Access policy updates in a dispersed storage network

• US 10,237,281 B2
• Filed: 07/28/2016
• Issued: 03/19/2019
• Est. Priority Date: 12/29/2009
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Grube, Gary W., Resch, Jason K.
• Primary Examiner(s): Herzog, Madhuri R
• Application Number:
  US15/221,731
• Publication Number:
  US 20160337377A1
• Time in Patent Office: 964 Days
• CPC Class Codes: G06F 11/00 Error detection; Error correction; Monitoring error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00
• CPC Class Codes: G06F 11/08 Error detection or correction by redundancy in data representation, e.g. by using checking codes
• CPC Class Codes: G06F 11/1096 Parity calculation or recalculation after configuration or reconfiguration of the system
• CPC Class Codes: G06F 16/182 Distributed file systems
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2211/1028 Distributed, i.e. distributed RAID systems with parity
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 3/061 Improving I/O performance
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/0635 by changing the path, e.g. traffic rerouting, path reconfiguration
• CPC Class Codes: G06F 3/064 Management of blocks
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 2012/6467 Information loss recovery, e.g. error correction, prediction
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A method for execution in a dispersed storage network operates to determine one or more slice names of one or more slices and determine whether to establish a new access policy corresponding to the one or more slices. When the new access policy is to be established, the method determines a timestamp; determines a new access policy; and sends the new access policy and the timestamp to one or more storage units that store the one or more slices.

Claims

1. A method for execution by a processing system of a dispersed storage network (DSN) that includes a processor, the method comprises:

determining one or more slice names of one or more encoded data slices, wherein one or more data segments of data are dispersed storage error encoded to produce one more sets of encoded data slices, wherein the one or more sets of encoded data slices includes the one or more encoded data slices;

determining whether to establish a new access policy corresponding to the one or more encoded data slices;

when the new access policy is to be established;

determining a timestamp regarding the new access policy;

determining the new access policy, wherein the new access policy includes an access policy pattern; and

sending the new access policy and the timestamp to one or more storage units of the DSN that store the one or more encoded data slices; and

when the new access policy is not to be established;

repeating, the determining the one or more slice names of the one or more encoded data slices.

2. The method of claim 1, wherein the one or more slice names include one of:

a plurality of discrete and non-contiguous slice names, a contiguous range of slice names associated with a common data segment or a contiguous range of slice names associated with a common data object.

3. The method of claim 1, wherein the determining one or more slice names is based on one or more of an access policy reconsideration request, where a previous access policy update ended, a starting DSN address, a lookup, a command, a request, a random number, a vault ID, a data object ID, or a virtual DSN address to a physical location table.

4. The method of claim 1, wherein the determining whether to establish the new access policy is based on one or more of:

an access policy reconsideration message, a current access policy for the one or more slice names, a command, a past history of access policy reconsiderations, a history of slice access sequences, a request, a predetermination, a data type, a security indicator, a priority indicator, a DSN memory system status indicator, a vault utilization indicator, or a DS managing unit message.

5. The method of claim 1, wherein the determining the new access policy is based on one or more of:

an access policy reconsideration message, a current access policy for the one or more slice names, a command, a past history of access policy reconsiderations, a history of slice access sequences, a request, a predetermination, a data type, a security indicator, a priority indicator, a DSN memory system status indicator, a vault utilization indicator, or a DS managing unit message.

6. The method of claim 1, wherein the determining the one or more slice names and the determining whether to establish a new access policy are in response to receiving a reconsideration message that includes the one or more slice names.

7. The method of claim 6, further comprising:

generating a reconsideration response message that indicates a denial of reconsideration when the new access policy is not established.

8. A processing system of a dispersed storage network (DSN) comprises:

at least one processor;

a memory that stores operational instructions, that when executed by the at least one processor cause the processing system to;

determine one or more slice names of one or more encoded data slices, wherein one or more data segments of data are dispersed storage error encoded to produce one more sets of encoded data slices, wherein the one or more sets of encoded data slices includes the one or more encoded data slices;

determine whether to establish a new access policy corresponding to the one or more encoded data slices;

when the new access policy is to be established;

determine a timestamp regarding the new access policy;

determine the new access policy, wherein the new access policy includes an access policy pattern; and

send the new access policy and the timestamp to one or more storage units of the DSN that store the one or more encoded data slices; and

when the new access policy is not to be established;

repeating, the determining the one or more slice names of the one or more encoded data slices.

