Dispersed Storage Encryption Keys for Fault-Tolerant Data Retrieval
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current dispersed storage networks face challenges in securely storing and retrieving data across geographically diverse locations, particularly in maintaining data integrity and preventing unauthorized access, while existing solutions are often prone to data loss due to device or network failures and software errors.
Innovation Solution
A distributed computing system that employs dispersed storage error encoding, using information dispersal algorithms to split data into encoded slices stored across multiple sites, with per-vault and per-slice encryption keys to secure and verify data integrity, and a network management unit to coordinate storage and retrieval operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored in a dispersed storage network across multiple locations, then data availability and fault tolerance are improved, but data security and integrity verification become more complex
Solution Approach 1:
The patent segments data into multiple encoded slices distributed across different storage locations. Each slice is encrypted with unique per-slice encryption keys, and metadata is separately encoded and distributed. This segmentation allows the system to maintain high availability through distribution while managing security through modular key management and independent verification of each slice.
Solution Approach 2:
The patent introduces distributed error encoding metadata as an intermediary layer between the stored data slices and the verification process. This metadata contains encoding parameters and integrity information that enables automated verification of data integrity without requiring complex cross-location coordination, thus simplifying security management while maintaining reliability.
2Reliability
If per-slice encryption keys are used to secure encoded data slices, then data security is improved, but key management and retrieval operations become more complex
Solution Approach 1:
The patent divides the encryption scheme into per-vault encryption keys for broader security and per-slice encryption keys for fine-grained control. This segmentation allows selective encryption and decryption operations where only specific slices need to be accessed, simplifying key management during retrieval operations while maintaining strong security through multiple key layers.
Solution Approach 2:
The patent performs preliminary encoding and encryption of data into multiple slices with associated metadata before distribution. This preliminary action includes generating all necessary encryption keys and embedding verification information in the metadata, so that during retrieval operations, the system only needs to perform straightforward decryption and verification rather than complex key derivation and management.
3Reliability
If error correction encoding is applied to data before storage, then data integrity is improved, but storage space and processing time increase
Solution Approach 1:
The patent applies error correction encoding to create redundant encoded slices, but stores only a subset of these slices at any given location or across the network. The system is designed to tolerate loss of some slices by having enough remaining slices to reconstruct the original data, thus achieving data integrity protection without requiring storage of all encoded slices, optimizing storage space utilization.
Data Source
AI summary
A storage network operates by: receiving a encoded data slice for storage by the storage network, wherein the encoded data slice is associated with a vault; generating a encryption key corresponding to the encoded data slice based on a vault identifier associated with the vault; utilizing the encryption key to generate a encrypted data slice and that corresponds to, and is based on, the encoded data slice; storing the encrypted data slice in a storage unit of the storage network; receiving a request to retrieve the encoded data slice; retrieving the encrypted data slice corresponding to the encoded data slice from the storage unit of the storage network; generating a decryption key corresponding to the encoded data slice based on the vault identifier, wherein the decryption key is different from the encryption key; and regenerating the encoded data slice using the decryption key.