Controlling access in a dispersed storage network

Patent metadata

Field	Value
Publication number	US-9390283-B2
Application number	US-201514610331-A
Country	US
Kind code	B2
Filing date	Jan 30, 2015
Priority date	Apr 2, 2014
Publication date	Jul 12, 2016
Grant date	Jul 12, 2016

Abstract

A method begins by a set of storage units of a dispersed storage network (DSN) receiving a set of access requests from a requesting device. The method continues with a first storage unit extracting a unique identifier from a first access request, performing a deterministic function on the unique identifier to produce a first obfuscated identifier, seeking a first obfuscated access permissions list, recovering first access permissions from the first obfuscated access permissions list, and processing the first access request based on the recovered first access permissions. The method continues with the requesting device receiving a set of access responses from the set of storage units for the set of access requests for which the requesting device had favorable access permissions with at least a threshold number of storage units.

First claim

What is claimed is:

1. A method for execution by one or more processing modules of one or more computing devices of a dispersed storage network (DSN), the method comprises:
receiving, by a set of storage units, a plurality of sets of access requests from a plurality of requesting devices, wherein a requesting device of the plurality of requesting device generates a set of access requests of the plurality of sets of access requests regarding a particular type of data access;
for a first storage unit of the set of storage units:
receiving a first access request from each set of access requests of the plurality of access requests to produce a group of first access requests;
extracting a unique identifier from each first access request of the group of first access requests to produce a first group of unique identifiers;
for a unique identifier of the first group of unique identifiers, performing a deterministic function on the unique identifier to produce a first obfuscated identifier;
seeking a first obfuscated access permissions list based on the first obfuscated identifier;
when the first obfuscated access permissions list is found based on the first obfuscated identifier, recovering first access permissions from the first obfuscated access permissions list based on the first obfuscated identifier for a first requesting device of the plurality of requesting devices associated with the unique identifier of the first group of unique identifiers; and
processing the first access request for the first requesting device based on the recovered first access permissions; and

receiving, by the plurality of requesting devices, a set of access responses from the set of storage units for each set of access requests of the plurality of access requests for which a corresponding requesting device had favorable access permissions with at least a threshold number of storage units of the set of storage units.

2. The method of claim 1 further comprises:
for a second storage unit of the set of storage units:
receiving a second access request from each set of access requests of the plurality of access requests to produce a group of second access requests;
extracting a unique identifier from each second access request of the group of second access requests to produce a second group of unique identifiers;
for a unique identifier of the second group of unique identifiers, performing the deterministic function on the unique identifier of the second group of unique identifiers to produce a second obfuscated identifier;
seeking a second obfuscated access permissions list based on the second obfuscated identifier;
when the second obfuscated access permissions list is found based on the second obfuscated identifier, recovering second access permissions from the second obfuscated access permissions list based on the second obfuscated identifier for a second requesting device of the plurality of requesting devices associated with the unique identifier of the second group of unique identifiers; and
processing the second access request for the second requesting device based on the recovered second access permissions.

3. The method of claim 1 , wherein the performing the deterministic function comprises one or more of:
performing a hash function on the unique identifier;
performing a hash based message authentication code function on the unique identifier;
performing a mask generating function on the unique identifier;
performing a sponge function on the unique identifier; and
performing a cyclic redundancy check function on the unique identifier.

4. The method of claim 1 further comprises:
the first access request including a read request; and
the threshold number corresponding to a read threshold number.

5. The method of claim 1 further comprises:
the first access request including a write request; and
the threshold number corresponding to a write threshold number.

6. The method of claim 1 further comprises:
when the first obfuscated access permissions list is not found, sending a rejection response or ignoring the first access request.

7. The method of claim 1 further comprises:
when the first obfuscated access permissions list is found, determining whether the first requesting device has permission for the first access request based on the recovered first access permissions.

8. The method of claim 1 further comprises:
for the first storage unit of the set of storage units:
for a second unique identifier of the first group of unique identifiers, performing the deterministic function on the second unique identifier to produce a second obfuscated identifier;
seeking a second obfuscated access permissions list based on the second obfuscated identifier;
when the second obfuscated access permissions list is found based on the second obfuscated identifier, recovering second access permissions from the second obfuscated access permissions list based on the second obfuscated identifier for a second requesting device of the plurality of requesting devices associated with the second unique identifier of the first group of unique identifiers; and
processing a second access request for the second requesting device based on the recovered second access permissions.

9. The method of claim 8 , wherein the seeking the second obfuscated access permissions list comprises:
determining whether the second obfuscated identifier references the first obfuscated access permissions list; and
when the second obfuscated identifier does reference the first obfuscated access permissions list, recovering the second access permissions from the first obfuscated access permissions list based on the second obfuscated identifier.

10. A computer readable storage medium comprises:
at least one memory section that stores operational instructions that, when executed by one or more processing modules of one or more computing devices of a dispersed storage network (DSN), causes the one or more computing devices to:
receive, by a set of storage units, a plurality of sets of access requests from a plurality of requesting devices, wherein a requesting device of the plurality of requesting device generates a set of access requests of the plurality of sets of access requests regarding a particular type of data access;
for a first storage unit of the set of storage units:
receive a first access request from each set of access requests of the plurality of access requests to produce a group of first access requests;
extract a unique identifier from each first access request of the group of first access requests to produce a first group of unique identifiers;
for a unique identifier of the first group of unique identifiers, perform a deterministic function on the unique identifier to produce a first obfuscated identifier;
seek a first obfuscated access permissions list based on the first obfuscated identifier;
when the first obfuscated access permissions list is found based on the first obfuscated identifier, recover first access permissions from the first obfuscated access permissions list based on the first obfuscated identifier for a first requesting device of the plurality of requesting devices associated with the unique identifier of the first group of unique identifiers; and
process the first access request for the first requesting device based on the recovered first access permissions; and

receive, by the plurality of requesting devices, a set of access responses from the set of storage units for each set of access requests of the plurality of access requests for which a corresponding requesting device had favorable access permissions with at least a threshold number of storage units of the set of storage units.

Assignees

• Cleversafe Inc
• IBM

Inventors

• Resch Jason K
• Leggette Wesley

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L67/1097 Primary

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title