US 2017/0250809 A1 · CRYPTOGRAPHIC KEY STORAGE IN A DISPERSED STORAGE NETWORK

Abstract

Methods for use in a storage unit of a dispersed storage network (DSN) to securely store cryptographic key information. In various examples, the storage unit receives a slice access request relating to a key slice generated by performing a dispersed storage error encoding function on an encryption key. When the slice access request includes a request to store the key slice, the storage unit encrypts the key slice using a local key and stores the encrypted key slice (e.g., in a key region of a storage vault). When the slice access request includes a request to recover a key slice stored in the storage unit, the encrypted key slice is recovered from memory and decrypted using the local key to produce a decrypted key slice for provision to the requesting entity. For rebuilding operations, the storage unit may instead return a zero information gain (ZIG) representation of the key slice.

Claims20

Dependent claims

A method for execution by one or more processing modules of a storage unit of a dispersed storage network (DSN), the storage unit including a local key, the method comprises:

receiving a slice access request from a requesting entity;
identifying the type of the slice access request as a key slice access request, wherein the key slice access request includes either a request to store a key slice or a request to recover a key slice;
when the key slice access request includes a request to store a key slice received in conjunction with the key slice access request:
encrypting the key slice using the local key to produce an encrypted key slice;
and
storing the encrypted key slice in a memory of the storage unit;
and
when the key slice access request includes a request to recover a key slice, wherein the key slice is stored as an encrypted key slice in a memory of the storage unit:
recovering the encrypted key slice from the memory of the storage unit;
and
decrypting the encrypted key slice using the local key to produce a decrypted key slice for provision to the requesting entity.

8 more elements

A storage unit of a dispersed storage network (DSN), the storage unit comprises:

a network interface;
a local memory, the local memory including a local key;
a memory device;
and
a processing module operably coupled to the network interface, the local memory, and the memory device, wherein the processing module is configured to:
receive, via the network interface, a slice access request from a requesting entity;
identify the type of the slice access request as a key slice access request, wherein the key slice access request includes either a request to store a key slice or a request to recover a key slice;
when the key slice access request includes a request to store a key slice received in conjunction with the key slice access request:
encrypt the key slice using the local key to produce an encrypted key slice;
and
store the encrypted key slice in the memory device;
and
when the key slice access request includes a request to recover a key slice, the key slice stored as an encrypted key slice in the memory device:
recover the encrypted key slice from the memory device;
and
decrypt the encrypted key slice using the local key to produce a decrypted key slice for provision to the requesting entity.

13 more elements

Dependencies are inferred from the claim text.

Cryptographic key storage in a dispersed storage network

Life of this patent

Cryptographic key storage in a dispersed storage network

Life of this patent

Abstract

Claims20