Dispersed storage system with identity unit selection and methods for use therewith

Patent metadata

Field	Value
Publication number	US-10120569-B2
Application number	US-201414457907-A
Country	US
Kind code	B2
Filing date	Aug 12, 2014
Priority date	Oct 3, 2013
Publication date	Nov 6, 2018
Grant date	Nov 6, 2018

Abstract

A method for execution by one or more processing modules of a dispersed storage network (DSN) includes receiving a data access request for at least one data segment stored in the DSN. One of a plurality of identity units is selected, based on the data access request. The method determines, via the selected one of the plurality of identity units, whether to allow the data access request. The data access request is processed, when the data access request is allowed via the selected one of the plurality of identity units.

First claim

What is claimed is:

1. A method for execution in a dispersed storage network (DSN), the method comprises:
receiving, by a first computing device of the DSN, a data access request relating to at least one set of encoded data slices stored in the DSN, the data access request including requesting entity credentials and a data request having an associated request type, wherein at least a threshold number of encoded data slices of the set of encoded data slices is required to recover a corresponding data segment;
selecting, by the first computing device, one of a plurality of identity units based on the requesting entity credentials;
determining, via the selected one of the plurality of identity units, whether to allow the data access request;
when the selected one of the plurality of identity units indicates that the data access request is allowed based on the requesting entity credentials, selecting, by the first computing device or a first storage unit of a set of storage units, another one of the plurality of identity units based on the data request;
determining, via the selected other one of the plurality of identity units, whether to allow the associated request type of the data request based on access control information for at least a portion of a vault identified by a vault identifier associated with the requesting entity credentials, wherein the at least a portion of the vault comprises a sub-vault associated with the requesting

entity credentials: and
when the associated request type of the data request is allowed by the selected other one of the plurality of identity units, performing, by the first storage unit, a first corresponding portion of the data access request.

2. The method of claim 1 further comprises:
when the first computing device selects the another one of the plurality of identity units and when the associated request type of the data request is allowed by the selected other one of the plurality of identity units, issuing, by the first computing device, corresponding portions of the data access request to the set of storage units.

3. The method of claim 1 further comprises:
receiving, by the first storage unit, the first corresponding portion of the data access request from the first computing device; and
in response to receiving the first corresponding portion of the data access request, selecting, by the first storage unit, the another one of the plurality of identity units.

4. The method of claim 1 further comprises:
when the selected one of the plurality of identity units indicates that the data access request is not allowed, denying, by the first computing device or the first storage unit, the data access request.

5. The method of claim 1 further comprising:
denying the data access request, when the data access request is not allowed via the selected one of the plurality of identity units.

6. A dispersed storage and task (DST) processing unit comprises:
one or more network interfaces; a memory comprising instructions; and
processing circuitry in communication with the memory, wherein the processing circuitry executes the instructions to:
receive, via the one or more network interfaces, a data access request relating to at least one set of encoded data slices stored in a dispersed storage network (DSN), the data access request including requesting entity credentials and a data request, wherein at least a threshold number of encoded data slices of the set of encoded data slices is required to recover a corresponding data segment;
select one of a plurality of identity units based on the requesting entity credentials;
receive, from the selected one of the plurality of identity units, a first indication allowing the data access request based on the requesting entity credentials;
in response to the first indication, select another one of the plurality of identity units based on the data request;
receive, from the selected other one of the plurality of identity units, a second indication allowing the data access request based on access control information for at least a portion of a vault identified by a vault identifier associated with the requesting entity credentials, wherein the at least a portion of the vault comprises a sub-vault associated with the requesting entity

credentials: and
issue, via the one or more network interfaces, corresponding portions of the data access request to a set of storage units.

7. The DST processing unit of claim 6 , wherein the processing circuitry further executes the instructions to:
receive, via the one or more network interfaces, a favorable indication when a first storage unit of the set of storage units successfully executed a corresponding portion of the data access request; and
receive, via the one or more network interfaces, a denial message when the first storage unit did not successfully execute the corresponding portion of the data access request.

8. The DST processing unit of claim 6 , wherein the processing circuitry further executes the instructions to:
deny the data access request when the first indication is not received.

9. The DST processing unit of claim 6 , wherein the processing circuitry further executes the instructions to:
deny the data access request when the second indication is not received.

10. A non-transitory computer readable storage medium comprises:
a first memory section that stores operational instructions that, when executed by a computing device of a dispersed storage network (DSN), causes the computing device to:
receive a data access request relating to at least one set of encoded data slices stored in the DSN, wherein the data access request includes requesting entity credentials and a data request having an associated request type; and
select one of a plurality of identity units based on the requesting entity credentials;
a second memory section that stores operational instructions that, when executed by the selected one of the plurality of identity units, causes the selected one of the plurality of identity units to determine whether to allow the data access request based on the requesting entity credentials;
a third memory section that stores operational instructions that, when executed by the computing device or a storage unit of the DSN, causes the computing device or the storage unit to, when the selected one of the plurality of identity units indicates that the data access request is allowed based on the requesting entity credentials, select another one of the plurality of identity units based on the data request;
a fourth memory section that stores operation instructions that, when executed by selected other one of the plurality of identity units, causes selected other one of the plurality of identity units to determine whether to allow the associated request type of the data request based on access control information for at least a portion of a vault identified by a vault identifier associated with the requesting entity credentials, wherein the at least a portion of the vault comprises a sub-vault associated with the requesting entity credentials; and
a fifth memory section that stores operational instructions that, when executed by the storage unit, causes the storage unit to, when the associated request type of the data request is allowed by the selected other one of the plurality of identity units, perform a first corresponding portion of the data access request.

11. The non-transitory computer readable storage medium of claim 10 further comprises:
when the computing device selects the another one of the plurality of identity units and when the associated request type of the data request is allowed by the selected other one of the plura

Assignees

• Cleversafe Inc
• IBM

Inventors

• Leggette Wesley
• Resch Jason K
• Smith Eric Gunnar

Classifications

• H04L67/1095

  Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes · CPC title

• G06F3/0647

  Migration mechanisms · CPC title

• G06F2221/2149

  Restricted operating environment · CPC title

• G06F2212/1052

  Security improvement · CPC title

• G06F11/1076

  Parity data used in redundant arrays of independent storages, e.g. in RAID systems · CPC title