Protecting encoded data slice integrity at various levels

Patent metadata

Field	Value
Publication number	US-10440107-B2
Application number	US-201715403228-A
Country	US
Kind code	B2
Filing date	Jan 11, 2017
Priority date	Jan 26, 2016
Publication date	Oct 8, 2019
Grant date	Oct 8, 2019

Abstract

A method for execution within a dispersed storage network (DSN), where the method begins by calculating, utilizing a first integrity check value function, an integrity check value of a first type for each encoded data slice of a set of encoded data slices to produce a corresponding set of integrity check values. The method continues by issuing, via a network, one or more sets of write slice requests 1-n to a set of storage units 1-n within the DSN, where the one or more sets of write slice requests include a plurality of sets of the encoded data slices and a corresponding plurality of sets of the integrity check values. The method continues, when verifying integrity of a received encoded data slice, by a storage unit calculating, utilizing a second integrity check value function, an integrity check value of a second type for the encoded data slice.

First claim

What is claimed is:

1. A method for execution by one or more processing modules of one or more computing devices of a dispersed storage network (DSN), the method comprises:
calculating, utilizing a first integrity check value function, an integrity check value of a first type for each encoded data slice of a set of encoded data slices to produce a corresponding set of integrity check values;
issuing, via a network, one or more sets of write slice requests 1-n to a set of storage units 1-n within the DSN, where the one or more sets of write slice requests include a plurality of sets of the encoded data slices and a corresponding plurality of sets of the integrity check values; and
when verifying integrity of a received encoded data slice, a storage unit calculating, utilizing a second integrity check value function, an integrity check value of a second type for the encoded data slice; and
when data is to be recovered, the storage unit issuing a read response to a DSN processing unit when the storage unit verifies integrity of a recovered encoded data slice utilizing the integrity check value of the second type; and
wherein the storage unit issuing a read response includes: retrieving the encoded data slice, recalculating the integrity check value of the second type, indicating a favorable verified integrity when the recalculated integrity check value of the second type substantially matches a retrieved integrity check value of the second type, generating the read response to include the retrieved encoded data slice, the integrity check value of the second type, and an identifier to identify the second integrity check value function, and sending the read response to the DSN processing unit, and where the DSN processing unit dispersed storage error decodes a decode threshold number of received verified encoded data slices for each set of encoded data slices to reproduce the data.

2. The method of claim 1 , wherein the data is divided into a plurality of data segments, and wherein each data segment is dispersed storage error encoded to produce a corresponding set of encoded data slices of a plurality of sets of encoded data slices.

3. The method of claim 1 , wherein the calculating an integrity check value of a first type includes any of: selecting the first integrity check value function, performing corresponding selected one-way deterministic function on one or more of: the encoded data slice, a slice name of the encoded data slice, or a revision number of encoded data slice, to produce a corresponding integrity check value of a first type.

4. The method of claim 3 , wherein the first integrity check value function includes any of: a predetermination, interpreting system registry info, interpreting a request, or interpreting available processing resources.

5. The method of claim 3 , wherein the selected one-way deterministic function includes any of: a hash function, a sponge function, or a mask generating function.

6. The method of claim 1 , wherein the issuing includes: generating each of the one or more sets of write slice requests to include one or more encoded data slices, one or more corresponding integrity check values, and an identifier to identify the first integrity check value function and sending, via the network, the write slice requests to the set of storage units.

7. The method of claim 1 , wherein the verifying includes: calculating the integrity check value of the first type for the received encoded data slice to produce a calculated integrity check value and indicating favorably verified when the calculated integrity check value substantially matches a corresponding received integrity check value.

8. The method of claim 7 , wherein the calculating the integrity check value of the second type includes: selecting the second integrity check value function, performing a corresponding selected one-way deterministic function on one or more of the encoded data slices, a slice name of the encoded data slice, a revision number of encoded data slice to produce a corresponding integrity check value of the second type, and storing the integrity check value of the second type.

9. The method of claim 8 , wherein the second integrity check value function is any of: a predetermination, interpreting system registry info, interpret a request, or interpreting available storage unit processing resources.

10. A dispersed storage network (DSN), the DSN comprises:
one or more DSN storage units; and
a DSN processing module operably coupled to the one or more DSN storage units, wherein the DSN processing module functions to:
calculate, utilizing a first integrity check value function, an integrity check value of a first type for each encoded data slice of a set of encoded data slices to produce a corresponding set of integrity check values;
issue, via a network, one or more sets of write slice requests 1-n to a set of the one or more DSN storage units 1-n, where the one or more sets of write slice requests include a plurality of sets of the encoded data slices and a corresponding plurality of sets of the integrity check values; and
when verifying integrity of a received encoded data slice, a DSN storage unit calculates, utilizing a second integrity check value function, an integrity check value of a second type for the encoded data slice; and
when data is to be recovered, the DSN storage unit issues a read response to the DSN processing module when the DSN storage unit verifies integrity of a recovered encoded data slice utilizing the integrity check value of the second type; and
wherein the DSN storage unit issuing a read response includes: retrieving the encoded data slice, recalculating the integrity check value of the second type, indicating a favorable verified integrity when the recalculated integrity check value of the second type substantially matches a retrieved integrity check value of the second type, generating the read response to include the retrieved encoded data slice, the integrity check value of the second type, and an identifier to identify the second integrity check value function, and sending the read response to the DSN processing module, and where the DSN processing module dispersed storage error decodes a decode threshold number of received verified encoded data slices for each set of encoded data slices to reproduce the data.

11. The computing device of claim 10 , wherein the data is divided into a plurality of data segments, and wherein each data segment is dispersed storage error encoded to produce a corresponding set of encoded data slices of a plurality of sets of encoded data slices.

12. The computing device of claim 10 , wherein the calculating an integrity check value of a first type includes any of: selecting the first integrity check value function, performing corresponding selected one-way deterministic function on one or more of: the encoded data slice, a slice name of the encoded data slice, or a revision number of encoded data slice, to produce a corresponding integrity check value of a first type.

13. The computing device of claim 12 , wherein the first integrity check value function includes any of: a predetermination, interpreting system registry info, interpreting a request, or interpreting available processing resources.

14. The computing device of claim 12 , wherein the selected one-way deterministic function includes any of: a hash function, a sponge function, or a mask generating function.

15. The computing device of claim 10 , wherein the issuing includes: generating each of the one or more sets of write slice requests to include one or more encoded data slices, one or more correspon

Assignees

• IBM

Inventors

• Mcshane Niall J
• Resch Jason K
• Viraraghavan Praveen
• Volvovski Ilya

Classifications

• G06F12/0837

  with software control, e.g. non-cacheable data · CPC title

• G06F11/1076

  Parity data used in redundant arrays of independent storages, e.g. in RAID systems · CPC title

• H03M13/3761

  using code combining, i.e. using combining of codeword portions which may have been transmitted separately, e.g. Digital Fountain codes, Raptor codes or Luby Transform [LT] codes · CPC title

• G06F12/0813

  with a network or matrix configuration · CPC title

• H04L67/1097

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title