Dispersed Storage Network Data Encryption Parameter Dispersal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional computer storage systems face challenges with data integrity and security due to the failure of memory devices, particularly those using physical movement technologies, such as disc drives, which can lead to bit-level corruption and require redundant arrays like RAID to ensure data availability but increase maintenance demands and security risks with multiple copies of data.
Innovation Solution
A distributed storage system that employs error-coded data slices stored across multiple physically diverse locations, using a dispersed storage network with a processing unit that partitions data into segments, encodes them using forward error correction, and distributes them across multiple storage units, allowing for reliable and secure data retrieval even in the event of device failures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If redundant arrays like RAID are used to ensure data availability, then data reliability is improved, but maintenance demands and security risks increase
Solution Approach 1:
The patent segments data into multiple data slices and disperses them across different storage locations. Instead of creating redundant copies like RAID, the system divides the original data into fragments using error correction coding, so that any subset of a threshold number of slices can reconstruct the original data. This segmentation approach provides fault tolerance without requiring multiple complete copies, thereby reducing maintenance complexity while maintaining reliability.
Solution Approach 2:
The patent introduces error correction codes as an intermediary mechanism between the data and storage locations. These codes are embedded within the data slices, enabling automatic detection and correction of errors without requiring manual intervention or complex RAID management. This intermediary layer simplifies the system by providing automatic fault tolerance rather than requiring complex redundant array management.
2Reliability
If multiple copies of data are stored for redundancy, then data reliability is improved, but security risks increase due to multiple access points
Solution Approach 1:
The patent segments data into encrypted slices and distributes them across multiple locations. Each slice alone is useless without the corresponding error correction code and a threshold number of other slices. This segmentation combined with distributed storage means that even if multiple slices are compromised, the data remains secure unless a threshold is met, thereby reducing security risks compared to storing multiple complete copies.
Solution Approach 2:
The patent uses error correction codes and encryption as intermediary layers between the data and storage locations. These intermediaries ensure that even if storage locations are accessed unauthorizedly, the data cannot be reconstructed without the complete set of slices and proper decoding. This provides security while maintaining availability, as legitimate access can reconstruct data from any sufficient subset of slices.
3Reliability
If data is distributed across multiple locations, then security and reliability are improved, but storage overhead increases
Solution Approach 1:
The patent changes the parameters of data storage by using error correction codes with configurable redundancy levels. Instead of fixed RAID configurations that require significant overhead, the system allows flexible adjustment of the number of data slices and threshold requirements. This enables optimization of storage overhead based on specific reliability needs, allowing efficient use of storage space while maintaining data availability.
Data Source
AI summary
A method for securely distributing a profile within a dispersed storage network (DSN) that begins by encrypting a profile using a key. The method continues by encoding the encrypted profile in accordance with a dispersed storage error encoding function. The method continues by outputting the set of encoded profile slices to the DSN for storage therein. The method continues by encoding the key in accordance with an error encoding function and outputting the set of secure key portions to a set of devices of the DSN for storage therein. A device obtains the profile by retrieving secure key portions from the set of devices and recovering the key therefrom. The device then retrieves encoded profile slices from the DSN and decodes them to recover the encrypted profile. The device then decrypts the encrypted profile using the key to recover the profile.