Tracking data access in a dispersed storage network

• US 10,114,696 B2
• Filed: 07/14/2016
• Issued: 10/30/2018
• Est. Priority Date: 07/14/2016
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Johnson, Trent William
• Primary Examiner(s): Chung, Phung M
• Application Number:
  US15/210,209
• Publication Number:
  US 20180018228A1
• Time in Patent Office: 838 Days
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/064 Management of blocks
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]

Abstract

A method for execution by a dispersed storage and task (DST) processing unit that includes a processor includes receiving an access request from a requesting entity via a network indicating an original data object. At least one read request is generated for transmission to at least one storage unit indicating a plurality of encoded original data slices associated with the original data object. A regenerated original data object is generated by utilizing a decoding scheme on the plurality of encoded original data slice. A transformed data object is generated for transmission to the requesting entity via the network by utilizing a transformation function on the first regenerated original data object based on an entity identifier associated with the requesting entity.

Claims

1. A method for execution by a dispersed storage and task (DST) processing unit that includes a processor, the method comprises:

receiving an access request from a first requesting entity via a network indicating a first original data object;

generating a first at least one read request for transmission to at least one storage unit to retrieve a plurality of encoded original data slices associated with the first original data object;

generating a first regenerated original data object by utilizing a decoding scheme on the plurality of encoded original data slices; and

generating a first transformed data object for transmission to the first requesting entity via the network by utilizing a transformation function on the first regenerated original data object based on a first entity identifier associated with the first requesting entity.

2. The method of claim 1, wherein the transformation function includes inserting one of:

randomized or pseudorandomized changes to content of the first original data object.

3. The method of claim 1, wherein the transformation function is a one-way function.

4. The method of claim 1, wherein the first transformed data object includes new content that is generated by applying imperceptible changes to content of the first original data object.

5. The method of claim 1, wherein the first original data object includes at least one of:

image file content or video file content, and wherein generating the first transformed data object includes applying changes to at least one pixel of the at least one of;

the image file content or the video file content.

6. The method of claim 1, wherein the first original data object includes sound file content, and wherein generating the first transformed data object includes applying audible changes to the sound file content.

7. The method of claim 1, wherein the first original data object includes document file content, and wherein generating the first transformed data object includes applying changes to at least one of:

spacing, punctuation, or type-face of the document file content.

8. The method of claim 1, further comprising:

receiving an access history request from a verifying entity via the network that indicates the first original data object and includes the first transformed data object;

generating a second at least one read request for transmission to at least one storage unit indicating the plurality of encoded original data slices associated with the first original data object;

generating a second regenerated data object by utilizing the decoding scheme on the plurality of encoded original data slices;

generating access history data based on comparing the first transformed data object received from the verifying entity to the second regenerated data object, wherein the access history data indicates the first entity identifier associated with the first requesting entity; and

transmitting the first entity identifier to the verifying entity via the network.

9. The method of claim 1, further comprising:

generating a plurality of encoded transformed data slices by applying an encoding scheme to the first transformed data object; and

generating a plurality of write requests for transmission to a first plurality of storage units via the network, wherein each of the plurality of write requests includes at least one of the plurality of encoded transformed data slices for storage.

10. The method of claim 9, further comprising generating a plurality of delete requests corresponding to each of the plurality of encoded original data slices associated with the first original data object for transmission to a second plurality of storage units via the network, wherein each of the plurality of delete requests indicate one of the plurality of encoded original data slices for removal from a corresponding one of the second plurality of storage units.

11. The method of claim 9, wherein each of the plurality of write requests includes a request to replace one of the plurality of encoded original data slices with a one of the plurality of encoded transformed data slices.

12. The method of claim 9, further comprising:

receiving an access history request from a verifying entity via the network that indicates the first original data object;

generating a second at least one read request for transmission to at least one of the first plurality of storage units indicating the plurality of encoded transformed data slices associated with the first transformed data object;

generating a regenerated transformed data object by utilizing the decoding scheme on the plurality of encoded transformed data slices;

generating access history data based on comparing the first original data object to the regenerated transformed data object, wherein the access history data indicates the first entity identifier associated with the first requesting entity; and

transmitting the first entity identifier to the verifying entity via the network.

