# US 10,372,357 B2 · Securely recovering stored data in a dispersed storage network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,372,357 B2 - Document ID: US10372357B2 - Status: Granted - Kind: B2 - Application number: 16/102,940 - Filed: 2018-08-14 - Published: 2018-12-13 - Granted: 2019-08-06 - Earliest claimed: 2015-08-31 - Assignees: Pure Storage, Inc. - Applicants: International Business Machines Corporation - Inventors: Jason K. Resch - Web page: https://patentgrep.com/patent/US10372357B2 ## CPC - G06F 3/0619: {in relation to data integrity, e.g. data losses, bit errors} - G06F 3/061: {Improving I/O performance} - G06F 3/0611: {in relation to response time} - G06F 3/0622: {in relation to access} - G06F 3/0635: {by changing the path, e.g. traffic rerouting, path reconfiguration} - G06F 3/0637: {Permissions} - G06F 3/064: {Management of blocks} - G06F 3/0644: {Management of space entities, e.g. partitions, extents, pools} - G06F 3/0659: {Command handling arrangements, e.g. command buffers, queues, command scheduling} - G06F 3/0665: {at area level, e.g. provisioning of virtual or logical volumes} - G06F 3/067: {Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]} - G06F 3/0689: {Disk arrays, e.g. RAID, JBOD} - G06F 11/1076: {Parity data used in redundant arrays of independent storages, e.g. in RAID systems} - G06F 11/1092: {Rebuilding, e.g. when physically replacing a failing disk} - G06F 11/3034: {where the computing system component is a storage system, e.g. DASD based or network based (digital input from or digital output to record carriers G06F3/06; digital recording or reproducing G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097)} - G06F 11/3409: {for performance assessment} - G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)} - H03M 13/3761: {using code combining, i.e. using combining of codeword portions which may have been transmitted separately, e.g. Digital Fountain codes, Raptor codes or Luby Transform [LT] codes} - H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] - G06F 2212/1052: Security improvement - H03M 13/1515: {Reed-Solomon codes} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H03M: CODING; DECODING; CODE CONVERSION IN GENERAL (using fluidic means F15C4/00; optical analogue/digital converters G02F7/00; coding, decoding or code conversion, specially adapted for particular applications, see the relevant subclasses, e.g. G01D, G01R, G06F, G06T, G09G, G10L, G11B, G11C, H04B, H04L, H04M, H04N; ciphering or deciphering for cryptography or other purposes involving the need for secrecy G09C) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for execution by a dispersed storage and task (DST) execution unit that includes a processor includes receiving a slice pre-image request from a computing device via a network that indicates a data slice, a requesting entity and a plurality of storage units. A data pre-image is generated by performing a pre-image function on the data slice based on the plurality of storage units. An encrypted data pre-image is generated for transmission to the computing device by performing an encryption function on the data pre-image based on a key associated with the requesting entity. ## Claims ### Claim 1 A method for execution by a dispersed storage and task (DST) execution unit that includes a hardware processor, the method comprises: generating, based on a slice pre-image request from a computing device, a data pre-image by performing a pre-image function on a data slice based on a plurality of storage units indicated in the request; and generating an encrypted data pre-image for transmission to the computing device by performing an encryption function on the data pre-image based on a key associated with a requesting entity; wherein the computing device receives a plurality of encrypted data pre-images from a plurality of storage units that includes the DST execution unit for transmission to the requesting entity for decoding; wherein the requesting entity receives a plurality of storage unit identifiers corresponding to the plurality of storage units from the computing device, and wherein the requesting entity decodes the plurality of encrypted data pre-images by utilizing a plurality of unique keys, each associated with one of the plurality of storage units; and wherein the requesting entity receives a sum of the encrypted data pre-images from the computing device, and wherein decoding includes subtracting each of the plurality of unique keys from the sum of the encrypted data pre-images. ### Claim 2 (depends on 1) The method of claim 1, wherein the slice pre-image request indicates the data slice, the requesting entity, and the plurality of storage units. ### Claim 3 (depends on 1) The method of claim 1, wherein the pre-image function includes creating a vector that includes the data slice. ### Claim 4 (depends on 3) The method of claim 3, wherein the pre-image function further includes creating a decode matrix based on the plurality of storage units. ### Claim 5 (depends on 4) The method of claim 4, wherein the pre-image function further includes performing matrix multiplication on the vector and the decode matrix. ### Claim 6 (depends on 1) The method of claim 1, wherein generating the encryption function includes applying the key additively to the data pre-image. ### Claim 7 (depends