Policy-based access in a dispersed storage network

• US 10,158,648 B2
• Filed: 07/27/2016
• Issued: 12/18/2018
• Est. Priority Date: 12/29/2009
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Grube, Gary W., Resch, Jason K.
• Primary Examiner(s): HERZOG, MADHURI R
• Application Number:
  US15/221,344
• Publication Number:
  US 20160337376A1
• Time in Patent Office: 874 Days
• CPC Class Codes: G06F 11/00 Error detection; Error correction; Monitoring error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 16/182 Distributed file systems
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2211/1028 Distributed, i.e. distributed RAID systems with parity
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 2012/6467 Information loss recovery, e.g. error correction, prediction
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A method for execution by a dispersed storage and task (DST) execution unit operates to receive a slice retrieval request from a requester that includes a slice name of one or slices to be retrieved; determine an access policy to apply to the slice retrieval request; determine a timestamp; and determine, based on the timestamp, when the one or more slices are available for retrieval. When the one or more slices are available for retrieval, the method operates further to determine when the one or more slices are currently available to the requester; retrieves the one or more slices from memory and sends the one or more slices to the requester, when the one or more slices are currently available to the requester.

Claims

1. A method for execution by a dispersed storage and task (DST) execution unit that includes a processor, the method comprises:

receiving a slice retrieval request from a requester that includes a slice name of one or more slices to be retrieved, wherein each slice of the one or more slices is a dispersed storage error encoded portion of a segment of a data object;

determining an access policy to apply to the slice retrieval request, the access policy including time varying availability patterns of one or more dispersed storage units in which the one or more slices to be retrieved are stored, wherein less than a read threshold number of the dispersed storage units are available for retrieval requests during any one time varying availability pattern of the time varying availability patterns;

determining a timestamp relating to the slice retrieval request;

determining, based on a comparison of the time varying availability patterns and the timestamp, when the one or more slices are available for retrieval; and

when the one or more slices are available for retrieval;

determining when the one or more slices are currently available to the requester; and

retrieving the one or more slices from memory and sending the one or more slices to the requester, when the one or more slices are currently available to the requester.

2. The method of claim 1, wherein the requester is at least one of:

a user device, a DST processing unit, a storage integrity processing unit, a managing unit, or another DST execution unit.

3. The method of claim 1, wherein the slice retrieval request includes one or more of:

a requester identifier (ID), a command, an access policy update, a data object ID, a source name, a data type, a data size indicator, a priority indicator, a security indicator, or a performance indicator.

4. The method of claim 1, wherein determining the access policy to apply to the slice retrieval request is based on a stored access policy associated with the slice name of the one or more slices.

5. The method of claim 1, wherein determining the access policy to apply to the slice retrieval request is based on one or more of a lookup in memory of a previously received access policy, a requester ID, a command, an access policy update, a data object ID, a source name, a data type, a data size indicator, a priority indicator, a security indicator, or a performance indicator.

6. The method of claim 1, wherein determining when the one or more slices are currently available to the requester is based on one or more of:

a memory status indicator, a dispersed storage unit status indicator, or a performance indicator.

7. The method of claim 1, further comprising:

sending an unavailable message to the requester when the one or more slices are not available for retrieval.

8. The method of claim 1, wherein determining when the one or more slices are currently available to the requester is based on when the access policy indicates that the requester has access authorization at the time indicated by the timestamp.

9. The method of claim 1, further comprising:

sending an unavailable message to the requester when the one or more slices are not currently available to the requester.

10. A processing system of a dispersed storage and task (DST) execution unit comprises:

at least one processor;

a memory that stores operational instructions, that when executed by the at least one processor cause the processing system to;

receive a slice retrieval request from a requester that includes a slice name of one or more slices to be retrieved, wherein each slice of the one or more slices is a dispersed storage error encoded portion of a segment of a data object;

determine an access policy to apply to the slice retrieval request, the access policy including time varying availability patterns of one or more dispersed storage units in which the one or more slices to be retrieved are stored, wherein less than a read threshold number of the dispersed storage units are available for retrieval requests during any one time varying availability pattern of the time varying availability patterns;

determine a timestamp relating to the slice retrieval request;

determine, based on a comparison of the time varying availability patterns and the timestamp, when the one or more slices are available for retrieval; and

when the one or more slices are available for retrieval;

determine when the one or more slices are currently available to the requester; and

retrieve the one or more slices from memory and send the one or more slices to the requester, when the one or more slices are currently available to the requester.

11. The processing system of claim 10, wherein the requester is at least one of:

a user device, a DST processing unit, a storage integrity processing unit, a managing unit, or another DST execution unit.

12. The processing system of claim 10, wherein the slice retrieval request includes one or more of:

a requester identifier (ID), a command, an access policy update, a data object ID, a source name, a data type, a data size indicator, a priority indicator, a security indicator, or a performance indicator.

13. The processing system of claim 10, wherein determining the access policy to apply to the slice retrieval request is based on a stored access policy associated with the slice name of the one or more slices.

14. The processing system of claim 10, wherein determining the access policy to apply to the slice retrieval request is based on one or more of a lookup in memory of a previously received access policy, a requester ID, a command, an access policy update, a data object ID, a source name, a data type, a data size indicator, a priority indicator, a security indicator, or a performance indicator.

15. The processing system of claim 10, wherein determining when the one or more slices are currently available to the requester is based on one or more of:

a memory status indicator, a dispersed storage unit status indicator, or a performance indicator.

16. The processing system of claim 10, wherein the operational instructions, when executed by the at least one processor, further cause the processing system to:

send an unavailable message to the requester when the one or more slices are not available for retrieval.

17. The processing system of claim 10, wherein determining when the one or more slices are currently available to the requester is based on when the access policy indicates that the requester has access authorization at the time indicated by the timestamp.

18. The processing system of claim 10, wherein the operational instructions, when executed by the at least one processor, further cause the processing system to:

send an unavailable message to the requester when the one or more slices are not currently available to the requester.

19. A non-transitory computer readable storage medium comprises:

at least one memory section that stores operational instructions that, when executed by a processing system of a dispersed storage network (DSN) that includes a processor and a memory, causes the processing system to;

receive a slice retrieval request from a requester that includes a slice name of one or more slices to be retrieved, wherein each slice of the one or more slices is a dispersed storage error encoded portion of a segment of a data object;

determine an access policy to apply to the slice retrieval request, the access policy including time varying availability patterns of one or more dispersed storage units in which the one or more slices to be retrieved are stored, wherein less than a read threshold number of the dispersed storage units are available for retrieval requests during any one time varying availability pattern of the time varying availability patterns;

determine a timestamp relating to the slice retrieval request;

determine, based on a comparison of the time varying availability patterns and the timestamp, when the one or more slices are available for retrieval; and

when the one or more slices are available for retrieval;

determine when the one or more slices are currently available to the requester; and

retrieve the one or more slices from memory and send the one or more slices to the requester, when the one or more slices are currently available to the requester.

20. The non-transitory computer readable storage medium of claim 19, wherein determining the access policy to apply to the slice retrieval request is based on a stored access policy associated with the slice name of the one or more slices.