Dispersed storage system with sub-vaults and methods for use therewith

Patent metadata

Field	Value
Publication number	US-9841899-B2
Application number	US-201414451610-A
Country	US
Kind code	B2
Filing date	Aug 5, 2014
Priority date	Oct 3, 2013
Publication date	Dec 12, 2017
Grant date	Dec 12, 2017

Abstract

A method for execution by one or more processing modules of a dispersed storage network (DSN) includes receiving a data access request for at least one data segment stored in the DSN. A vault associated with data access request is identified along with one of a plurality of sub-vaults associated with the vault. Access information corresponding to the one of the plurality of sub-vaults is retrieved to determine whether the access request is allowed. When the access request is allowed, a sub-vault directory associated with the one of the plurality of sub-vaults is retrieved to identify a DSN address corresponding to the data access request, and fulfilling the data access request based on the DSN address.

First claim

What is claimed is:

1. A method for execution by one or more processing modules of one or more computing devices of a dispersed storage network (DSN), the method comprises:
receiving a data access request for at least one data segment stored in the DSN;
identifying a vault associated with the data access request and one of a plurality of sub-vaults associated with the vault including:
issuing a plurality of requests to a set of distributed storage and/or task (DST) execution units to retrieve at least one set of vault list slices that are distributedly stored in the set of DST execution units, wherein a decode threshold number of vault list slices are needed to recover a vault list;
receiving at least the decode threshold number of vault list slices in responses to the plurality of requests from the set of DST execution units;
decoding the at least the decode threshold number of vault list slices to produce the vault list; and
identifying the vault based on the vault list;

retrieving access information corresponding to the one of the plurality of sub-vaults to determine whether the data access request is allowed; and
when the data access request is allowed, retrieving a sub-vault directory associated with the one of the plurality of sub-vaults to identify a DSN address corresponding to the data access request, and fulfilling the data access request based on the DSN address.

2. The method of claim 1 wherein the data access request includes a requesting entity identifier (ID) and the vault is identified based on the requesting entity ID.

3. The method of claim 2 wherein the one of the plurality of sub-vaults is identified based on an identification of the vault and based on a sub-vault ID included in the data access request.

4. The method of claim 1 wherein retrieving the access information corresponding to the one of the plurality of sub-vaults includes retrieving a vault directory corresponding to the vault associated with the data access request.

5. The method of claim 4 wherein the vault directory indicates an address for each of the plurality of sub-vaults associated with the vault.

6. The method of claim 1 wherein determining whether the data access request is allowed includes determining a request type associated with the data access request and allowing the data access request when the access information indicates the request type is allowed.

7. The method of claim 6 wherein the data access request indicates the request type as one of: a read request, or a write request.

8. A dispersed storage and task (DST) processing unit comprises:
at least one module, when operable within a computing device, that causes the computing device to:
receive a data access request for at least one data segment stored in a dispersed storage network (DSN);
identify a vault associated with the data access request and one of a plurality of sub-vaults associated with the vault including to:
issue a plurality of requests to a set of distributed storage and/or task (DST) execution units to retrieve at least one set of vault list slices that are distributedly stored in the set of DST execution units, wherein a decode threshold number of vault list slices are needed to recover a vault list;
receive at least the decode threshold number of vault list slices in responses to the plurality of requests from the set of DST execution units;
decode the at least the decode threshold number of vault list slices to produce the vault list; and
identify the vault based on the vault list;

retrieve access information corresponding to the one of the plurality of sub-vaults to determine whether the data access request is allowed; and
when the data access request is allowed, retrieve a sub-vault directory associated with the one of the plurality of sub-vaults to identify a DSN address corresponding to the data access request, and fulfilling the data access request based on the DSN address.

9. The DST processing unit of claim 8 wherein the data access request includes a requesting entity identifier (ID) and the vault is identified based on the requesting entity ID.

10. The DST processing unit of claim 9 wherein the one of the plurality of sub-vaults is identified based on an identification of the vault and based on a sub-vault ID included in the data access request.

11. The DST processing unit of claim 8 wherein retrieving the access information corresponding to the one of the plurality of sub-vaults includes retrieving a vault directory corresponding to the vault associated with the data access request.

12. The DST processing unit of claim 11 wherein the vault directory indicates an address for each of the plurality of sub-vaults associated with the vault.

13. The DST processing unit of claim 8 wherein determining whether the data access request is allowed includes determining a request type associated with the data access request and allowing the data access request when the access information indicates the request type is allowed.

14. The DST processing unit of claim 13 wherein the data access request indicates the request type as one of: a read request, or a write request.

15. A non-transitory computer readable storage medium comprises:
at least one memory section that stores operational instructions that, when executed by one or more processing modules of one or more computing devices of a dispersed storage network (DSN), causes the one or more computing devices to:
receive a data access request for at least one data segment stored in the DSN;
identify a vault associated with the data access request and one of a plurality of sub-vaults associated with the vault including to:
issue a plurality of requests to a set of distributed storage and/or task (DST) execution units to retrieve at least one set of vault list slices that are distributedly stored in the set of DST execution units, wherein a decode threshold number of vault list slices are needed to recover a vault list;
receive at least the decode threshold number of vault list slices in responses to the plurality of requests from the set of DST execution units;
decode the at least the decode threshold number of vault list slices to produce the vault list; and
identify the vault based on the vault list;

retrieve access information corresponding to the one of the plurality of sub-vaults to determine whether the data access request is allowed; and
when the data access request is allowed, retrieve a sub-vault directory associated with the one of the plurality of sub-vaults to identify a DSN address corresponding to the data access request, and fulfilling the data access request based on the DSN address.

16. The non-transitory computer readable storage medium of claim 15 wherein the data access request includes a requesting entity identifier (ID) and the vault is identified based on the requesting entity ID.

17. The non-transitory computer readable storage medium of claim 16 wherein the one of the plurality of sub-vaults is identified based on an identification of the vault and based on a sub-vault ID included in the data access request.

18. The non-transitory computer readable storage medium of claim 15 wherein retrieving the access information corresponding to the one of the plurality of sub-vaults includes retrieving a vault directory corresponding to the vault associated with the data access request.

19. The non-transitory computer readable storage medium of claim 18 wherein the vault directory indicates an address for each of the plurality of sub-vaults associated with the vault

Assignees

• Cleversafe Inc
• IBM

Inventors

• Leggette Wesley
• Cilfone Bart

Classifications

• G06F2211/1028

  Distributed, i.e. distributed RAID systems with parity · CPC title

• G06F12/1458

  by checking the subject access rights · CPC title

• G06F3/0655

  Vertical data movement, i.e. input-output transfer; data movement between one or more hosts and one or more storage devices · CPC title

• G06F2221/2149

  Restricted operating environment · CPC title

• G06F2212/1052

  Security improvement · CPC title