METHOD AND APPARATUS FOR OBFUSCATING SLICE NAMES IN A DISPERSED STORAGE SYSTEM

• US 20110078534A1
• Filed: 06/16/2010
• Published: 03/31/2011
• Est. Priority Date: 09/29/2009
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: RESCH, JASON K.
• Granted Patent: US 9,076,138 B2
• Time in Patent Office: Days
• US Class Current: 714/752
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2211/1028 Distributed, i.e. distributed RAID systems with parity
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/202 Interconnection or interaction of plural electronic cash registers [ECR] or to host computer, e.g. network details, transfer of information from host to ECR or from ECR to ECR
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification

Abstract

A method begins by a processing module receiving a data segment for dispersed storage. The method continues with the processing module encoding the data segment in accordance with an error coding dispersed storage function to produce a plurality of error coded data slices. The method continues with the processing module generating a slice name for an error coded data slice of the plurality of error coded data slices, wherein the slice name includes a dispersed storage routing information section and a data identification section. The method continues with the processing module performing a securing function on at least the data identification section to produce a secure data identification section. The method continues with the processing module replacing, within the slice name, the data identification section with the secure data identification section to produce a secure slice name.

Claims

1. A method for a dispersed storage (DS) processing module to secure a slice name, the method comprises:

receiving a data segment for dispersed storage;

encoding the data segment in accordance with an error coding dispersed storage function to produce a plurality of error coded data slices;

generating a slice name for an error coded data slice of the plurality of error coded data slices, wherein the slice name includes a dispersed storage routing information section and a data identification section;

performing a securing function on at least the data identification section to produce a secure data identification section; and

replacing, within the slice name, the data identification section with the secure data identification section to produce a secure slice name.

2. The method of claim 1, wherein the performing the securing function comprises calculating a hash of the slice name.

3. The method of claim 1, wherein the performing the securing function comprises performing a deterministic mathematical function on the slice name.

4. The method of claim 1, wherein the data identification section comprises identification of the data segment and a data object, wherein the data segment is one of a plurality of data segments of the data object.

5. The method of claim 1 further comprises:

generating slice names for remaining ones of the plurality of error coded data slices to produce a plurality of slice names;

for each of at least a pillar width minus a decode threshold number of the plurality of slice names, securing the slices names by;

performing a securing function on at least the data identification section to produce a secure data identification section; and

replacing the data identification section with the secure data identification section.

6. A method for execution by a dispersed storage (DS) processing module, the method comprises:

receiving an access request to a data segment, wherein the data segment is encoded in accordance with an error coding dispersed storage function to produce a plurality of error coded data slices that are stored in a plurality of DS storage units;

generating a slice name for an error coded data slice of the plurality of error coded data slices, wherein the slice name includes a dispersed storage routing information section and a data identification section;

performing a securing function on at least the data identification section to produce a secure data identification section;

replacing, within the slice name, the data identification section with the secure data identification section to produce a secure slice name; and

accessing the error coded slice based on the secure slice name.

7. The method of claim 6, wherein the performing the securing function comprises calculating a hash of the slice name.

8. The method of claim 6, wherein the performing the securing function comprises performing a deterministic mathematical function on the slice name.

9. The method of claim 6, wherein the data identification section comprises identification of the data segment and a data object, wherein the data segment is one of a plurality of data segments of the data object.

10. The method of claim 6 further comprises:

generating slice names for remaining ones of the plurality of error coded data slices to produce a plurality of slice names;

for each of at least a decode threshold minus one number of the plurality of slice names, securing the slices names to produce secure slices names by;

performing a securing function on at least the data identification section to produce a secure data identification section; and

replacing the data identification section with the secure data identification section; and

accessing the remaining ones of the plurality of error coded data slices based on the secure slice names.

12. The DS processing module of claim 10, wherein the processing module further functions to perform the securing function by calculating a hash of the slice name.

13. The DS processing module of claim 10, wherein the processing module further functions to perform the securing function by performing a deterministic mathematical function on the slice name.

14. The DS processing module of claim 10, wherein the data identification section includes identification of the data segment and a data object, wherein the data segment is one of a plurality of data segments of the data object.

15. The DS processing module of claim 10, wherein the processing module further functions to:

generate slice names for remaining ones of the plurality of error coded data slices to produce a plurality of slice names;

for each of at least a pillar width minus a decode threshold number of the plurality of slice names, secure the slices names by;

performing a securing function on at least the data identification section to produce a secure data identification section; and

replacing the data identification section with the secure data identification section.

11. A dispersed storage (DS) processing module comprises:

memory; and

a processing module operably coupled to the memory, wherein the processing module is operable to;

receive a data segment for dispersed storage;

encode the data segment in accordance with an error coding dispersed storage function to produce a plurality of error coded data slices;

generate a slice name for an error coded data slice of the plurality of error coded data slices, wherein the slice name includes a dispersed storage routing information section and a data identification section;

perform a securing function on at least the data identification section to produce a secure data identification section; and

replace, within the slice name, the data identification section with the secure data identification section to produce a secure slice name.

16. A dispersed storage (DS) processing module comprises:

an interface; and

a processing module operable to;

receive an access request to a data segment, wherein the data segment is encoded in accordance with an error coding dispersed storage function to produce a plurality of error coded data slices that are stored in a plurality of DS storage units;

generate a slice name for an error coded data slice of the plurality of error coded data slices, wherein the slice name includes a dispersed storage routing information section and a data identification section;

perform a securing function on at least the data identification section to produce a secure data identification section;

replace, within the slice name, the data identification section with the secure data identification section to produce a secure slice name; and

access, via the interface, the error coded slice based on the secure slice name.

17. The DS processing module of claim 16, wherein the processing module further functions to perform the securing function by calculating a hash of the slice name.

18. The DS processing module of claim 16, wherein the processing module further functions to perform the securing function by performing a deterministic mathematical function on the slice name.

19. The DS processing module of claim 16, wherein the data identification section includes identification of the data segment and a data object, wherein the data segment is one of a plurality of data segments of the data object.

20. The DS processing module of claim 16, wherein the processing module further functions to:

generate slice names for remaining ones of the plurality of error coded data slices to produce a plurality of slice names;

for each of at least a decode threshold minus one number of the plurality of slice names, secure the slices names to produce secure slices names by;

performing a securing function on at least the data identification section to produce a secure data identification section; and

replacing the data identification section with the secure data identification section; and

accessing, via the interface, the remaining ones of the plurality of error coded data slices based on the secure slice names.