Secret distribution among storage devices
AssigneePure Storage, Inc.
InventorsAndrew Bernat, Ethan Miller
Life of this patent
Estimating the term…
Abstract
In a storage system that includes a plurality of storage devices configured into one or more write groups, quorum-aware secret sharing may include: encrypting a device key for each storage device using a master secret; generating a plurality of shares from the master secret such that a minimum number of storage devices required from each write group for a quorum to boot the storage system is not less than a minimum number of shares required to reconstruct the master secret; and storing the encrypted device key and a separate share of the plurality of shares in each storage device.
Claims20
A storage system comprising:
- a plurality of storage devices and a controller, wherein the storage devices are configured into one or more write groups, and the controller is configured to carry out:
- encrypting a device key for each storage device using a master secret to generate an encrypted device key for each storage device;
- generating, for each write group, a first plurality of shares from the master secret;
- creating, from each share of the first plurality of shares, a second plurality of shares equal to a minimum number of storage devices required from each write group for a quorum to boot the storage system;
- and
- storing, for each storage device, the encrypted device key and a respective share of the second plurality of shares in the storage devices.
A method comprising:
- encrypting a device key for each storage device using a master secret to generate an encrypted device key for each storage device;
- generating, for each write group, a first plurality of shares from the master secret;
- creating, from each share of the first plurality of shares, a second plurality of shares equal to a minimum number of storage devices required from each write group for a quorum to boot the storage system;
- and
- storing, for each storage device, the encrypted device key and a respective share of the second plurality of shares in the storage devices.
Dependencies are inferred from the claim text.