Use of key metadata during write and read operations in a dispersed storage network memory

Patent metadata

Field	Value
Publication number	US-10693640-B2
Application number	US-201715462163-A
Country	US
Kind code	B2
Filing date	Mar 17, 2017
Priority date	Mar 17, 2017
Publication date	Jun 23, 2020
Grant date	Jun 23, 2020

Abstract

Systems and Methods for encrypting and decrypting data in a dispersed storage network are disclosed. A data object may be encrypted using a data object specific encryption key, a container specific encryption key, a tenant account specific encryption key, or a time based encryption key. This specific, or more generally, secondary encryption key can be derived from a master or primary encryption key. Encryption key metadata pertaining to the master encryption key and the specific encryption key is also created and stored in the DSN. When reading an encrypted data object, the master encryption key can be retrieved and, along with the encryption key metadata, used to derive the specific encryption key. The specific encryption key can then be used to decrypt the encrypted data object to recover the data object.

First claim

What is claimed is:

1. A method of storing an object of data in a dispersed storage network (DSN), the DSN including a plurality of dispersed storage units, the method comprising:
deriving a secondary encryption key from a primary encryption key using a key derivation method, wherein the key derivation method includes wrapping the secondary encryption key with the primary encryption key;
encrypting the object of data using the secondary encryption key to produce an encrypted data object;
creating encryption key metadata related to the primary encryption key and the secondary encryption key;
storing the encrypted data object as a first set of encoded data slices in a corresponding first set of one or more dispersed storage units of the plurality of dispersed storage units; and
storing the encryption key metadata as a second set of encoded data slices in a corresponding second set of one or more dispersed storage units of the plurality of dispersed storage units,
wherein the encryption key metadata includes secondary encryption key content information, secondary encryption key derivation method information, primary encryption key policy information and primary encryption key source information.

2. The method of claim 1 , further comprising retrieving the primary encryption key from a key management server external to the DSN.

3. The method of claim 1 , further comprising retrieving the primary encryption key as a third set of encoded data slices from a corresponding third set of one or more dispersed storage units of the plurality of dispersed storage units.

4. The method of claim 1 , wherein the key derivation method includes generating the secondary encryption key from the primary encryption key using a key derivation function.

5. The method of claim 1 , wherein the secondary encryption key is specific to the object of data.

6. The method of claim 1 , wherein the object of data is related to a tenant account and wherein the secondary encryption key is specific to a tenant account.

7. The method of claim 1 , wherein the secondary encryption key is specific to a time period.

8. A method of reading an object of data from a dispersed storage network (DSN), the DSN including a plurality of dispersed storage units, the method comprising:
retrieving at least a read threshold of encoded data slices of an encrypted data object from a first set of one or more dispersed storage units of the plurality of dispersed storage units;
retrieving at least a read threshold of encoded data slices of encryption key metadata corresponding to the encrypted data object from a second set of one or more dispersed storage units of the plurality of dispersed storage units;
retrieving a primary encryption key related to the encrypted data object by decoding the encryption key metadata;
recovering a secondary encryption key using a key derivation method based on the primary encryption key and the encryption key metadata, wherein the key derivation method includes unwrapping the primary encryption key from the secondary encryption key; and
decrypting the encrypted data object to produce the object of data,
wherein the encryption key metadata includes secondary encryption key content information, secondary encryption key derivation method information, primary encryption key policy information and primary encryption key source information.

9. The method of claim 8 , wherein the step of retrieving the primary encryption key further comprises retrieving the primary encryption key from a key management server external to the DSN.

10. The method of claim 8 , wherein the step of retrieving the primary encryption key further comprises retrieving the primary encryption key as a third set of encoded data slices from a corresponding third set of one or more dispersed storage units of the plurality of dispersed storage units.

11. The method of claim 8 , wherein the key derivation method includes generating the secondary encryption key from the primary encryption key using a key derivation function.

12. The method of claim 8 , wherein the secondary encryption key is specific to the object of data.

13. The method of claim 8 , wherein the object of data is related to a tenant account and wherein secondary encryption key is specific to the tenant account.

14. The method of claim 8 , wherein the secondary encryption key is specific to a time period.

15. A dispersed storage processing unit for use in a dispersed storage network (DSN), the DSN including a plurality of dispersed storage units, the dispersed storage processing unit comprising:
a communications interface;
a memory; and
a computer processor,
wherein the memory includes instructions for causing the computer processor to:
derive a secondary encryption key from a primary encryption key using a key derivation method, wherein the key derivation method includes wrapping the secondary encryption key with the primary encryption key;
encrypt an object of data using the secondary encryption key to produce an encrypted data object;
create encryption key metadata related to the primary encryption key and the secondary encryption key;
store the encrypted data object as a first set of encoded data slices in a corresponding first set of one or more dispersed storage units of the plurality of dispersed storage units; and
store the encryption key metadata as a second set of encoded data slices in a corresponding second set of one or more dispersed storage units of the plurality of dispersed storage units, and

wherein the encryption key metadata includes secondary encryption key content information, secondary encryption key derivation method information, primary encryption key policy information and primary encryption key source information.

16. The dispersed storage processing unit of claim 15 , wherein the secondary encryption key is specific to the object of data.

Assignees

• IBM

Inventors

• Gray Adam M
• Hegde Harsha
• Leggette Wesley B
• Motwani Manish
• Resch Jason K
• Scholl Daniel J
• Seaborn Mark D
• Shah Rohan P
• Vedpathak Yogesh R

Classifications

• H04L2463/061

  applying further key derivation, e.g. deriving traffic keys from a pair-wise master key · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L67/1097

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L9/0894 Primary

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title