Dispersed storage network secure hierarchical file directory
A method includes creating a file directory entry in a directory file of a secure hierarchical file directory system for a file. The file directory entry includes a path name, an encryption access control list, and a source name. The file is encrypted with a key and the key is encrypted with each public key of user devices authorized to access the file. The encryption access control list includes identities of the set of user devices and the set of object content keys. The method further includes encrypting the directory file using a second key. The method further includes generating second object content keys based on the second key and public keys of second user devices authorized to access the directory file. The method further includes creating a next level directory file entry in a next higher directory file of the secure hierarchical file directory system for the directory file.
1. A method for execution by a processing module to generate a secure hierarchical file directory system, the method comprises:
encrypting a directory file using a second key to produce an encrypted directory file of the secure hierarchical file directory system for a file, wherein the directory file includes a file directory entry having a path name for the file, an encryption access control list, and a source name of the file, wherein the file is encrypted with a key, wherein the key is encrypted with each public key of a set of user devices that is authorized to access the file to produce a set of object content keys, and wherein the encryption access control list includes identities of the set of user devices and the set of object content keys;
generating a second set of object content keys based on the second key and public keys of a second set of user devices authorized to access the directory file; and
creating a next level directory file entry in a next higher directory file of the secure hierarchical file directory system for the directory file, wherein the next level file directory entry includes a next level path name for the file directory, a second encryption access control list, and a second source name of the file directory, and wherein the second encryption access control list includes the second set of object content keys and identities of the second set of user devices, wherein the second set of user devices includes the set of user devices.
2. The method of claim 1 further comprises:
dispersed storage error encoding the encrypted file to produce a plurality of sets of encoded data slices.
3. The method of claim 2 further comprises:
generating a plurality of sets of slice names for the plurality of sets of encoded data slices based on the source name of the file.
4. The method of claim 3 further comprises:
sending, based on the plurality of sets of slice names, the plurality of sets of encoded data slices to storage units for storage therein.
5. The method of claim 1 further comprises:
dispersed storage error encoding the encrypted directory file to produce a set of encoded data slices.
6. The method of claim 5 further comprises:
generating a sets of slice names for the set of encoded data slices based on the source name of the directory file.
7. The method of claim 6 further comprises:
sending, based on the set of slice names, the set of encoded data slices to storage units for storage therein.
8. The method of claim 1 further comprises:
encrypting the next level directory file using a third key to produce a second encrypted directory file.
9. The method of claim 8 further comprises:
generating a third set of object content keys based on the third key and public keys of a third set of user devices authorized to access the next level directory file.
10. The method of claim 9 further comprises:
creating a subsequent next level directory file entry in a subsequent next higher directory file of the secure hierarchical file directory system for the next level directory file, wherein the subsequent next level file directory entry includes a subsequent next level path name for the next level file directory, a third encryption access control list, and a third source name of the next level file directory, and wherein the third encryption access control list includes identities of the third set of user devices and the third set of object content keys, wherein the third set of user devices includes the second set of user devices.
11. A dispersed storage (DS) module comprises:
a processing system including a processing module and a memory, wherein the processing system is configured to perform operations that include:
encrypting a directory file using a second key to produce an encrypted directory file of secure hierarchical file directory system for a file, wherein the directory file includes a file directory entry having a path name for the file, an encryption access control list, and a source name of the file, wherein the file is encrypted with a key, wherein the key is encrypted with each public key of a set of user devices that is authorized to access the file to produce a set of object content keys, and wherein the encryption access control list includes identities of the set of user devices and the set of object content keys;
generating a second set of object content keys based on the second key and public keys of a second set of user devices authorized to access the directory file; and
creating a next level directory file entry in a next higher directory file of the secure hierarchical file directory system for the directory file, wherein the next level file directory entry includes a next level path name for the file directory, a second encryption access control list, and a second source name of the file directory, and wherein the second encryption access control list includes the second set of object content keys and identities of the second set of user devices, wherein the second set of user devices includes the set of user devices.
12. The DS module of claim 11 , wherein the operations further include:
dispersed storage error encoding the encrypted file to produce a plurality of sets of encoded data slices.
13. The DS module of claim 12 , wherein the operations further include:
generating a plurality of sets of slice names for the plurality of sets of encoded data slices based on the source name of the file.
14. The DS module of claim 13 , wherein the operations further include:
sending, based on the plurality of sets of slice names, the plurality of sets of encoded data slices to storage units for storage therein.
15. The DS module of claim 11 , wherein the operations further include:
dispersed storage error encoding the encrypted directory file to produce a set of encoded data slices.
16. The DS module of claim 15 , wherein the operations further include:
generating a sets of slice names for the set of encoded data slices based on the source name of the directory file.
17. The DS module of claim 16 , wherein the operations further include:
sending, based on the set of slice names, the set of encoded data slices to storage units for storage therein.
18. The DS module of claim 11 , wherein the operations further include:
encrypting the next level directory file using a third key to produce a second encrypted directory file.
19. The DS module of claim 18 , wherein the operations further include:
generating a third set of object content keys based on the third key and public keys of a third set of user devices authorized to access the next level directory file.
20. A computer readable storage medium comprises:
at least one memory section that stores operational instructions that, when executed by a processing system of a dispersed storage network (DSN) that includes a processor and a memory, causes the processing system to perform operations that include:
encrypting a directory file using a second key to produce an encrypted directory file of a secure hierarchical file directory system for a file, wherein the directory file includes a file directory entry having a path name for the file, an encryption access control list, and a source name of the file, wherein the file is encrypted with a key, wherein the key is encrypted with each public key of a set of user devices that is authorized to access the file to produce a set of object content keys, and wherein the encryption access control list includes identities of the set of user devices and the set of object content keys;
generating a second set of object content keys based on the second key and public keys of a second set of user devices authorized to access the directory file; and
creating a next level directory file entry in a next higher directory file of the secure hierarchical file directory system for the directory file, wherein the next level file directory entry includes a next level path name for the file directory, a second encryption access control list, and a second source name of the file directory, and wherein the second encryption access control list includes the second set of object content keys and identities of the second set of user devices, wherein the second set of user devices includes the set of user devices.