/0813G06F12/0888G06F12/1408G06F16/182G06F16/2246H04L43/0888G06F3/0604G06F3/067G06F3/0631G06F3/0665G06F11/1076G06F11/1092G06F12/0684G06F2212/154G06F2212/263H03M13/1515H03M13/3761H04L43/0852H04L43/0876H04L43/16H04L67/1097
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,613,776
App. No.
16/193,064
Granted
Apr 7, 2020
Kind
B2
Abstract

Methods and apparatus for efficiently storing and accessing secure data are disclosed. The method of storing includes encrypting data utilizing an encryption key to produce encrypted data, performing deterministic functions on the encrypted data to produce deterministic function values, masking the encryption key utilizing the deterministic function values to produce masked keys and combining the encrypted data and the masked keys to produce a secure package. The method of accessing includes de-combining a secure package to reproduce encrypted data and masked keys, selecting a deterministic function, performing the selected deterministic function on the reproduced encrypted data to reproduce a deterministic function value, de-masking a corresponding masked key utilizing the reproduced deterministic function value to reproduce an encryption key, and decrypting the reproduced encrypted data utilizing the reproduced encryption key to reproduce data.

Claims (39)

1. A method for execution by one or more processing modules of one or more computing devices of a dispersed storage network (DSN), the DSN including a plurality of storage units, the method comprising:

encrypting data utilizing an encryption key to produce encrypted data;

performing a plurality of deterministic functions on the encrypted data to produce a plurality of deterministic function values;

masking the encryption key utilizing the plurality of deterministic function values to produce a plurality of masked keys;

combining the encrypted data and the plurality of masked keys to produce a secure package;

dispersed storage error encoding the secure package;

sending the dispersed storage error encoded secure package to the plurality of storage units for dispersed storage;

receiving, by a computing device of the DSN, the secure package from the plurality of storage units;

de-combining the secure package to reproduce the encrypted data and the plurality of masked keys;

selecting a selected deterministic function of the plurality of deterministic functions based on one or more characteristics of the plurality of deterministic functions;

performing the selected deterministic function on the encrypted data to reproduce a deterministic function value of the plurality of deterministic function values;

de-masking a masked key of the plurality of masked keys corresponding to the selected deterministic function using the reproduced deterministic function value to produce an encryption key; and

decrypting the encrypted data utilizing the encryption key to produce reproduced data.

2. The method of claim 1 , wherein each of the plurality of deterministic function values includes a first number of bits that is the same as a second number of bits of the encryption key.

3. The method of claim 1 , wherein masking the encryption key utilizing the plurality of deterministic function values includes performing an exclusive OR function on the encryption key and the plurality of deterministic function values.

4. The method of claim 1 , wherein combining the encrypted data and the plurality of masked keys to produce a secure package includes appending each of the plurality of masked keys to the encrypted data.

5. The method of claim 1 , wherein de-combining the secure package to reproduce the encrypted data and the plurality of masked keys includes de-appending the plurality of masked keys from the encrypted data.

6. The method of claim 1 , wherein the one or more characteristics of the plurality of deterministic functions includes speed of execution.

7. The method of claim 1 , wherein the one or more characteristics of the plurality of deterministic functions includes processing efficiency of operation.

8. The method of claim 1 , wherein the step of de-masking the masked key of the plurality of masked keys corresponding to the selected deterministic function of the plurality of deterministic functions using the deterministic function value to produce the encryption key includes performing an exclusive OR function on the masked key of the plurality of masked keys corresponding to the selected deterministic function of the plurality of deterministic functions utilizing the deterministic function value.

9. The method of claim 1 , further comprising the step of dispersed storage error decoding the dispersed storage error encoded secure package to reproduce the secure package.

10. A computer readable storage medium comprises:

at least one memory section that stores operational instructions that, when executed by one or more processing modules of one or more computing devices of a dispersed storage network (DSN), causes the one or more computing devices to:

encrypt data utilizing an encryption key to produce encrypted data;

perform a plurality of deterministic functions on the encrypted data to produce a plurality of deterministic function values;

mask the encryption key utilizing the plurality of deterministic function values to produce a plurality of masked keys;

combine the encrypted data and the plurality of masked keys to produce a secure package;

dispersed storage error encode the secure package;

send the dispersed storage error encoded secure package to a plurality of storage units for dispersed storage;

receive the secure package from the plurality of storage units;

de-combine the secure package to reproduce the encrypted data and the plurality of masked keys;

select a selected deterministic function of the plurality of deterministic functions based on one or more characteristics of the plurality of deterministic functions;

perform the selected deterministic function on the encrypted data to reproduce a deterministic function value of the plurality of deterministic function values;

de-mask a masked key of the plurality of masked keys corresponding to the selected deterministic function using the reproduced deterministic function value to produce an encryption key; and

decrypt the encrypted data utilizing the encryption key to produce reproduced data.

11. The computer readable storage medium of claim 10 , wherein each of the plurality of deterministic function values includes a first number of bits that is the same as a second number of bits of the encryption key.

12. The computer readable storage medium of claim 10 , wherein masking the encryption key utilizing the plurality of deterministic function values includes performing an exclusive OR function on the encryption key and the plurality of deterministic function values.

13. The computer readable storage medium of claim 10 , wherein combining the encrypted data and the plurality of masked keys to produce a secure package includes appending each of the plurality of masked keys to the encrypted data.

14. The computer readable storage medium of claim 10 comprising further operational instructions that, when executed by the one or more processing modules, causes the one or more computing devices of the DSN to send the dispersed storage error encoded secure package to a plurality of storage units for dispersed storage.

Assignments (4)
TERMINATION AND RELEASE OF SECURITY INTEREST IN PATENT RIGHTS Recorded Jun 11, 2025
From: BARCLAYS BANK PLC, AS ADMINISTRATIVE AGENT
To: PURE STORAGE, INC.
Reel/Frame 071558/0523 →
SECURITY INTEREST Recorded Aug 26, 2020
From: PURE STORAGE, INC.
To: BARCLAYS BANK PLC AS ADMINISTRATIVE AGENT
Reel/Frame 053867/0581 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Sep 20, 2019
From: INTERNATIONAL BUSINESS MACHINES CORPORATION
To: PURE STORAGE, INC.
Reel/Frame 050451/0549 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Nov 16, 2018
From: RESCH, JASON K.
To: INTERNATIONAL BUSINESS MACHINES CORPORATION
Reel/Frame 047523/0901 →