Access policy updates in a dispersed storage network

Patent metadata

Field	Value
Publication number	US-2016337377-A1
Application number	US-201615221731-A
Country	US
Kind code	A1
Filing date	Jul 28, 2016
Priority date	Dec 29, 2009
Publication date	Nov 17, 2016
Grant date	—

Abstract

A method for execution in a dispersed storage network operates to determine one or more slice names of one or more slices and determine whether to establish a new access policy corresponding to the one or more slices. When the new access policy is to be established, the method determines a timestamp; determines a new access policy; and sends the new access policy and the timestamp to one or more storage units that store the one or more slices.

First claim

What is claimed is:

1 . A method for execution by a processing system of a dispersed storage network that includes a processor, the method comprises:
determining one or more slice names of one or more slices; determining whether to establish a new access policy corresponding to the one or more slices; when the new access policy is to be established:
determining a timestamp;
determining a new access policy; and
sending the new access policy and the timestamp to one or more storage units that store the one or more slices.

2 . The method of claim 1 , wherein the one or more slice names include one of: a plurality of discrete and non-contiguous slice names, a contiguous range of slice names associated with a common data segment or a contiguous range of slice names associated with a common data object.

3 . The method of claim 1 , wherein determining one or more slice names is based on one or more of an access policy reconsideration request, where a previous access policy update ended, a starting DSN address, a lookup, a command, a request, a random number, a vault ID, a data object ID, or a virtual DSN address to a physical location table.

4 . The method of claim 1 , wherein determining whether to establish the new access policy is based on one or more of: an access policy reconsideration message, a current access policy for the one or more slice names, a command, a past history of access policy reconsiderations, a history of slice access sequences, a request, a predetermination, a data type, a security indicator, a priority indicator, a DSN memory system status indicator, a vault utilization indicator, or a DS managing unit message.

5 . The method of claim 1 , wherein determining the new access policy is based on one or more of: is based on one or more of: an access policy reconsideration message, a current access policy for the one or more slice names, a command, a past history of access policy reconsiderations, a history of slice access sequences, a request, a predetermination, a data type, a security indicator, a priority indicator, a DSN memory system status indicator, a vault utilization indicator, or a DS managing unit message.

6 . The method of claim 1 , wherein determining the one or more slice names and determining whether to establish a new access policy are in response to receiving a reconsideration message that includes the one or more slice names.

7 . The method of claim 6 , further comprising:
generating a reconsideration response message that indicates a denial of reconsideration when the new access policy is not established.

8 . A processing system of a dispersed storage network comprises:
at least one processor; a memory that stores operational instructions, that when executed by the at least one processor cause the processing system to:
determine one or more slice names of one or more slices;
determine whether to establish a new access policy corresponding to the one or more slices;
when the new access policy is to be established:
determine a timestamp;
determine a new access policy; and
send the new access policy and the timestamp to one or more storage units that store the one or more slices.

9 . The processing system of claim 8 , wherein the one or more slice names include one of: a plurality of discrete and non-contiguous slice names, a contiguous range of slice names associated with a common data segment or a contiguous range of slice names associated with a common data object.

10 . The processing system of claim 8 , wherein determining one or more slice names is based on one or more of an access policy reconsideration request, where a previous access policy update ended, a starting DSN address, a lookup, a command, a request, a random number, a vault ID, a data object ID, or a virtual DSN address to a physical location table.

11 . The processing system of claim 8 , wherein determining whether to establish the new access policy is based on one or more of: an access policy reconsideration message, a current access policy for the one or more slice names, a command, a past history of access policy reconsiderations, a history of slice access sequences, a request, a predetermination, a data type, a security indicator, a priority indicator, a DSN memory system status indicator, a vault utilization indicator, or a DS managing unit message.

12 . The processing system of claim 8 , wherein determining the new access policy is based on one or more of: is based on one or more of: an access policy reconsideration message, a current access policy for the one or more slice names, a command, a past history of access policy reconsiderations, a history of slice access sequences, a request, a predetermination, a data type, a security indicator, a priority indicator, a DSN memory system status indicator, a vault utilization indicator, or a DS managing unit message.

13 . The processing system of claim 8 , wherein determining the one or more slice names and determining whether to establish a new access policy are in response to receiving a reconsideration message that includes the one or more slice names.

14 . The processing system of claim 13 , wherein the operational instructions, when executed by the at least one processor, further cause the processing system to:
generate a reconsideration response message that indicates a denial of reconsideration when the new access policy is not established.

15 . A non-transitory computer readable storage medium comprises:
at least one memory section that stores operational instructions that, when executed by a processing system of a dispersed storage network (DSN) that includes a processor and a memory, causes the processing system to:
determine one or more slice names of one or more slices;
determine whether to establish a new access policy corresponding to the one or more slices;
when the new access policy is to be established:
determine a timestamp;
determine a new access policy; and
send the new access policy and the timestamp to one or more storage units that store the one or more slices.

16 . The non-transitory computer readable storage medium of claim 15 , wherein the one or more slice names include one of: a plurality of discrete and non-contiguous slice names, a contiguous range of slice names associated with a common data segment or a contiguous range of slice names associated with a common data object.

17 . The non-transitory computer readable storage medium of claim 15 , wherein determining one or more slice names is based on one or more of an access policy reconsideration request, where a previous access policy update ended, a starting DSN address, a lookup, a command, a request, a random number, a vault ID, a data object ID, or a virtual DSN address to a physical location table.

18 . The non-transitory computer readable storage medium of claim 15 , wherein determining whether to establish the new access policy is based on one or more of: an access policy reconsideration message, a current access policy for the one or more slice names, a command, a past history of access policy reconsiderations, a history of slice access sequences, a request, a predetermination, a data type, a security indicator, a priority indicator, a DSN memory system status indicator, a vault utilization indicator, or a DS managing unit message.

19 . The non-transitory computer readable storage medium of claim 15 , wherein determining the new access policy is based on one or more of: is based on one or more of: an access policy reconsideration message,

Assignees

• IBM

Inventors

• Grube Gary W
• Resch Jason K

Classifications

• H04L67/1097 Primary

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/108 Primary

  when the policy decisions are valid for a limited amount of time · CPC title

• G06F3/061

  Improving I/O performance · CPC title

• G06F2221/2137

  Time limited access, e.g. to a computer or data · CPC title