Seeded Deterministic Memory Access for Secure Slice Placement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional dispersed storage techniques rely on deterministic functions for data distribution, which can be vulnerable to attacks by malicious agents who can predict data storage locations, leading to performance degradation.
Innovation Solution
Incorporating a secure seed into the deterministic function used for data storage, generated from a true or cryptographically strong pseudorandom source, to ensure that even if the function's specifications are known, the output cannot be predicted, thereby preventing malicious agents from identifying data storage locations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a deterministic function is used to determine data storage locations, then data distribution can be achieved, but the system becomes vulnerable to attacks by malicious agents who can predict storage locations
Solution Approach 1:
The patent changes the parameters of the deterministic function by incorporating a secret seed value that is unknown to malicious agents. This transforms the function from being predictable (given knowledge of the algorithm) to being unpredictable (given unknown seed), while maintaining the deterministic nature needed for consistent data retrieval. The seed acts as an additional parameter that secures the storage location determination process.
2Reliability
If data is distributed across multiple storage units, then system availability is improved, but malicious agents can identify specific storage locations and degrade performance
Solution Approach 1:
The secret seed value serves as an intermediary between the data and the storage units. Instead of directly mapping data to storage locations using a predictable function, the seed mediates this process by adding an unpredictable layer. This intermediary prevents malicious agents from directly inferring storage locations from data characteristics, thereby protecting against targeted attacks while maintaining distributed storage benefits.
3Ease of operation
If a predictable deterministic function is used for storage, then system operation is simple, but malicious agents can exploit the predictability to launch attacks
Solution Approach 1:
The system performs preliminary action by pre-distributing secret seed values to storage units before any data storage operations occur. This preliminary setup ensures that when data needs to be stored or retrieved, the deterministic function with the secret seed can be applied immediately without compromising security. The preliminary distribution of secrets enables secure operations while maintaining simplicity in the actual data access processes.
Data Source
AI summary
A processing device implementing a storage unit is included in a distributed storage network (DSN) that uses employing one or more storage units to store encoded data slices. The storage unit receives an access request that includes a slice identifier associated with an encoded data slice stored in a particular distributed storage (DS) memory of the storage unit. The storage unit obtains a secure seed, and determines a memory range associated with the slice identifier by performing a deterministic function on the slice identifier using the secure seed as an input to the deterministic function. The storage unit identifies the particular DS memory as being associated with the memory range, and performs the access request using the particular DS memory.