Dispersed data storage in a VPN group of devices

• US 10,015,141 B2
• Filed: 07/10/2014
• Issued: 07/03/2018
• Est. Priority Date: 11/25/2009
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Grube, Gary W., Markison, Timothy W.
• Primary Examiner(s): Nipa, Wasika
• Application Number:
  US14/328,311
• Publication Number:
  US 20140325224A1
• Time in Patent Office: 1,454 Days
• CPC Class Codes: G06F 11/1092 Rebuilding, e.g. when physically replacing a failing disk
• CPC Class Codes: G06F 16/182 Distributed file systems
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

A method begins when at least a consensus threshold number of devices are active in a virtual private network (VPN) group of devices. The method continues by encoding group specific data based on a consensus threshold number of devices in the VPN group of devices and a number of devices in the VPN group of devices to produce one or more sets of encoded data slices. The method continues by sending the one or more sets of encoded data slices to at least one of: the consensus threshold number of devices or a dispersed storage network (DSN) memory for storage therein. When the at least the consensus threshold number of devices are not active in the VPN group of devices, each of the devices in the VPN group of devices are prohibited from creating the group specific data or accessing previously created group specific data.

Claims

1. A method comprises:

determining whether a consensus threshold number of devices are active in a virtual private network (VPN) group of devices by;

verifying user identifiers (IDs) affiliated with the VPN group of devices;

verifying a unique user code related to group specific data; and

verifying a peer-to-peer communication between the consensus threshold number of devices;

when determining at least a consensus threshold number of devices are active in the VPN group of devices;

encoding, by a device of the at least the consensus threshold number of devices, a data segment of group specific data based on a consensus threshold number of devices in the VPN group of devices and a number of devices in the VPN group of devices to produce a set of encoded data slices;

wherein the consensus threshold number corresponds to a decode threshold number of encoded data slices of the set of encoded data slices required to reconstruct the data segment, and the number of devices in the VPN group corresponds to a total number of encoded data slices in the set of encoded data slices;

sending, by the device, a unique encoded data slice of the decode threshold number of encoded data slices to a corresponding device of the consensus threshold number of devices or to a unique storage unit of a set of storage units of a dispersed storage network (DSN) memory for storage therein; and

when determining at least a consensus threshold number of devices are not active in the VPN group of devices, prohibiting each of the devices in the VPN group of devices from encoding the data segment of group specific data; and

when determining at least a consensus threshold number of devices are not active in the VPN group of devices, further prohibiting each of the devices in the VPN group of devices from accessing previously created group specific data.

2. The method of claim 1 further comprises:

establishing the VPN group of devices; and

establishing error coding parameters based on the consensus threshold number of devices in the VPN group of devices and the number of devices in the VPN group of devices for accessing the group specific data.

3. The method of claim 1, wherein the encoding the group specific data further comprises:

encrypting the group specific data using an encryption key.

4. The method of claim 3 further comprises:

encoding the encryption key based on the consensus threshold number of devices and the number of devices in the VPN group of devices to produce one or more sets of encoded key slices; and

sending the one or more sets of encoded key slices to at least one of the consensus threshold number of devices or the DSN memory for storage therein.

5. The method of claim 4 further comprises:

when the set of encoded data slices is sent to the DSN memory for storage, sending the one or more sets of encoded key slices to the consensus threshold number of devices for distributed storage therein;

or

when the set of encoded data slices is sent to the consensus threshold number of devices for storage, sending the one or more sets of encoded key slices to the DSN memory for storage.

6. The method of claim 1 further comprises:

generating data directory information regarding storage of the group specific data;

encoding the data directory information based on the consensus threshold number of devices and the number of devices in the VPN group of devices to produce one or more sets of encoded directory slices; and

sending the one or more sets of encoded directory slices to at least one of the consensus threshold number of devices or the DSN memory for storage therein.

7. The method of claim 6 further comprises:

when the set of encoded data slices is sent to the DSN memory for storage, sending the one or more sets of encoded directory slices to the consensus threshold number of devices;

or

when the set of encoded data slices is sent to the consensus threshold number of devices, sending the one or more sets of encoded directory slices to the DSN memory for storage.

