Distributing registry information in a dispersed storage network

• US 10,325,110 B2
• Filed: 09/29/2017
• Issued: 06/18/2019
• Est. Priority Date: 04/02/2014
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Leggette, Wesley
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US15/721,093
• Publication Number:
  US 20180039788A1
• Time in Patent Office: 627 Days
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A method begins by a processing module of a dispersed storage network (DSN) generating a signed registry information packet, dispersed storage error encoding the signed registry information packet to produce a set of encoded registry information slices, and generating a set of signed encoded registry information slice packets for storage in storage units of the DSN. The method continues with the processing module retrieving a decode threshold number of signed encoded registry information slice packets. For each of the decode threshold number of signed encoded registry information slice packets, the method continues with the processing module recovering an encoded registry information slice. The method continues with the processing module dispersed storage error decoding a decode threshold number of recovered encoded registry information slices to reproduce the signed registry information packet, validating the signed registry information packet, and extracting registry information when the signed registry information packet is valid.

Claims

1. A method for distributing registry information to computing devices of a dispersed storage network (DSN), the method comprises:

signing, by a managing unit of the DSN, the registry information with a certificate authority (CA) certificate to produce a signed registry information;

dispersed storage error encoding, by the managing unit, the signed registry information to produce a set of encoded registry information slices, wherein a decode threshold number of encoded registry information slices is needed to recover the signed registry information packet;

signing, by the managing unit, each encoded registry information slice with the CA certificate to produce a set of signed encoded registry information slices;

sending, by the managing unit, the set of signed encoded registry information slices to a set of storage units of the DSN for storage therein;

sending, by the managing unit, the CA certificate to a computing device of the computing devices;

retrieving, by the computing device, the decode threshold number of signed encoded registry information slices from at least some of the storage units of the set of storage units;

verifying, by the computing device, the CA certificate to produce a verified CA certificate;

verifying, by the computing device, each signed encoded registry information slice of the decode threshold number of signed encoded registry information slices based on the verified CA certificate to produce the decode threshold number of verified encoded registry information slices;

decoding, by the computing device, the decode threshold number of verified encoded registry information slices to recover the signed registry information; and

verifying, by the computing device, the signed registry information based on the verified CA certificate to recover the registry information.

2. The method of claim 1, wherein the registry information comprises one or more of:

hardware configuration information, software version information, software, software configuration information, user group affiliation information, an access control list, system namespace information, and vault information.

3. The method of claim 1, wherein the CA certificate comprises:

an identifier of the CA;

an identifier of the managing unit; and

a public key of the CA.

4. The method of claim 1 further comprises:

signing, by the managing unit, the registry information with a registry information certificate that includes one or more of;

an identifier of the managing unit;

an identifier of the registry information; and

a public key of the managing unit.

5. The method of claim 1 further comprises:

signing, by the managing unit, each encoded registry information slice with a encoded registry information slice certificate that includes one or more of;

an identifier of the managing unit;

an identifier of the encoded registry information slice; and

a public key of the managing unit.

6. A computer readable storage device for storing operational instructions that enable distributing registry information to computing devices of a dispersed storage network (DSN), the computer readable storage device comprises:

a first memory section that stores operational instructions that, when executed by a managing unit of the DSN, causes the managing unit to;

sign the registry information with a certificate authority (CA) certificate to produce a signed registry information;

dispersed storage error encode the signed registry information to produce a set of encoded registry information slices, wherein a decode threshold number of encoded registry information slices is needed to recover the signed registry information packet;

sign each encoded registry information slice with the CA certificate to produce a set of signed encoded registry information slices;

send the set of signed encoded registry information slices to a set of storage units of the DSN for storage therein; and

send the CA certificate to a computing device of the computing devices;

a second memory section that stores operational instructions that, when executed by the computing device, causes the computing device to;

retrieve the decode threshold number of signed encoded registry information slices from at least some of the storage units of the set of storage units;

verify the CA certificate to produce a verified CA certificate;

verify each signed encoded registry information slice of the decode threshold number of signed encoded registry information slices based on the verified CA certificate to produce the decode threshold number of verified encoded registry information slices;

decode the decode threshold number of verified encoded registry information slices to recover the signed registry information; and

verify the signed registry information based on the verified CA certificate to recover the registry information.

7. The computer readable storage device of claim 6, wherein the registry information comprises one or more of:

hardware configuration information, software version information, software, software configuration information, user group affiliation information, an access control list, system namespace information, and vault information.

8. The computer readable storage device of claim 6, wherein the CA certificate comprises:

an identifier of the CA;

an identifier of the managing unit; and

a public key of the CA.

9. The computer readable storage device of claim 6, wherein the first memory section further stores operational instructions that, when executed by the managing unit, causes the managing unit to:

sign the registry information with a registry information certificate that includes one or more of;

an identifier of the managing unit;

an identifier of the registry information; and

a public key of the managing unit.

10. The computer readable storage device of claim 6, wherein the first memory section further stores operational instructions that, when executed by the managing unit, causes the managing unit to:

sign each encoded registry information slice with an encoded registry information slice certificate that includes one or more of;

an identifier of the managing unit;

an identifier of the encoded registry information slice; and

a public key of the managing unit.