Distributed Data Encryption via Segmentation and Masked Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current distributed computing systems face challenges in securely and reliably storing and processing large datasets across multiple locations, particularly in ensuring data integrity and availability in the face of device and network failures, while also managing complex tasks and operations efficiently.
Innovation Solution
A distributed computing system that employs dispersed storage error encoding and decoding, segmenting data into encoded slices, and distributing these across multiple execution units for secure storage and task processing, utilizing error correction schemes to ensure data integrity and availability, and managing tasks through a network of distributed storage and task (DST) units.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored in a distributed computing system across multiple locations, then data availability and system resilience are improved, but data security and integrity become more difficult to ensure
Solution Approach 1:
The patent segments data into multiple slices and distributes them across different storage locations. Each slice is encrypted with unique encryption keys, so that compromise of one slice does not endanger the entire dataset. This segmentation approach maintains data availability while enhancing security by isolating potential security breaches to individual slices only.
Solution Approach 2:
The patent introduces encryption algorithms and decryption keys as intermediaries between the stored data and accessing processes. Data is encrypted before storage and can only be decrypted with appropriate keys, creating a security layer that protects data integrity and confidentiality even when distributed across multiple locations with varying security levels.
2Reliability
If data is segmented and distributed across multiple execution units, then system fault tolerance is improved, but system complexity increases
Solution Approach 1:
The system divides data into segments and distributes them across multiple execution units, allowing the system to tolerate failures of individual units while maintaining overall functionality. Each execution unit operates independently on its assigned data segments, simplifying the management of complexity through modular organization.
Solution Approach 2:
The patent implements universal encryption and decryption mechanisms that can be applied across all execution units regardless of their specific functions or locations. This standardized approach to data protection reduces system complexity by providing a consistent security framework that works uniformly across the distributed architecture.
3Object-affected harmful factors
If encryption is applied to each data slice, then data security is improved, but processing time and computational overhead increase
Solution Approach 1:
By segmenting data into smaller slices and encrypting them in parallel across multiple execution units, the system reduces the total processing time compared to sequential encryption of the entire dataset. The segmentation enables concurrent processing while maintaining security through individual encryption of each slice.
Solution Approach 2:
The patent applies encryption to data slices during the data preparation and storage phase, before the data is needed for processing. This preliminary encryption action ensures that security is established upfront, eliminating the need for time-consuming encryption operations during critical data processing phases.
Data Source
AI summary
A method begins by a dispersed storage (DS) processing module segmenting a data partition into a plurality of data segments. For a data segment of the plurality of data segments, the method continues with the DS processing module dividing the data segment into a set of data sub-segments and generating a set of sub keys for the set of data sub-segments based on a master key. The method continues with the DS processing module encrypting the set of data sub-segments using the set of sub keys to produce a set of encrypted data sub-segments and aggregating the set of encrypted data sub-segments into encrypted data. The method continues with the DS processing module generating a masked key based on the encrypted data and the master key and combining the encrypted data and the masked key to produce an encrypted data segment.