8. The method of claim 1, wherein determining whether a consensus threshold number of devices are active in the VPN group of devices further includes verifying a proximity of the consensus threshold number of devices in accordance with a group gathering threshold.

9. A computer readable memory device comprises:

a first memory section that stores operational instructions that, when executed by one of a virtual private network (VPN) group of devices, causes the one of the VPN group of devices to;

determine whether at least a consensus threshold number of devices of the VPN group of devices are active by;

verifying user identifiers (IDs) affiliated with the VPN group of devices;

verifying a unique user code related to group specific data; and

verifying a peer-to-peer communication between the consensus threshold number of devices;

when determining at least a consensus threshold number of devices are active in the VPN group of devices, a second memory section that stores operational instructions that, when executed by a device of the at least the consensus threshold number of devices, causes the device to;

encode a data segment of group specific data based on a consensus threshold number of devices in the VPN group of devices and a number of devices in the VPN group of devices to produce a set of encoded data slices, wherein the consensus threshold number corresponds to a decode threshold number of encoded data slices of the set of encoded data slices required to reconstruct the data segment and the number of devices in the VPN group corresponds to a total number of encoded data slices in the set of encoded data slices;

send a unique encoded data slice of the decode threshold number of encoded data slices to a corresponding device of the consensus threshold number of devices or to a unique storage unit of a set of storage units of a dispersed storage network (DSN) memory for storage therein;

the first memory section further stores operational instructions that, when executed by the one of the VPN group of devices, causes the one of the VPN group of devices to;

when determining at least a consensus threshold number of devices are not verified as active in the VPN group of devices, prohibit encoding the data segment of group specific data; and

when determining at least a consensus threshold number of devices are not verified as active in the VPN group of devices, further prohibiting each of the devices in the VPN group of devices from accessing previously created group specific data.

10. The computer readable memory device of claim 9, wherein the first memory section further stores operational instructions that, when executed by the one of the VPN group of devices, causes the one of the VPN group of devices to:

establish the VPN group of devices; and

establish error coding parameters based on the consensus threshold number of devices in the VPN group of devices and the number of devices in the VPN group of devices for accessing the group specific data.

11. The computer readable memory device of claim 9, wherein the first memory section further stores operational instructions that, when executed by the one of the VPN group of devices, causes the one of the VPN group of devices to:

encrypt the group specific data using an encryption key.

12. The computer readable memory device of claim 11, wherein the second memory section further stores operational instructions that, when executed by the device, causes the device to:

encode the encryption key based on the consensus threshold number of devices and the number of devices in the VPN group of devices to produce one or more sets of encoded key slices; and

send the one or more sets of encoded key slices to at least one of the consensus threshold number of devices or the DSN memory for storage therein.

13. The computer readable memory device of claim 12, wherein the second memory section further stores operational instructions that, when executed by the device, causes the device to:

when the set of encoded data slices is sent to the DSN memory for storage, send the one or more sets of encoded key slices to the consensus threshold number of devices;

or

when the set of encoded data slices is sent to the consensus threshold number of devices, send the one or more sets of encoded key slices to the DSN memory for storage.

14. The computer readable memory device of claim 9, wherein the second memory section further stores operational instructions that, when executed by the device, causes the device to:

generate data directory information regarding storage of the group specific data;

encode the data directory information based on the consensus threshold number of devices and the number of devices in the VPN group of devices to produce one or more sets of encoded directory slices; and

send the one or more sets of encoded directory slices to at least one of the consensus threshold number of devices or the DSN memory for storage therein.

15. The computer readable memory device of claim 14, wherein the second memory section further stores operational instructions that, when executed by the device, causes the device to:

when the set of encoded data slices is sent to the DSN memory for storage, send the one or more sets of encoded directory slices to the consensus threshold number of devices;

or

when the set of encoded data slices is sent to the consensus threshold number of devices, send the one or more sets of encoded directory slices to the DSN memory for storage.

16. The computer readable memory device of claim 9, wherein determining whether at least a consensus threshold number of devices of the VPN group of devices are active further includes verifying a proximity of the consensus threshold number of devices in accordance with a group gathering threshold.