METHOD AND APPARATUS FOR ACCESSING SECURE DATA IN A DISPERSED STORAGE SYSTEM

• US 20140215641A1
• Filed: 03/31/2014
• Published: 07/31/2014
• Est. Priority Date: 09/29/2009
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Grube, Gary W., Markison, Timothy W.
• Granted Patent: US 9,443,099 B2
• Time in Patent Office: Days
• US Class Current: 726/28
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2211/1028 Distributed, i.e. distributed RAID systems with parity
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/202 Interconnection or interaction of plural electronic cash registers [ECR] or to host computer, e.g. network details, transfer of information from host to ECR or from ECR to ECR
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification

Abstract

A method begins with a first computing device receiving a first request from a user device to access secure data. The method continues with the first computing device processing the first request to determine a level of access. When the level of access is acceptable, the method continues with the first computing device facilitating sending a set of encoded data slices to the user device. The method continues with a second computing device receiving a second request from the user device. The method continues with the second computing device processing the second request to determine the level of access. When the level of access is acceptable, the method continues with the second computing device facilitating sending a second set of encoded data slices to the user device. When the level of access is at a given level, the sets include a reconstruction threshold number of encoded data slices.

Claims

1. A method comprises:

receiving, by a first computing device, a first request from a user device to access secure data, wherein the first request includes a user identification code (ID) and at least one object name for the secure data;

processing, by the first computing device, the first request to determine a level of access to the secure data for the user device;

when the level of access is of an acceptable level, facilitating, by the first computing device, sending a set of encoded data slices to the user device, wherein the set of encoded data slices includes less than a reconstruction threshold number of encoded data slices to reconstruct at least a segment of the secure data;

receiving, by a second computing device, a second request from the user device to access the secure data, wherein the second request includes the user ID, the at least one object name for the secure data, and a representation of the first request;

processing, by the second computing device, the second request to determine the level of access to the secure data for the user device; and

when the level of access is of the acceptable level, facilitating, by the second computing device, sending a second set of encoded data slices to the user device, wherein the second set of encoded data slices includes less than the reconstruction threshold number of encoded data slices and wherein, when the level of access is at a given level, the set of encoded data slices and the second set of encoded data slices includes at least the reconstruction threshold number of encoded data slices.

2. The method of claim 1, wherein the processing the first request comprises:

determining a security level associated with the user device; and

determining security parameters associated with the secure data, wherein the first computing device determines the level of access to the secure data based on the security level associated with the user device and the security parameters.

3. The method of claim 1, wherein the facilitating the sending of the set of encoded data slices to the user device comprises:

when the acceptable level is a partial access level;

retrieving the set of encoded data slices from dispersed storage units;

generating a response that includes the set of encoded data slices; and

sending the response to the user device.

4. The method of claim 1, wherein the processing the first request further comprises:

communicating with a dispersed storage (DS) managing unit regarding a security level associated with the user device; and

communicating with the dispersed storage (DS) managing unit regarding security parameters associated with the secure data, wherein the first computing device determines the level of access to the secure data based on the security level associated with the user device and the security parameters.

5. The method of claim 1, wherein the processing the first request comprises:

determining whether the first request includes a representation of a response from another computing device;

when the first request does not include the representation, determining whether the first request is an initial request for the secure data by the user device; and

when the first request is not the initial request, determining that the level of access is not acceptable for facilitating sending of the set of encoded data slices.

6. The method of claim 1, wherein the processing the first request comprises:

determining a number of encoded data slices to include in the set of encoded data slices based on a variable function of security parameters and a security level associated with the user ID, wherein the security parameters includes at least one of;

a secrecy level of data, an amount of data, codec information regarding the data, and error coding dispersal storage function parameters.

7. The method of claim 1, wherein the processing the second request comprises:

determining a security level associated with the user device;

determining security parameters associated with the secure data;

verifying the representation of the first request; and

when the representation of the first request is verified, determining the level of access to the secure data based on the security level associated with the user device and the security parameters.

8. The method of claim 1, wherein the facilitating the sending of the second set of encoded data slices to the user device comprises:

when the acceptable level is a partial access level;

retrieving the second set of encoded data slices from dispersed storage units;

generating a response that includes the second set of encoded data slices; and

sending the response to the user device.