on 1) The method of claim 1, further comprising generating a message authentication code based on the data slice for transmission to the computing device. ### Claim 8 (depends on 1) The method of claim 1, wherein the key is established based on at least one of: a public-key system or a key agreement protocol. ### Claim 9 A processing system of a dispersed storage and task (DST) execution unit comprises: at least one hardware processor; a memory that stores operational instructions, that when executed by the at least one hardware processor cause the processing system to perform operations including: generating, based on a slice pre-image request from a computing device, a data pre-image by performing a pre-image function on a data slice based on a plurality of storage units indicated in the request; and generating an encrypted data pre-image for transmission to the computing device by performing an encryption function on the data pre-image based on a key associated with a requesting entity; wherein the computing device receives a plurality of encrypted data pre-images from a plurality of storage units that includes the DST execution unit for transmission to the requesting entity for decoding; wherein the requesting entity receives a plurality of storage unit identifiers corresponding to the plurality of storage units from the computing device, and wherein the requesting entity decodes the plurality of encrypted data pre-images by utilizing a plurality of unique keys, each associated with one of the plurality of storage units; and wherein the requesting entity receives a sum of the encrypted data pre-images from the computing device, and wherein decoding includes subtracting each of the plurality of unique keys from the sum of the encrypted data pre-images. ### Claim 10 (depends on 9) The processing system of claim 9, wherein the pre-image function includes creating a vector that includes the data slice, creating a decode matrix based on the plurality of storage units, and performing matrix multiplication on the vector and the decode matrix. ### Claim 11 (depends on 9) The processing system of claim 9, wherein generating the encryption function includes applying the key additively to the data pre-image. ### Claim 12 (depends on 9) The processing system of claim 9, wherein the operations further include: generating a message authentication code based on the data slice for transmission to the computing device. ### Claim 13 (depends on 9) The processing system of claim 9, wherein the key is established based on at least one of: a public-key system or a key agreement protocol. ### Claim 14 (depends on 9) The processing system of claim 9, wherein the slice pre-image request indicates the data slice, the requesting entity, and the plurality of storage units. ### Claim 15 A non-transitory computer readable storage medium comprises: at least one memory section that stores operational instructions that, when executed by a processing system of a dispersed storage and task (DST) execution unit that includes a hardware processor and a memory, causes the processing system to perform operations including: generating, based on a slice pre-image request from a computing device, a data pre-image by performing a pre-image function on a data slice based on a plurality of storage units indicated in the request; and generating an encrypted data pre-image for transmission to the computing device by performing an encryption function on the data pre-image based on a Key associated with a requesting entity; wherein the computing device receives a plurality of encrypted data pre-images from a plurality of storage units that includes the DST execution unit for transmission to the requesting entity for decoding; wherein the requesting entity receives a plurality of storage unit identifiers corresponding to the plurality of storage units from the computing device, and wherein the requesting entity decodes the plurality of encrypted data pre-images by utilizing a plurality of unique keys, each associated with one of the plurality of storage units; and wherein the requesting entity receives a sum of the encrypted data pre-images from the computing device, and wherein decoding includes subtracting each of the plurality of unique keys from the sum of the encrypted data pre-images. ### Claim 16 (depends on 15) The computer readable storage medium of claim 15, wherein the pre-image function includes creating a vector that includes the data slice. ### Claim 17 (depends on 16) The computer readable storage medium of claim 16, wherein the pre-image function further includes creating a decode matrix based on the plurality of storage units, and performing matrix multiplication on the vector and the decode matrix. ### Claim 18 (depends on 15) The computer readable storage medium of claim 15, wherein generating the encryption function includes applying the key additively to the data pre-image. ### Claim 19 (depends on 15) The computer readable storage medium of claim 15, wherein the operations further include generating a message authentication code based on the data slice for transmission to the computing device. ### Claim 20 (depends on 15) The computer readable storage medium of claim 15, wherein the slice pre-image request indicates the data slice, the requesting entity, and the plurality of storage units.