Dispersed Key Slice Storage for Secure Failure-Tolerant Retrieval
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional RAID systems face challenges with disk failures, increased maintenance costs, and security issues due to data redundancy and co-location, which can lead to data loss and unauthorized access, especially in the event of disasters or power outages.
Innovation Solution
A dispersed storage network (DSN) with error encoding and decoding capabilities, using Cauchy Reed-Solomon encoding, distributes data across multiple storage units geographically, allowing for secure storage and retrieval of cryptographic keys with zero information gain rebuilding functions, ensuring data integrity and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored in multiple RAID devices to reduce data loss risk, then data reliability is improved, but security deteriorates due to increased unauthorized access risk
Solution Approach 1:
The patent segments cryptographic keys into multiple key slices that are distributed across different storage units. Each key slice alone is insufficient to reconstruct the original key, providing both redundancy for reliability and security against unauthorized access. The key material is divided into N slices where any K slices can reconstruct the key, but fewer than K slices provide no useful information.
Solution Approach 2:
The patent introduces an intermediary encoding mechanism (RAID64 error correction coding) that transforms the key material into encoded key slices. This intermediary layer ensures that even if multiple slices are accessed, the original key cannot be recovered without the proper decoding process, thus mediating between reliability needs and security requirements.
2Ease of operation
If RAID devices are co-located for easy access, then ease of operation is improved, but reliability deteriorates due to disaster risk
Solution Approach 1:
The patent applies local quality by allowing different storage units to have different locations (some co-located for performance, others geographically distributed for disaster resistance). The system can configure storage units based on specific quality requirements - hot storage units can be nearby for fast access while cold storage units are distributed for reliability.
3Reliability
If multiple copies of data are stored to prevent data loss, then reliability is improved, but device complexity increases due to maintenance requirements
Solution Approach 1:
The patent implements automated discarding and recovering of key slices. When storage units fail or are replaced, the system automatically recovers key slices from remaining units and redistributes them. This eliminates manual intervention for maintenance while maintaining reliability through continuous redundancy.
4Object-affected harmful factors
If cryptographic keys are stored in distributed manner, then security is improved, but productivity decreases due to retrieval complexity
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing encoding/decoding information along with the key slices. The system prepares recovery paths in advance, so when key retrieval is needed, the system can quickly identify which slices to retrieve and how to reconstruct the key without complex real-time computations.
Data Source
AI summary
Methods for use in a storage unit of a dispersed storage network (DSN) to securely store cryptographic key information. In various examples, the storage unit receives a slice access request relating to a key slice generated by performing a dispersed storage error encoding function on an encryption key. When the slice access request includes a request to store the key slice, the storage unit encrypts the key slice using a local key and stores the encrypted key slice (e.g., in a key region of a storage vault). When the slice access request includes a request to recover a key slice stored in the storage unit, the encrypted key slice is recovered from memory and decrypted using the local key to produce a decrypted key slice for provision to the requesting entity. For rebuilding operations, the storage unit may instead return a zero information gain (ZIG) representation of the key slice.