Use of key metadata during write and read operations in a dispersed storage network memory
Systems and Methods for encrypting and decrypting data in a dispersed storage network are disclosed. A data object may be encrypted using a data object specific encryption key, a container specific encryption key, a tenant account specific encryption key, or a time based encryption key. This specific, or more generally, secondary encryption key can be derived from a master or primary encryption key. Encryption key metadata pertaining to the master encryption key and the specific encryption key is also created and stored in the DSN. When reading an encrypted data object, the master encryption key can be retrieved and, along with the encryption key metadata, used to derive the specific encryption key. The specific encryption key can then be used to decrypt the encrypted data object to recover the data object.
1. A method of storing an object of data in a dispersed storage network (DSN), the DSN including a plurality of dispersed storage units, the method comprising:
deriving a secondary encryption key from a primary encryption key using a key derivation method, wherein the key derivation method includes wrapping the secondary encryption key with the primary encryption key;
encrypting the object of data using the secondary encryption key to produce an encrypted data object;
creating encryption key metadata related to the primary encryption key and the secondary encryption key;
storing the encrypted data object as a first set of encoded data slices in a corresponding first set of one or more dispersed storage units of the plurality of dispersed storage units; and
storing the encryption key metadata as a second set of encoded data slices in a corresponding second set of one or more dispersed storage units of the plurality of dispersed storage units,
wherein the encryption key metadata includes secondary encryption key content information, secondary encryption key derivation method information, primary encryption key policy information and primary encryption key source information.
2. The method of claim 1 , further comprising retrieving the primary encryption key from a key management server external to the DSN.
3. The method of claim 1 , further comprising retrieving the primary encryption key as a third set of encoded data slices from a corresponding third set of one or more dispersed storage units of the plurality of dispersed storage units.
4. The method of claim 1 , wherein the key derivation method includes generating the secondary encryption key from the primary encryption key using a key derivation function.
5. The method of claim 1 , wherein the secondary encryption key is specific to the object of data.
6. The method of claim 1 , wherein the object of data is related to a tenant account and wherein the secondary encryption key is specific to a tenant account.
7. The method of claim 1 , wherein the secondary encryption key is specific to a time period.
8. A method of reading an object of data from a dispersed storage network (DSN), the DSN including a plurality of dispersed storage units, the method comprising:
retrieving at least a read threshold of encoded data slices of an encrypted data object from a first set of one or more dispersed storage units of the plurality of dispersed storage units;
retrieving at least a read threshold of encoded data slices of encryption key metadata corresponding to the encrypted data object from a second set of one or more dispersed storage units of the plurality of dispersed storage units;
retrieving a primary encryption key related to the encrypted data object by decoding the encryption key metadata;
recovering a secondary encryption key using a key derivation method based on the primary encryption key and the encryption key metadata, wherein the key derivation method includes unwrapping the primary encryption key from the secondary encryption key; and
decrypting the encrypted data object to produce the object of data,
wherein the encryption key metadata includes secondary encryption key content information, secondary encryption key derivation method information, primary encryption key policy information and primary encryption key source information.
9. The method of claim 8 , wherein the step of retrieving the primary encryption key further comprises retrieving the primary encryption key from a key management server external to the DSN.
10. The method of claim 8 , wherein the step of retrieving the primary encryption key further comprises retrieving the primary encryption key as a third set of encoded data slices from a corresponding third set of one or more dispersed storage units of the plurality of dispersed storage units.
11. The method of claim 8 , wherein the key derivation method includes generating the secondary encryption key from the primary encryption key using a key derivation function.
12. The method of claim 8 , wherein the secondary encryption key is specific to the object of data.
13. The method of claim 8 , wherein the object of data is related to a tenant account and wherein secondary encryption key is specific to the tenant account.
14. The method of claim 8 , wherein the secondary encryption key is specific to a time period.
15. A dispersed storage processing unit for use in a dispersed storage network (DSN), the DSN including a plurality of dispersed storage units, the dispersed storage processing unit comprising:
a communications interface;
a memory; and
a computer processor,
wherein the memory includes instructions for causing the computer processor to:
derive a secondary encryption key from a primary encryption key using a key derivation method, wherein the key derivation method includes wrapping the secondary encryption key with the primary encryption key;
encrypt an object of data using the secondary encryption key to produce an encrypted data object;
create encryption key metadata related to the primary encryption key and the secondary encryption key;
store the encrypted data object as a first set of encoded data slices in a corresponding first set of one or more dispersed storage units of the plurality of dispersed storage units; and
store the encryption key metadata as a second set of encoded data slices in a corresponding second set of one or more dispersed storage units of the plurality of dispersed storage units, and
wherein the encryption key metadata includes secondary encryption key content information, secondary encryption key derivation method information, primary encryption key policy information and primary encryption key source information.
16. The dispersed storage processing unit of claim 15 , wherein the secondary encryption key is specific to the object of data.