Audit object generation in a dispersed storage network

• US 10,120,756 B2
• Filed: 07/22/2016
• Issued: 11/06/2018
• Est. Priority Date: 08/17/2011
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Resch, Jason K., Leggette, Wesley B.
• Primary Examiner(s): Hoffman, Brandon S
• Application Number:
  US15/217,585
• Publication Number:
  US 20160328298A1
• Time in Patent Office: 837 Days
• Field of Search: None
• CPC Class Codes: G06F 11/00 Error detection; Error correction; Monitoring error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 11/1446 Point-in-time backing up or restoration of persistent data
• CPC Class Codes: G06F 11/1612 where the redundant component is persistent storage
• CPC Class Codes: G06F 15/17331 Distributed shared memory [DSM], e.g. remote direct memory access [RDMA]
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2211/1028 Distributed, i.e. distributed RAID systems with parity
• CPC Class Codes: G06F 3/06 Digital input from, or digital output to, record carriers , e.g. RAID, emulated record carriers or networked record carriers
• CPC Class Codes: G06F 3/0604 Improving or facilitating administration, e.g. storage management
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/064 Management of blocks
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/0877 : using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/0894 : Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/32 : including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/321 : involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 : involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A method for execution by a dispersed storage and task (DST) processing unit includes obtaining audit records for an audit object and determining when the audit object is complete. When the audit object is complete, aggregating the audit records of the audit object within the audit object by generating the audit object to include the audit records; generating identifier (ID) information and generating integrity information. Fields of the audit object are populated with the audit records, the ID information, and the integrity information and a name of the audit object is determined for storage of the audit object and the name of the audit object in a dispersed storage network (DSN).

Claims

1. A method for execution by a dispersed storage and task (DST) processing unit that includes a processor, the method comprises:

obtaining audit records for an audit object;

determining when the audit object is complete, based on comparing a number of audit records of the audit object to an audit record threshold;

when the audit object is complete, aggregating the audit records of the audit object within the audit object by generating the audit object to include the audit records;

generating identifier (ID) information;

generating integrity information;

populating fields of the audit object with the audit records, the ID information, and the integrity information;

determining a name of the audit object; and

facilitating storage of the audit object and the name of the audit object in a dispersed storage network (DSN).

2. The method of claim 1 wherein the name of the audit object is determined based on a virtual DSN address associated with accessing the audit object when stored as a plurality of audit object slices in the DSN.

3. The method of claim 1 wherein the name of the audit object includes at least one of:

a text string name, a sequence number or a timestamp when created or a timestamp associated with when the audit object may be deleted.

4. The method of claim 1 wherein generating the integrity information includes at least one of:

utilizing an ID associated with the DST processing unit, querying another device of the DSN for the ID information or receiving the ID information.

5. The method of claim 1 wherein generating the integrity information includes at least one of obtaining a certificate, generating a signature of the certificate, or calculating a hash of the audit object.

6. The method of claim 1 wherein facilitating storage of the audit object and the name of the audit object includes at least one of:

sending the audit object and the name of the audit object to the DSN for storage or storing the audit object and the name of the audit object in the DSN.

7. A processing system of a dispersed storage and task (DST) processing unit comprises:

at least one processor;

a memory that stores operational instructions, that when executed by the at least one processor cause the processing system to;

obtain audit records for an audit object;

determine when the audit object is complete, based on comparing a number of audit records of the audit object to an audit record threshold;

when the audit object is complete, aggregate the audit records of the audit object within the audit object by generating the audit object to include the audit records;

generate identifier (ID) information;

generate integrity information;

populate fields of the audit object with the audit records, the ID information, and the integrity information;

determine a name of the audit object; and

facilitate storage of the audit object and the name of the audit object in a dispersed storage network (DSN).

8. The processing system of claim 7 wherein the name of the audit object is determined based on a virtual DSN address associated with accessing the audit object when stored as a plurality of audit object slices in the DSN.

9. The processing system of claim 7 wherein the name of the audit object includes at least one of:

a text string name, a sequence number or a timestamp when created or a timestamp associated with when the audit object may be deleted.

10. The processing system of claim 7 wherein generating the integrity information includes at least one of:

utilizing an ID associated with the DST processing unit, querying another device of the DSN for the ID information or receiving the ID information.

11. The processing system of claim 7 wherein generating the integrity information includes at least one of obtaining a certificate, generating a signature of the certificate, or calculating a hash of the audit object.

12. The processing system of claim 7 wherein facilitating storage of the audit object and the name of the audit object includes at least one of:

sending the audit object and the name of the audit object to the DSN for storage or storing the audit object and the name of the audit object in the DSN.

13. A non-transitory computer readable storage medium comprises:

at least one memory section that stores operational instructions that, when executed by a processing system of a dispersed storage network (DSN) that includes a processor and a memory, causes the processing system to;

obtain audit records for an audit object;

determine when the audit object is complete, based on comparing a number of audit records of the audit object to an audit record threshold;

when the audit object is complete, aggregate the audit records of the audit object within the audit object by generating the audit object to include the audit records;

generate identifier (ID) information;

generate integrity information;

populate fields of the audit object with the audit records, the ID information, and the integrity information;

determine a name of the audit object; and

facilitate storage of the audit object and the name of the audit object in a dispersed storage network (DSN).

14. The processing system of claim 13 wherein the name of the audit object is determined based on a virtual DSN address associated with accessing the audit object when stored as a plurality of audit object slices in the DSN.

15. The processing system of claim 13 wherein the name of the audit object includes at least one of:

a text string name, a sequence number or a timestamp when created or a timestamp associated with when the audit object may be deleted.

16. The processing system of claim 13 wherein generating the integrity information includes at least one of:

utilizing an ID associated with a DST processing unit, querying another device of the DSN for the ID information or receiving the ID information.

17. The processing system of claim 13 wherein generating the integrity information includes at least one of obtaining a certificate, generating a signature of the certificate, or calculating a hash of the audit object.