Encryption of Encoded Data in a Storage Network

1 . A method for execution by a processing system of a storage network that includes a processor, the method comprising:

receiving a first encoded data slice for storage by the storage network, wherein the first encoded data slice is associated with a first vault;

generating a first encryption key corresponding to the first encoded data slice associated with the first vault;

utilizing the first encryption key to generate a first encrypted data slice and that corresponds) to, and is based on, the first encoded data slice;

storing the first encrypted data slice in a first storage unit of the storage network;

receiving a request to retrieve the first encoded data slice;

retrieving the first encrypted data slice corresponding to the first encoded data slice from the first storage unit of the storage network;

generating a first decryption key corresponding to the first encoded data slice, wherein the first decryption key is different from the first encryption key; and

regenerating the first encoded data slice using the first decryption key.

2 . The method of claim 1 , further comprising:

receiving a second encoded data slice for storage by the storage network, wherein the second encoded data slice is associated with a second vault;

generating a second encryption key corresponding the second encoded data slice associated with the second vault;

generating a second encrypted data slice using the second encryption key; and

storing the second encrypted data slice in a second storage unit of the storage network.

3 . The method of claim 2 , further comprising:

receiving a third encoded data slice for storage by the storage network, wherein the third encoded data slice is associated with the first vault;

generating a third encrypted data slice by utilizing the first encryption key; and

storing the third encrypted data slice in the first storage unit of the storage network.

4 . The method of claim 2 , wherein the first encryption key is generated by performing a deterministic function on a first vault identifier.

5 . The method of claim 4 , wherein the first encryption key is generated by performing the deterministic function further on a slice identifier of the first encoded data slice.

6 . The method of claim 4 , wherein the second encryption key is generated by performing the deterministic function on a second vault identifier.

7 . The method of claim 1 , further comprising:

re-encrypting the first encoded data slice with a new encryption key in response to a transfer of the first encoded data slice from the first storage unit to another storage unit.

8 . A processing system of a storage network comprises:

an interface; and

processing circuitry, coupled to the interface, configured by operational instructions to perform operations that include:

receiving a first encoded data slice for storage by the storage network, wherein the first encoded data slice is associated with a first vault;

generating a first encryption key corresponding to the first encoded data slice associated with the first vault;

utilizing the first encryption key to generate a first encrypted data slice and that corresponds to, and is based on, the first encoded data slice;

storing the first encrypted data slice in a first storage unit of the storage network;

receiving a request to retrieve the first encoded data slice;

retrieving the first encrypted data slice corresponding to the first encoded data slice from the first storage unit of the storage network;

generating a first decryption key corresponding to the first encoded data slice, wherein the first decryption key is different from the first encryption key; and

regenerating the first encoded data slice using the first decryption key.

9 . The processing system of claim 8 , wherein the operations further include:

receiving a second encoded data slice for storage by the storage network, wherein the second encoded data slice is associated with a second vault;

generating a second encryption key corresponding the second encoded data associated with the second vault;

generating a second encrypted data slice using the second encryption key; and

storing the second encrypted data slice in a second storage unit of the storage network.

10 . The processing system of claim 9 , wherein the operations further include:

receiving a third encoded data slice for storage by the storage network, wherein the third encoded data slice is associated with the first vault;

generating a third encrypted data slice by utilizing the first encryption key; and

storing the third encrypted data slice in the first storage unit of the storage network.

11 . The processing system of claim 9 , wherein the first encryption key is generated by performing a deterministic function on a first vault identifier.

12 . The processing system of claim 11 , wherein the first encryption key is generated by performing the deterministic function further on a slice identifier of the first encoded data slice.

13 . The processing system of claim 11 , wherein the second encryption key is generated by performing the deterministic function on a second vault identifier.

14 . The processing system of claim 8 , wherein the operations further include:

re-encrypting the first encoded data slice with a new encryption key in response to a transfer of the first encoded data slice from the first storage unit to another storage unit.

15 . A non-transitory computer readable storage medium comprises:

at least one memory that stores operational instructions that, when executed by a processing system of a storage network having a processor, causes the processing system to perform operations including:

receiving a first encoded data slice for storage by the storage network, wherein the first encoded data slice is associated with a first vault;

generating a first encryption key corresponding to the first encoded data slice associated with the first vault;

utilizing the first encryption key to generate a first encrypted data slice and that corresponds to and is based on the first encoded data slice;

storing the first encrypted data slice in a first storage unit of the storage network;

receiving a request to retrieve the first encoded data slice;

retrieving the first encrypted data slice corresponding to the first encoded data slice from the first storage unit of the storage network;

generating a first decryption key corresponding to the first encoded data slice, wherein the first decryption key is different from the first encryption key; and

regenerating the first encoded data slice using the first decryption key.

16 . The non-transitory computer readable storage medium of claim 15 , wherein the operations further include:

receiving a second encoded data slice for storage by the storage network, wherein the second encoded data slice is associated with a second vault;

generating a second encryption key corresponding the second encoded data slice associated with the second vault;

generating a second encrypted data slice using the second encryption key; and

storing the second encrypted data slice in a second storage unit of the storage network.

17 . The non-transitory computer readable storage medium of claim 16 , wherein the operations further include:

receiving a third encoded data slice for storage by the storage network, wherein the third encoded data slice is associated with the first vault;

generating a third encrypted data slice by utilizing the first encryption key; and

storing the third encrypted data slice in the first storage unit of the storage network.

18 . The non-transitory computer readable storage medium of claim 16 , wherein the first encryption key is generated by performing a deterministic function on a first vault identifier.

19 . The non-transitory computer readable storage medium of claim 18 , wherein the first encryption key is generated by performing the deterministic function further on a slice identifier of the first encoded data slice.

20 . The non-transitory computer readable storage medium of claim 18 , wherein the second encryption key is generated by performing the deterministic function on a second vault identifier.