Dispersed storage network secure hierarchical file directory

Abstract

A method to generate a secure hierarchical file directory system begins by a processing module, for a child level directory of the secure hierarchical file directory system, obtaining a unique inner encryption key for encrypting the child level directory and creating one or more outer encryption keys for encrypting the unique inner encryption key. For each of the one or more outer encryption keys, the method continues with the processing module encrypting the unique inner encryption key to create one or more encrypted inner encryption keys. The method continues with the processing module creating one or more entries in a parent level directory, where each entry includes a path name, a dispersed storage network (DSN) address of the child level directory, a corresponding one of the one or more encrypted inner encryption keys, and an indicator for a corresponding one of the one or more outer encryption keys.

What is claimed is: 
     
         1 . A method for execution by a processing module to generate a secure hierarchical file directory system, the method comprises:
 for a child level directory of the secure hierarchical file directory system, obtaining a unique inner encryption key for encrypting the child level directory;   creating one or more outer encryption keys for encrypting the unique inner encryption key based on an access security level for accessing the child level directory;   for each of the one or more outer encryption keys, encrypting the unique inner encryption key to create one or more encrypted inner encryption keys; and   creating one or more entries in a parent level directory of the secure hierarchical file directory system, wherein each of the one or more entries includes a path name, a dispersed storage network (DSN) address of the child level directory, a corresponding one of the one or more encrypted inner encryption keys, and an indicator for a corresponding one of the one or more outer encryption keys.   
     
     
         2 . The method of  claim 1 , wherein the creating the one or more outer encryption keys comprises at least one of:
 creating one of the one or more outer encryption keys based on a user identification code;   creating the one of the one or more outer encryption keys based on a password associated with a user device or a group of user devices; and   creating the one of the one or more outer encryption keys based on a public key of a public/private key associated with the user device.   
     
     
         3 . The method of  claim 1 , wherein the creating the one or more outer encryption keys comprises:
 determining the access security level to be one of:
 each valid user device having an individual outer encryption key; 
 a group of user devices having a common group outer encryption key; and 
 valid user devices using a common outer encryption key; and 
   creating the one or more outer encryption keys in accordance with access security level.   
     
     
         4 . The method of  claim 1  further comprises:
 encrypting the child level directory using the unique inner encryption key to produce an encrypted child level directory; 
 dispersed storage error encoding the encrypted child level directory to produce a set of child directory encoded slices; and 
 storing the set of child directory encoded slices in a DSN memory in accordance with the DSN address. 
 
     
     
         5 . The method of  claim 1  further comprises:
 for a second child level directory of the secure hierarchical file directory system, obtaining a second unique inner encryption key for encrypting the second child level directory; 
 creating one or more second outer encryption keys for encrypting the second unique inner encryption key based on a second access security level for accessing the second child level directory; 
 for each of the one or more second outer encryption keys, encrypting the second unique inner encryption key to create one or more second encrypted inner encryption keys; and 
 creating one or more new entries in the parent level directory of the secure hierarchical file directory system, wherein each of the one or more new entries includes a second path name, a second DSN address of the second child level directory, a corresponding one of the one or more second encrypted inner encryption keys, and a second indicator for a corresponding one of the one or more second outer encryption keys. 
 
     
     
         6 . A method comprises:
 receiving a request to retrieve a data object stored in a dispersed storage network (DSN) memory;   obtaining a directory file associated with the data object from the DSN memory;   identifying a directory entry of the directory file based on the request to access the data object to produce an identified directory entry;   entering a loop that includes:
 extracting a DSN address of an encrypted child object from the identified directory entry; 
 extracting an encrypted content key from the identified directory entry based on a requesting entity identifier (ID) of the request to access the data object; 
 decrypting the encrypted content key utilizing an affinity key associated with the requesting entity ID to produce a content key; 
 retrieving the encrypted child object from the DSN memory using the DSN address of the child object; 
 decrypting the encrypted child object using the content key to produce a child object; 
 determining whether the child object is the data object; 
 when the child object is the data object, exiting the loop; and 
 when the child object is not the data object, identifying a next directory entry of the child object as the identified directory entry and repeating the loop. 
   
     
     
         7 . The method of  claim 6 , wherein the obtaining the directory file associated with the data object from the DSN memory comprises:
 identifying a DSN address of the directory file based on the request to retrieve the data object;   retrieving at least a decode threshold number of encoded directory slices from the DSN memory utilizing the DSN address of the directory file;   decoding the at least the decode threshold number of encoded directory slices using a dispersed storage error coding function to produce an encrypted directory file; and   decrypting the encrypted directory file to produce the directory file.   
     
     
         8 . The method of  claim 6 , wherein the identifying the directory entry of the directory file comprises:
 comparing a pathname of the request to retrieve the data object to one or more pathnames of the first directory file; and   identifying the directory entry associated with a favorably comparing pathname of the one or more pathnames of the first directory file to produce the identified directory entry.   
     
     
         9 . The method of  claim 6 , wherein the affinity key comprises at least one of:
 a private key of a public-private key pair associated with the requesting entity ID;   an access key obtained from a parent directory;   a common group key associated with a group of requesting entity identifiers, wherein the group of requesting identifiers includes the requesting entity ID; and   a stored key.   
     
     
         10 . The method of  claim 6 , wherein the identifying the next directory entry of the child object as the identified directory entry comprises:
 comparing a pathname of the request to retrieve the data object to one or more pathnames of the child object; and   identifying the directory entry associated with a favorably comparing pathname of the one or more pathnames of the child object to produce the identified next directory entry.   
     
