Storage security using cryptographic splitting

A secure storage appliance comprising a programmable circuit configured to execute program instructions which, when executed, configure the secure storage appliance to:

• receive from a client device a block of data for storage on a volume, the volume associated with a plurality of shares distributed across a plurality of physical storage devices;
• cryptographically split the block of data into a plurality of secondary data blocks;
• cryptographically split the session key into a plurality of session key fragments;
• encrypt each of the plurality of secondary data blocks with a different session key, each session key associated with at least one of the plurality of shares;
• and
• encrypt each of the plurality of session key fragments with a workgroup key associated with a source of the block of data.

A secure data storage network comprising:

• a client device;
• a plurality of physical storage devices;
• a secure storage appliance communicatively connected to the client device and the plurality of physical storage devices, the secure storage appliance including a programmable circuit configured to execute program instructions which, when executed, cause the secure storage appliance to:
• receive from the client device a block of data for storage on a volume, the volume associated with a plurality of shares distributed across the plurality of physical storage devices;
• cryptographically split the block of data into a plurality of secondary data blocks;
• cryptographically split the session key into a plurality of session key fragments;
• encrypt each of the plurality of secondary data blocks with a different session key, each session key associated with at least one of the plurality of shares;
• and
• encrypt each of the plurality of session key fragments with a workgroup key associated with a source of the block of data.