Patent ID: 8015211

Claim:
A distributed data storage system comprising: a plurality of peer nodes coupled by a communications network to form a peer-to-peer computing network; and a plurality of storage areas that stores data objects, each of the plurality of storage areas being locally coupled to a corresponding different one of the plurality of peer nodes, wherein each of the plurality of peer nodes includes one or more metadata indexes that store metadata associated with the data objects, a query processing module that processes queries from the other peer nodes and identifies one or more of the data objects based on metadata constraints specified within the queries, and an access control module that controls access to one or more of the data objects that are stored in the storage area coupled to the respective peer node, wherein the peer nodes store an encryption key within the storage areas by dividing the encryption key into a plurality of bit sequences after the encryption key has been used to encrypt a data object to create an encrypted data object, and by storing a different one of each of the plurality of bit sequences independently as a separate data object within a different one of the plurality of storage areas, each bit sequence having a unique identifier that is associated with a different one of the plurality of peer nodes, wherein a first one of the plurality of peer nodes attempts to subsequently reconstruct the encryption key from the plurality of bit sequences by obtaining the unique identifier of each bit sequence, identifying which of the plurality peer nodes are associated with the unique identifiers of the plurality of bit sequences, and requesting a copy of each bit sequence from a different one of the identified peer nodes that are each coupled to a different one of the plurality of storage areas, such that the reconstructed encryption key may be used to decrypt the encrypted data object, and wherein each of the identified peer nodes provides a copy of the requested bit sequence responsive to determining, using its respective access control module, whether the first one of the plurality of peer nodes is authorized to access the requested bit sequence stored in the storage area coupled to the respective identified peer node.