13. The method of claim 1, further comprising:

receiving a second original data object from a second requesting entity for storage;

generating a second transformed data object by utilizing the transformation function on the second original data object based on a second entity identifier associated with the second requesting entity;

generating a plurality of encoded transformed data slices by applying an encoding scheme to the second transformed data object; and

generating a plurality of write requests for transmission to a plurality of storage units via the network, wherein each of the plurality of write requests includes at least one of the plurality of encoded transformed data slices for storage.

14. A processing system of a dispersed storage and task (DST) processing unit comprises:

at least one processor;

a memory that stores operational instructions, that when executed by the at least one processor cause the processing system to;

receive an access request from a first requesting entity via a network indicating a first original data object;

generate a first at least one read request for transmission to at least one storage unit to retrieve a plurality of encoded original data slices associated with the first original data object;

generate a first regenerated original data object by utilizing a decoding scheme on the plurality of encoded original data slices; and

generate a first transformed data object for transmission to the first requesting entity via the network by utilizing a transformation function on the first regenerated original data object based on a first entity identifier associated with the first requesting entity.

15. The processing system of claim 14, wherein the transformation function includes inserting one of:

randomized or pseudorandomized changes to content of the first original data object.

16. The processing system of claim 14, wherein the operational instructions, when executed by the at least one processor, further cause the processing system to:

receive an access history request from a verifying entity via the network that indicates the first original data object and includes the first transformed data object;

generate a second at least one read request for transmission to at least one storage unit indicating the plurality of encoded original data slices associated with the first original data object;

generate a second regenerated data object by utilizing the decoding scheme on the plurality of encoded original data slices;

generate access history data based on comparing the first transformed data object received from the verifying entity to the second regenerated data object, wherein the access history data indicates the first entity identifier associated with the first requesting entity; and

transmit the first entity identifier to the verifying entity via the network.

17. The processing system of claim 14, wherein the operational instructions, when executed by the at least one processor, further cause the processing system to:

generate a plurality of encoded transformed data slices by applying an encoding scheme to the first transformed data object; and

generate a plurality of write requests for transmission to a first plurality of storage units via the network, wherein each of the plurality of write requests includes at least one of the plurality of encoded transformed data slices for storage.

18. The processing system of claim 17, wherein the operational instructions, when executed by the at least one processor, further cause the processing system to:

receive an access history request from a verifying entity via the network that indicates the first original data object;

generate a second at least one read request for transmission to at least one of the first plurality of storage units indicating the plurality of encoded transformed data slices associated with the first transformed data object;

generate a regenerated transformed data object by utilizing the decoding scheme on the plurality of encoded transformed data slices;

generate access history data based on comparing the first original data object to the regenerated transformed data object, wherein the access history data indicates the first entity identifier associated with the first requesting entity; and

transmit the first entity identifier to the verifying entity via the network.

19. The processing system of claim 14, wherein the operational instructions, when executed by the at least one processor, further cause the processing system to:

receive a second original data object from a second requesting entity for storage;

generate a second transformed data object by utilizing the transformation function on the second original data object based on a second entity identifier associated with the second requesting entity;

generate a plurality of encoded transformed data slices by applying an encoding scheme to the second transformed data object; and

generate a plurality of write requests for transmission to a plurality of storage units via the network, wherein each of the plurality of write requests includes at least one of the plurality of encoded transformed data slices for storage.

20. A non-transitory computer readable storage medium comprises:

at least one memory section that stores operational instructions that, when executed by a processing system of a dispersed storage network (DSN) that includes a processor and a memory, causes the processing system to;

receive an access request from a first requesting entity via a network indicating a first original data object;

generate a first at least one read request for transmission via the network to at least one storage unit of the DSN to retrieve a plurality of encoded original data slices associated with the first original data object;

generate a first regenerated original data object by utilizing a decoding scheme on the plurality of encoded original data slices; and

generate a first transformed data object for transmission to the first requesting entity via the network by utilizing a transformation function on the first regenerated original data object based on a first entity identifier associated with the first requesting entity.