DISPERSED STORAGE NETWORK WITH CUSTOMIZED SECURITY AND METHODS FOR USE THEREWITH

• US 20140310775A1
• Filed: 06/26/2014
• Published: 10/16/2014
• Est. Priority Date: 09/30/2005
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Resch, Jason K., Leggette, Wesley
• Granted Patent: US 10,180,884 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 11/1464 for networked environments
• CPC Class Codes: G06F 11/2038 with a single idle spare processing component
• CPC Class Codes: G06F 11/2048 where the redundant components share neither address space nor persistent storage
• CPC Class Codes: G06F 11/2094 Redundant storage or storage space G06F11/2056 takes precedence
• CPC Class Codes: G06F 16/172 Caching, prefetching or hoarding of files
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 2201/80 Database-specific techniques
• CPC Class Codes: G06F 2211/1028 Distributed, i.e. distributed RAID systems with parity
• CPC Class Codes: G06F 3/0617 in relation to availability
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/0635 by changing the path, e.g. traffic rerouting, path reconfiguration
• CPC Class Codes: G06F 3/065 Replication mechanisms
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A method begins with a processing module selecting one of a plurality of dispersed storage (DS) processing modules for facilitating access to a dispersed storage network (DSN) memory. The method continues with the processing module sending a DSN memory access request to the one of the plurality of DS processing modules. The method continues with the processing module selecting another one of the plurality of DS processing modules when no response is received within a given time frame or when the response to the access request does not include an access indication. The method continues with the processing module sending the DSN memory access request to the another one of the plurality of DS processing modules.

Claims

1. A method for execution by one or more processing modules of one or more computing devices of a dispersed storage network (DSN), the method comprises:

receiving an access request;

determining security requirements corresponding to the access request;

determining a subset of a plurality of dispersed storage units based on the security requirements;

determining at least one connection security approach for each of the subset of the plurality of dispersed storage units based on the security requirements; and

processing the access request via the subset of the plurality of dispersed storage units in accordance with the at least one connection security approach for each of the subset of the plurality of dispersed storage units.

2. The method of claim 1 wherein the at least one connection security approach for each of the subset of the plurality of dispersed storage units includes a first connection security approach employed for one of the subset of the plurality of dispersed storage units and a second connection security approach employed for another of the subset of the plurality of dispersed storage units.

3. The method of claim 1 wherein the at least one connection security approach for each of the subset of the plurality of dispersed storage units includes a first key employed for one of the subset of the plurality of dispersed storage units and a second key employed for another of the subset of the plurality of dispersed storage units.

4. The method of claim 1 wherein the at least one connection security approach for each of the subset of the plurality of dispersed storage units includes a first cipher employed for one of the subset of the plurality of dispersed storage units and a second cipher employed for another of the subset of the plurality of dispersed storage units.

5. The method of claim 1 wherein the at least one connection security approach includes at least one of:

a transmission control protocol connection that is based on a user identifier and security credentials;

a transport layer security null cipher connection that is based on the user identifier and the security credentials;

or

a transport layer security cipher connection that is based on the user identifier and the security credentials.

6. The method of claim 1 wherein the security requirements are determined based on at least one of:

a user identifier, a request type corresponding to the access request, a performance requirement, or a data type corresponding to the access request.

7. The method of claim 1 wherein the at least one connection security approach is determined for each of the subset of the plurality of dispersed storage units further based on security capabilities of each of the subset of the plurality of dispersed storage units.

8. A dispersed storage (DS) processing unit for use in a dispersed storage network (DSN) comprises:

at least one module, when operable within a computing device, that causes the computing device to;

receive an access request;

determine security requirements corresponding to the access request;

determine a subset of a plurality of dispersed storage units based on the security requirements;

determine at least one connection security approach for each of the subset of the plurality of dispersed storage units based on the security requirements; and

process the access request via the subset of the plurality of dispersed storage units in accordance with the at least one connection security approach for each of the subset of the plurality of dispersed storage units.

9. The DS processing unit of claim 8 wherein the at least one connection security approach for each of the subset of the plurality of dispersed storage units includes a first connection security approach employed for one of the subset of the plurality of dispersed storage units and a second connection security approach employed for another of the subset of the plurality of dispersed storage units.

10. The DS processing unit of claim 8 wherein the at least one connection security approach for each of the subset of the plurality of dispersed storage units includes a first key employed for one of the subset of the plurality of dispersed storage units and a second key employed for another of the subset of the plurality of dispersed storage units.

11. The DS processing unit of claim 8 wherein the at least one connection security approach for each of the subset of the plurality of dispersed storage units includes a first cipher employed for one of the subset of the plurality of dispersed storage units and a second cipher employed for another of the subset of the plurality of dispersed storage units.

12. The DS processing unit of claim 8 wherein the at least one connection security approach includes at least one of:

a transmission control protocol connection that is based on a user identifier and security credentials;

a transport layer security null cipher connection that is based on the user identifier and the security credentials;

or

a transport layer security cipher connection that is based on the user identifier and the security credentials.

13. The DS processing unit of claim 8 wherein the security requirements are determined based on at least one of:

a user identifier, a request type corresponding to the access request, a performance requirement, or a data type corresponding to the access request.

14. The DS processing unit of claim 8 wherein the at least one connection security approach is determined for each of the subset of the plurality of dispersed storage units further based on security capabilities of each of the subset of the plurality of dispersed storage units.

15. A computer readable storage medium comprises:

at least one memory section that stores operational instructions that, when executed by one or more processing modules of one or more computing devices of a dispersed storage network (DSN), causes the one or more computing devices to;

receive an access request;

determine security requirements corresponding to the access request;

determine a subset of a plurality of dispersed storage units based on the security requirements;

determine at least one connection security approach for each of the subset of the plurality of dispersed storage units based on the security requirements; and

process the access request via the subset of the plurality of dispersed storage units in accordance with the at least one connection security approach for each of the subset of the plurality of dispersed storage units.

16. The computer readable storage medium of claim 15 wherein the at least one connection security approach for each of the subset of the plurality of dispersed storage units includes a first connection security approach employed for one of the subset of the plurality of dispersed storage units and a second connection security approach employed for another of the subset of the plurality of dispersed storage units.

17. The computer readable storage medium of claim 15 wherein the at least one connection security approach for each of the subset of the plurality of dispersed storage units includes a first cipher employed for one of the subset of the plurality of dispersed storage units and a second cipher employed for another of the subset of the plurality of dispersed storage units.

18. The computer readable storage medium of claim 15 wherein the at least one connection security approach includes at least one of:

a transmission control protocol connection that is based on a user identifier and security credentials;

a transport layer security null cipher connection that is based on the user identifier and the security credentials;

or

a transport layer security cipher connection that is based on the user identifier and the security credentials.

19. The computer readable storage medium of claim 15 wherein the security requirements are determined based on at least one of:

a user identifier, a request type corresponding to the access request, a performance requirement, or a data type corresponding to the access request.

20. The computer readable storage medium of claim 15 wherein the at least one connection security approach is determined for each of the subset of the plurality of dispersed storage units further based on security capabilities of each of the subset of the plurality of dispersed storage units.