Password Augmented All-or-Nothing Transform for Dispersed Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems in dispersed storage networks lack adequate security measures to prevent unauthorized access and ensure data integrity, particularly in distributed environments where data is encoded and stored across multiple geographically dispersed units.
Innovation Solution
The implementation of a dispersed storage network (DSN) with error encoding and decoding capabilities, combined with data obfuscation techniques using encryption, deterministic functions, and key masking, ensures secure storage and retrieval of data by distributing encoded data slices across multiple storage units, allowing for secure and resilient data management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is distributed across multiple storage units in a dispersed storage network, then data availability and fault tolerance are improved, but security risks increase due to potential unauthorized access at multiple distribution points
Solution Approach 1:
The patent segments data into multiple data slices that are distributed across different storage units. Each slice alone is insufficient to reconstruct the original data, providing both availability (data can be accessed from multiple locations) and security (unauthorized access to individual slices does not compromise the entire dataset).
Solution Approach 2:
The patent implements nested encryption by placing encrypted data slices within secure containers that include additional security layers. Each data slice is encrypted individually, and the collection of slices is further protected by container-level encryption and authentication mechanisms, creating multiple nested security barriers.
2Object-affected harmful factors
If encryption is applied to protect data in dispersed storage, then security is improved, but processing time and computational resources increase
Solution Approach 1:
The patent applies encryption to data before it is distributed to storage units, during the initial data ingestion phase. This preliminary encryption ensures that data is protected from the moment it enters the system, eliminating the need for real-time encryption during read operations and reducing processing time for data retrieval.
Solution Approach 2:
The patent creates encrypted copies of data slices that are stored in their encrypted form across the distributed network. These pre-encrypted copies can be retrieved and decrypted only when all necessary slices are collected and the proper authentication is provided, avoiding repeated encryption operations during normal read operations.
3Reliability
If error correction coding is implemented to ensure data integrity, then data reliability is improved, but storage capacity efficiency decreases due to redundant data
Solution Approach 1:
The patent combines error correction capabilities with the segmentation approach by implementing erasure coding across the distributed data slices. Instead of adding separate error correction redundancy, the system uses the distributed slice structure itself to provide fault tolerance, where any sufficient subset of slices can reconstruct the original data, merging storage efficiency with error correction.
Solution Approach 2:
The patent allows dynamic adjustment of the number of data slices and the threshold for data reconstruction. By changing these parameters, the system can optimize the balance between data integrity (higher redundancy) and storage capacity efficiency (lower redundancy) based on specific operational requirements and constraints.
Data Source
AI summary
A computing device includes an interface configured to interface and communicate with a dispersed storage network (DSN), a memory that stores operational instructions, and processing circuitry operably coupled to the interface and to the memory. The processing circuitry is configured to execute the operational instructions to perform various operations and functions. The computing device encrypts data using a key to generate encrypted data and processes it and a password based on a deterministic function to generate transformed data. The computing device masks the key based on a masking function based on the transformed data to generate a masked key, and then combines the encrypted data and the masked key to generate a secure package that is encoded in accordance with dispersed error encoding parameters produce a set of encoded data slices (EDSs) and transmits the set of EDSs to a plurality of storage units (SUs) to be distributedly stored therein.