Dispersed Storage Network Secret Data Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data storage systems face challenges with data integrity and security, particularly in RAID configurations, where increased redundancy leads to higher maintenance demands and increased risks of unauthorized access due to multiple data copies, and the overhead of redundant systems becomes inefficient as data volume grows.
Innovation Solution
A distributed storage system that uses error coding dispersal storage to partition data into slices, which are then stored across multiple physically diverse locations, allowing for secure and reliable data retrieval even in the event of device failures, with a management system that handles encryption, key storage, and integrity verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple copies of data are stored for redundancy, then data reliability is improved, but security deteriorates due to increased risk of unauthorized access
Solution Approach 1:
The patent segments data into multiple slices that are distributed across different storage locations. Each slice alone is insufficient to reconstruct the original data, providing both redundancy and security. This is achieved by dividing data into N slices where any K slices can reconstruct the data, but fewer than K slices provide no useful information.
Solution Approach 2:
The patent introduces an intermediary encryption layer where data is encrypted before being sliced and distributed. The encryption key acts as a mediator that controls access to the segmented data, ensuring that even if slices are accessed, the original data remains protected without proper decryption credentials.
2Reliability
If redundant storage systems are implemented, then data integrity is improved, but device complexity increases
Solution Approach 1:
The patent creates a universal storage system that simultaneously provides data redundancy, security, and distributed storage capabilities through a single cohesive architecture. The same slicing and encryption mechanism handles multiple functions including backup, security, and load distribution, eliminating the need for separate redundant systems.
Solution Approach 2:
The patent changes the fundamental parameters of data storage by transitioning from storing complete data copies to storing encrypted data slices with specific reconstruction thresholds. This parameter change allows the system to achieve redundancy with fewer resources and lower complexity compared to traditional replication methods.
3Reliability
If more redundant storage capacity is allocated, then data security is improved, but storage efficiency deteriorates due to overhead
Solution Approach 1:
The patent applies partial redundancy by storing only the minimum necessary data slices required for reconstruction. Instead of storing multiple complete copies, the system stores N slices where any K can reconstruct the data, with K being the minimum threshold needed. This provides adequate security and redundancy without the excessive overhead of full replication.
Solution Approach 2:
The patent uses efficient copying by creating data slices that can be independently stored and later reassembled. Rather than copying entire data sets multiple times, the system creates lightweight slices that contain only the necessary portions of encrypted data, reducing storage overhead while maintaining security and redundancy.
Data Source
AI summary
A method for secure storage of secret data begins with an originating device transforming the secret data to produce a plurality of secret data shares and encrypting the plurality of secret data shares using unique encryption values of trusted agent modules of a dispersed storage network (DSN) to produce a plurality of encrypted secret data shares for storage in storage nodes of the DSN. Retrieval of the secret data begins with the originating device sending a secret data retrieval request to the trusted agent modules and recovering, by the trusted agent modules, the plurality of encrypted secret data shares from the storage nodes. The method continues with the trusted agent modules decrypting the plurality of encrypted secret data shares using a decryption function corresponding to the unique encryption values and sending the plurality of secret data shares to the originating device.