9. The processing system of claim 8, wherein the one or more slice names include one of:

a plurality of discrete and non-contiguous slice names, a contiguous range of slice names associated with a common data segment or a contiguous range of slice names associated with a common data object.

10. The processing system of claim 8, wherein the determining one or more slice names is based on one or more of an access policy reconsideration request, where a previous access policy update ended, a starting DSN address, a lookup, a command, a request, a random number, a vault ID, a data object ID, or a virtual DSN address to a physical location table.

11. The processing system of claim 8, wherein the determining whether to establish the new access policy is based on one or more of:

an access policy reconsideration message, a current access policy for the one or more slice names, a command, a past history of access policy reconsiderations, a history of slice access sequences, a request, a predetermination, a data type, a security indicator, a priority indicator, a DSN memory system status indicator, a vault utilization indicator, or a DS managing unit message.

12. The processing system of claim 8, wherein the determining the new access policy is based on one or more of:

an access policy reconsideration message, a current access policy for the one or more slice names, a command, a past history of access policy reconsiderations, a history of slice access sequences, a request, a predetermination, a data type, a security indicator, a priority indicator, a DSN memory system status indicator, a vault utilization indicator, or a DS managing unit message.

13. The processing system of claim 8, wherein the determining the one or more slice names and the determining whether to establish a new access policy are in response to receiving a reconsideration message that includes the one or more slice names.

14. The processing system of claim 13, wherein the operational instructions, when executed by the at least one processor, further cause the processing system to:

generate a reconsideration response message that indicates a denial of reconsideration when the new access policy is not established.

15. A non-transitory computer readable storage medium comprises:

at least one memory section that stores operational instructions that, when executed by a processing system of a dispersed storage network (DSN) that includes a processor and a memory, causes the processing system to;

determine one or more slice names of one or more encoded data slices;

determine whether to establish a new access policy corresponding to the one or more encoded data slices;

when the new access policy is to be established;

determine a timestamp regarding the new access policy;

determine the new access policy, wherein the new access policy includes an access policy pattern; and

send the new access policy and the timestamp to one or more storage units of the DSN that store the one or more encoded data slices; and

when the new access policy is not to be established;

repeating, the determining the one or more slice names of the one or more encoded data slices.

16. The non-transitory computer readable storage medium of claim 15, wherein the one or more slice names include one of:

a plurality of discrete and non-contiguous slice names, a contiguous range of slice names associated with a common data segment or a contiguous range of slice names associated with a common data object.

17. The non-transitory computer readable storage medium of claim 15, wherein the determining one or more slice names is based on one or more of an access policy reconsideration request, where a previous access policy update ended, a starting DSN address, a lookup, a command, a request, a random number, a vault ID, a data object ID, or a virtual DSN address to a physical location table.

18. The non-transitory computer readable storage medium of claim 15, wherein the determining whether to establish the new access policy is based on one or more of:

an access policy reconsideration message, a current access policy for the one or more slice names, a command, a past history of access policy reconsiderations, a history of slice access sequences, a request, a predetermination, a data type, a security indicator, a priority indicator, a DSN memory system status indicator, a vault utilization indicator, or a DS managing unit message.

19. The non-transitory computer readable storage medium of claim 15, wherein the determining the new access policy is based on one or more of an access policy reconsideration message, a current access policy for the one or more slice names, a command, a past history of access policy reconsiderations, a history of slice access sequences, a request, a predetermination, a data type, a security indicator, a priority indicator, a DSN memory system status indicator, a vault utilization indicator, or a DS managing unit message.

20. The non-transitory computer readable storage medium of claim 15, wherein the determining the one or more slice names and the determining whether to establish a new access policy are in response to receiving a reconsideration message that includes the one or more slice names.