Verifiable Keyed All-or-Nothing Transform for Dispersed Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional RAID systems face challenges with increasing disk failures, maintenance costs, data security, and vulnerability to natural disasters due to the need for redundant copies and co-location of storage units, which can lead to data loss and unauthorized access.
Innovation Solution
A dispersed storage network (DSN) with error encoding and decoding capabilities, using Cauchy Reed-Solomon encoding to distribute data across multiple storage units, ensuring data integrity and security by creating encoded data slices that can be recovered even with partial failures without the need for redundant copies, and encrypting data for secure storage and retrieval.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If redundant copies of data are stored to reduce data loss risk, then data security is improved, but the chance of unauthorized access increases
Solution Approach 1:
The patent segments data into multiple slices and distributes them across different storage units. Instead of storing redundant copies, the system creates multiple unique slices where any threshold number can reconstruct the original data. This segmentation prevents unauthorized access because no single slice contains complete information, while still providing reliability through distributed reconstruction capability.
Solution Approach 2:
The patent introduces error correction codes as an intermediary layer between the original data and storage units. These codes enable the system to tolerate failures and unauthorized access attempts without compromising data integrity or security. The error correction mechanism acts as a mediator that protects data while allowing distributed storage without redundant copies.
2Reliability
If multiple RAID devices are co-located to enable backup, then data loss risk is reduced, but vulnerability to natural disasters increases
Solution Approach 1:
The patent divides data into slices and distributes them across geographically dispersed storage units rather than co-locating redundant copies. This segmentation allows data to be stored in multiple locations, protecting against natural disasters while maintaining the ability to reconstruct data from any threshold number of slices regardless of location.
3Quantity of substance
If more disks are added to RAID array to increase storage capacity, then storage capacity is improved, but probability of disk failure rises
Solution Approach 1:
The patent segments data and distributes it across multiple storage units with error correction codes. This allows the system to add storage capacity by including more storage units in the distributed network without proportionally increasing failure risk, because the error correction mechanism tolerates a certain number of failures while maintaining data integrity.
4Device complexity
If manual replacement of failed disks is required to maintain RAID system, then system complexity is reduced, but maintenance costs and time increase
Solution Approach 1:
The patent implements error correction codes that enable the system to automatically detect and tolerate disk failures without requiring manual intervention. The distributed storage architecture with error correction allows the system to self-heal by reconstructing data from remaining slices, eliminating the need for manual disk replacement and reducing maintenance costs.
Data Source
AI summary
Systems and methods for encrypting and decrypting data in a dispersed storage network are disclosed. One encryption approach involves generating a random encryption key (REK), producing encrypted data using the REK, determining a computed value (CV) using the encrypted data, and combining the REK, CV and a supplied encryption key (SEK) into an Encrypted Difference (ED). The encrypted data and ED are then combined to produce a secure package. The secure package is then processed by an error coding function and stored as slices. One decryption approach includes accessing the slices and the SEK, decoding the slices to recover the secure package, re-computing the CV from the encrypted data within the secure package, and using the SEK and CV to de-combine the ED and recover the REK. The REK is then used to decrypt the encrypted data. Integrity verification of the secure package may also be used.