Encoding and encrypting data in a storage network
A storage network operates by: receiving a encoded data slice for storage by the storage network, wherein the encoded data slice is associated with a vault; generating a encryption key corresponding to the encoded data slice based on a vault identifier associated with the vault; utilizing the encryption key to generate a encrypted data slice and that corresponds to, and is based on, the encoded data slice; storing the encrypted data slice in a storage unit of the storage network; receiving a request to retrieve the encoded data slice; retrieving the encrypted data slice corresponding to the encoded data slice from the storage unit of the storage network; generating a decryption key corresponding to the encoded data slice based on the vault identifier, wherein the decryption key is different from the encryption key; and regenerating the encoded data slice using the decryption key.
1. A method for execution by a processing system of a storage network that includes a processor, the method comprising:
receiving a first encoded data slice for storage by the storage network, wherein the first encoded data slice is associated with a first vault;
generating a first encryption key corresponding to the first encoded data slice based on a first vault identifier associated with the first vault;
utilizing the first encryption key to generate a first encrypted data slice and that corresponds to, and is based on, the first encoded data slice;
storing the first encrypted data slice in a first storage unit of the storage network;
receiving a request to retrieve the first encoded data slice;
retrieving the first encrypted data slice corresponding to the first encoded data slice from the first storage unit of the storage network;
generating a first decryption key corresponding to the first encoded data slice based on the first vault identifier, wherein the first decryption key is different from the first encryption key; and
regenerating the first encoded data slice using the first decryption key.
2. The method of claim 1 , further comprising:
receiving a second encoded data slice for storage by the storage network, wherein the second encoded data slice is associated with a second vault;
generating a second encryption key corresponding the second encoded data slice based on on a second vault identifier associated with the second vault;
generating a second encrypted data slice using the second encryption key; and
storing the second encrypted data slice in a second storage unit of the storage network.
3. The method of claim 2 , further comprising:
receiving a third encoded data slice for storage by the storage network, wherein the third encoded data slice is associated with the first vault;
generating a third encrypted data slice by utilizing the first encryption key; and
storing the third encrypted data slice in the first storage unit of the storage network.
4. The method of claim 2 , wherein the first encryption key is generated by performing a deterministic function on the first vault identifier.
5. The method of claim 4 , wherein the first encryption key is generated by performing the deterministic function further on a slice identifier of the first encoded data slice.
6. The method of claim 4 , wherein the second encryption key is generated by performing the deterministic function on the second vault identifier.
7. The method of claim 1 , further comprising:
re-encrypting the first encoded data slice with a new encryption key in response to a transfer of the first encoded data slice from the first storage unit to another storage unit.
8. A processing system of a storage network comprises:
an interface; and
processing circuitry, coupled to the interface, configured by operational instructions to perform operations that include:
receiving a first encoded data slice for storage by the storage network, wherein the first encoded data slice is associated with a first vault;
generating a first encryption key corresponding to the first encoded data slice based on a first vault identifier associated with the first vault;
utilizing the first encryption key to generate a first encrypted data slice and that corresponds to, and is based on, the first encoded data slice;
storing the first encrypted data slice in a first storage unit of the storage network;
receiving a request to retrieve the first encoded data slice;
retrieving the first encrypted data slice corresponding to the first encoded data slice from the first storage unit of the storage network;
generating a first decryption key corresponding to the first encoded data slice based on the first vault identifier, wherein the first decryption key is different from the first encryption key; and
regenerating the first encoded data slice using the first decryption key.
9. The processing system of claim 8 , wherein the operations further include:
receiving a second encoded data slice for storage by the storage network, wherein the second encoded data slice is associated with a second vault;
generating a second encryption key corresponding the second encoded data slice based on on a second vault identifier associated with the second vault;
generating a second encrypted data slice using the second encryption key; and
storing the second encrypted data slice in a second storage unit of the storage network.
10. The processing system of claim 9 , wherein the operations further include:
receiving a third encoded data slice for storage by the storage network, wherein the third encoded data slice is associated with the first vault;
generating a third encrypted data slice by utilizing the first encryption key; and
storing the third encrypted data slice in the first storage unit of the storage network.
11. The processing system of claim 9 , wherein the first encryption key is generated by performing a deterministic function in the first vault identifier.
12. The processing system of claim 11 , wherein the first encryption key is generated by performing the deterministic function further on a slice identifier of the first encoded data slice.
13. The processing system of claim 11 , wherein the second encryption key is generated by performing the deterministic function on the second vault identifier.
14. The processing system of claim 8 , wherein the operations further include:
re-encrypting the first encoded data slice with a new encryption key in response to a transfer of the first encoded data slice from the first storage unit to another storage unit.
15. A non-transitory computer readable storage medium comprises:
at least one memory that stores operational instructions that, when executed by a processing system of a storage network having a processor, causes the processing system to perform operations including:
receiving a first encoded data slice for storage by the storage network, wherein the first encoded data slice is associated with a first vault;
generating a first encryption key corresponding to the first encoded data slice based on a first vault identifier associated with the first vault;
utilizing the first encryption key to generate a first encrypted data slice and that corresponds to and is based on the first encoded data slice;
storing the first encrypted data slice in a first storage unit of the storage network;
receiving a request to retrieve the first encoded data slice;
retrieving the first encrypted data slice corresponding to the first encoded data slice from the first storage unit of the storage network;
generating a first decryption key corresponding to the first encoded data slice based on the first vault identifier, wherein the first decryption key is different from the first encryption key; and
regenerating the first encoded data slice using the first decryption key.
16. The non-transitory computer readable storage medium of claim 15 , wherein the operations further include:
receiving a second encoded data slice for storage by the storage network, wherein the second encoded data slice is associated with a second vault;
generating a second encryption key corresponding the second encoded data slice based on on a second vault identifier associated with the second vault;
generating a second encrypted data slice using the second encryption key; and
storing the second encrypted data slice in a second storage unit of the storage network.
17. The non-transitory computer readable storage medium of claim 16 , wherein the operations further include:
receiving a third encoded data slice for storage by the storage network, wherein the third encoded data slice is associated with the first vault;
generating a third encrypted data slice by utilizing the first encryption key; and
storing the third encrypted data slice in the first storage unit of the storage network.
18. The non-transitory computer readable storage medium of claim 16 , wherein the first encryption key is generated by performing a deterministic function on the first vault identifier.
19. The non-transitory computer readable storage medium of claim 18 , wherein the first encryption key is generated by performing the deterministic function further on a slice identifier of the first encoded data slice.
20. The non-transitory computer readable storage medium of claim 18 , wherein the second encryption key is generated by performing the deterministic function on the second vault identifier.