Storage Network Slice Encryption for Cross-Vault Data Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing dispersed storage networks face challenges in securely storing and retrieving data across multiple vaults, as errors in data slices can lead to exposure of unauthorized data.
Innovation Solution
The implementation of per-vault or per-slice encryption keys, derived using deterministic functions based on vault identifiers, slice names, and memory device identifiers, ensures that each data slice is encrypted and decrypted using a unique key, preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data is stored in a dispersed storage network across multiple vaults, then data availability and distribution are improved, but data security deteriorates due to potential exposure of unauthorized data from errant slices
Solution Approach 1:
The patent segments data into multiple slices distributed across different vaults, with each slice independently encrypted using per-slice encryption keys. This segmentation allows data to be stored dispersely while maintaining security, as each slice can be independently protected and retrieved without exposing other slices.
Solution Approach 2:
The patent applies different encryption keys to different data slices, creating local quality variations in security protection. Each slice has its own unique encryption key derived from vault identifier, slice name, and memory device identifier, ensuring that security properties are optimized locally for each slice while maintaining overall system security.
2Reliability
If per-vault or per-slice encryption keys are implemented, then data security is improved, but system complexity increases due to key management requirements
Solution Approach 1:
The patent implements self-service key management where encryption keys are automatically derived using deterministic functions based on vault identifiers, slice names, and memory device identifiers. This eliminates the need for manual key distribution and management, as the system autonomously generates and manages keys through mathematical derivation.
Solution Approach 2:
The patent changes the parameter space for key management by using derived parameters (vault identifier, slice name, memory device identifier) instead of managing separate secret keys for each slice. This transforms the key management problem from storing multiple secrets to computing keys from public parameters, reducing complexity.
Data Source
AI summary
A storage network operates by: receiving a encoded data slice for storage by the storage network, wherein the encoded data slice is associated with a vault; generating a encryption key corresponding to the encoded data slice associated with the vault; utilizing the encryption key to generate a encrypted data slice and that corresponds to, and is based on, the encoded data slice; storing the encrypted data slice in a storage unit of the storage network; receiving a request to retrieve the encoded data slice; retrieving the encrypted data slice corresponding to the encoded data slice from the storage unit of the storage network; generating a decryption key corresponding to the encoded data slice, wherein the decryption key is different from the encryption key; and regenerating the encoded data slice using the decryption key.