     
         11 . A dispersed storage (DS) module comprises:
 a first module, when operable within a computing device, causes the computing device to:
 for a child level directory of a secure hierarchical file directory system, obtain a unique inner encryption key for encrypting the child level directory; 
   a second module, when operable within the computing device, causes the computing device to:
 create one or more outer encryption keys for encrypting the unique inner encryption key based on an access security level for accessing the child level directory; and 
 for each of the one or more outer encryption keys, encrypt the unique inner encryption key to create one or more encrypted inner encryption keys; and 
   a third module, when operable within the computing device, causes the computing device to:
 create one or more entries in a parent level directory of the secure hierarchical file directory system, wherein each of the one or more entries includes a path name, a dispersed storage network (DSN) address of the child level directory, a corresponding one of the one or more encrypted inner encryption keys, and an indicator for a corresponding one of the one or more outer encryption keys. 
   
     
     
         12 . The DS module of  claim 11 , wherein the second module functions to create the one or more outer encryption keys by at least one of:
 creating one of the one or more outer encryption keys based on a user identification code;   creating the one of the one or more outer encryption keys based on a password associated with a user device or a group of user devices; and   creating the one of the one or more outer encryption keys based on a public key of a public/private key associated with the user device.   
     
     
         13 . The DS module of  claim 11 , wherein the second module functions to create the one or more outer encryption keys by:
 determining the access security level to be one of:
 each valid user device having an individual outer encryption key; 
 a group of user devices having a common group outer encryption key; and 
 valid user devices using a common outer encryption key; and 
   creating the one or more outer encryption keys in accordance with access security level.   
     
     
         14 . The DS module of  claim 11  further comprises:
 a fourth module, when operable within the computing device, causes the computing device to:
 encrypt the child level directory using the unique inner encryption key to produce an encrypted child level directory; 
 dispersed storage error encode the encrypted child level directory to produce a set of child directory encoded slices; and 
 store the set of child directory encoded slices in a DSN memory in accordance with the DSN address. 
 
 
     
     
         15 . The DS module of  claim 11  further comprises:
 the first module further functions to, for a second child level directory of the secure hierarchical file directory system, obtain a second unique inner encryption key for encrypting the second child level directory; 
 the second module further functions to:
 create one or more second outer encryption keys for encrypting the second unique inner encryption key based on a second access security level for accessing the second child level directory; and 
 for each of the one or more second outer encryption keys, encrypt the second unique inner encryption key to create one or more second encrypted inner encryption keys; and 
 
 the third module further functions to create one or more new entries in the parent level directory of the secure hierarchical file directory system, wherein each of the one or more new entries includes a second path name, a second DSN address of the second child level directory, a corresponding one of the one or more second encrypted inner encryption keys, and a second indicator for a corresponding one of the one or more second outer encryption keys. 
 
     
     
         16 . A dispersed storage (DS) module comprises:
 a first module, when operable within a computing device, causes the computing device to:
 receive a request to retrieve a data object stored in a dispersed storage network (DSN) memory; and 
 obtain a directory file associated with the data object from the DSN memory; 
   a second module, when operable within the computing device, causes the computing device to:
 identify a directory entry of the directory file based on the request to access the data object to produce an identified directory entry; and 
   a third module, when operable within the computing device, causes the computing device to enter a loop where the third module causes the computing device to:
 extract a DSN address of an encrypted child object from the identified directory entry; 
 extract an encrypted content key from the identified directory entry based on a requesting entity identifier (ID) of the request to access the data object; 
 decrypt the encrypted content key utilizing an affinity key associated with the requesting entity ID to produce a content key; 
 retrieve the encrypted child object from the DSN memory using the DSN address of the child object; 
 decrypt the encrypted child object using the content key to produce a child object; 
 determine whether the child object is the data object; 
 when the child object is the data object, exit the loop; and 
 when the child object is not the data object, identify a next directory entry of the child object as the identified directory entry and repeat the loop. 
   
     
     
         17 . The DS module of  claim 16 , wherein the first module functions to obtain the directory file associated with the data object from the DSN memory by:
 identifying a DSN address of the directory file based on the request to retrieve the data object;   retrieving at least a decode threshold number of encoded directory slices from the DSN memory utilizing the DSN address of the directory file;   decoding the at least the decode threshold number of encoded directory slices using a dispersed storage error coding function to produce an encrypted directory file; and   decrypting the encrypted directory file to produce the directory file.   
     
     
         18 . The DS module of  claim 16 , wherein the second module functions to identify the directory entry of the directory file by:
 comparing a pathname of the request to retrieve the data object to one or more pathnames of the directory file; and   identifying the directory entry associated with a favorably comparing pathname of the one or more pathnames of the directory file to produce the identified directory entry.   
     
     
         19 . The DS module of  claim 16 , wherein the affinity key comprises at least one of:
 a private key of a public-private key pair associated with the requesting entity ID;   an access key obtained from a parent directory;   a common group key associated with a group of requesting entity identifiers, wherein the group of requesting identifiers includes the requesting entity ID; and   a stored key.   
     
     
         20 . The DS module of  claim 16 , wherein the third module functions to identify the next directory entry of the child object as the identified directory entry by:
 comparing a pathname of the request to retrieve the data object to one or more pathnames of the child object; and   identifying the directory entry associated with a favorably comparing pathname of the one or more pathnames of the child object to produce the identified next directory entry.