9. The method of claim 1, wherein the secure data includes one or more of:

financial account information;

user password information;

security credential information; and

personal data.

10. A computer readable storage medium comprises:

a first storage device that stores operational instructions that, when executed by a first computing device, causes the first computing device to;

receive a first request from a user device to access secure data, wherein the first request includes a user identification code (ID) and at least one object name for the secure data;

process the first request to determine a level of access to the secure data for the user device;

when the level of access is of an acceptable level, facilitate sending a set of encoded data slices to the user device, wherein the set of encoded data slices includes less than a reconstruction threshold number of encoded data slices to reconstruct at least a segment of the secure data;

a second storage device that stores operational instructions that, when executed by a second computing device, causes the second computing device to;

receive a second request from the user device to access the secure data, wherein the second request includes the user ID, the at least one object name for the secure data, and a representation of the first request;

process the second request to determine the level of access to the secure data for the user device; and

when the level of access is of the acceptable level, facilitate sending a second set of encoded data slices to the user device, wherein the second set of encoded data slices includes less than the reconstruction threshold number of encoded data slices and wherein, when the level of access is at a given level, the set of encoded data slices and the second set of encoded data slices includes at least the reconstruction threshold number of encoded data slices.

11. The computer readable storage medium of claim 10, wherein the first storage device further stores operational instructions that, when executed by the first computing device, causes the first computing device to process the first request by:

determining a security level associated with the user device; and

determining security parameters associated with the secure data, wherein the first computing device determines the level of access to the secure data based on the security level associated with the user device and the security parameters.

12. The computer readable storage medium of claim 10, wherein the first storage device further stores operational instructions that, when executed by the first computing device, causes the first computing device to facilitate the sending of the set of encoded data slices to the user device by:

when the acceptable level is a partial access level;

retrieving the set of encoded data slices from dispersed storage units;

generating a response that includes the set of encoded data slices; and

sending the response to the user device.

13. The computer readable storage medium of claim 10, wherein the first storage device further stores operational instructions that, when executed by the first computing device, causes the first computing device to process the first request further by:

communicating with a dispersed storage (DS) managing unit regarding a security level associated with the user device; and

communicating with the dispersed storage (DS) managing unit regarding security parameters associated with the secure data, wherein the first computing device determines the level of access to the secure data based on the security level associated with the user device and the security parameters.

14. The computer readable storage medium of claim 10, wherein the first storage device further stores operational instructions that, when executed by the first computing device, causes the first computing device to process the first request by:

determining whether the first request includes a representation of a response from another computing device;

when the first request does not include the representation, determining whether the first request is an initial request for the secure data by the user device; and

when the first request is not the initial request, determining that the level of access is not acceptable for facilitating sending of the set of encoded data slices.

15. The computer readable storage medium of claim 10, wherein the first storage device further stores operational instructions that, when executed by the first computing device, causes the first computing device to process the first request by:

determining a number of encoded data slices to include in the set of encoded data slices based on a variable function of security parameters and a security level associated with the user ID, wherein the security parameters includes at least one of;

a secrecy level of data, an amount of data, codec information regarding the data, and error coding dispersal storage function parameters.

16. The computer readable storage medium of claim 10, wherein the second storage device further stores operational instructions that, when executed by the second computing device, causes the second computing device to process the second request by:

determining a security level associated with the user device;

determining security parameters associated with the secure data;

verifying the representation of the first request; and

when the representation of the first request is verified, determining the level of access to the secure data based on the security level associated with the user device and the security parameters.

17. The computer readable storage medium of claim 10, wherein the second storage device further stores operational instructions that, when executed by the second computing device, causes the second computing device to facilitate the sending of the second set of encoded data slices to the user device by:

when the acceptable level is a partial access level;

retrieving the second set of encoded data slices from dispersed storage units;

generating a response that includes the second set of encoded data slices; and

sending the response to the user device.

18. The computer readable storage medium of claim 10, wherein the secure data includes one or more of:

financial account information;

user password information;

security credential information; and

personal data.