DISPERSED STORAGE SYSTEM WITH IDENTITY UNIT SELECTION AND METHODS FOR USE THEREWITH

• US 20150101024A1
• Filed: 08/12/2014
• Published: 04/09/2015
• Est. Priority Date: 10/03/2013
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Leggette, Wesley, Resch, Jason K., Smith, Eric Gunnar
• Granted Patent: US 10,120,569 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 12/1458 by checking the subject access rights
• CPC Class Codes: G06F 16/10 File systems; File servers
• CPC Class Codes: G06F 16/182 Distributed file systems
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: G06F 2211/1028 Distributed, i.e. distributed RAID systems with parity
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/154 Networked environment
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 3/0604 Improving or facilitating administration, e.g. storage management
• CPC Class Codes: G06F 3/061 Improving I/O performance
• CPC Class Codes: G06F 3/0611 in relation to response time
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0635 by changing the path, e.g. traffic rerouting, path reconfiguration
• CPC Class Codes: G06F 3/0637 Permissions
• CPC Class Codes: G06F 3/064 Management of blocks
• CPC Class Codes: G06F 3/0647 Migration mechanisms
• CPC Class Codes: G06F 3/0655 Vertical data movement, i.e. input-output transfer; data movement between one or more hosts and one or more storage devices
• CPC Class Codes: G06F 3/0665 : at area level, e.g. provisioning of virtual or logical volumes
• CPC Class Codes: G06F 3/067 : Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: G06F 3/0682 : Tape device
• CPC Class Codes: G06F 3/0689 : Disk arrays, e.g. RAID, JBOD
• CPC Class Codes: G06F 9/4881 : Scheduling strategies for dispatcher, e.g. round robin, multi-level priority queues
• CPC Class Codes: H04L 67/1001 : for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/1095 : Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/1097 : for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 67/145 : avoiding end of session, e.g. keep-alive, heartbeats, resumption message or wake-up for inactive or interrupted session

Abstract

A method for execution by one or more processing modules of a dispersed storage network (DSN) includes receiving a data access request for at least one data segment stored in the DSN. One of a plurality of identity units is selected, based on the data access request. The method determines, via the selected one of the plurality of identity units, whether to allow the data access request. The data access request is processed, when the data access request is allowed via the selected one of the plurality of identity units.

Claims

1. A method for execution by one or more processing modules of one or more computing devices of a dispersed storage network (DSN), the method comprises:

receiving a data access request for at least one data segment stored in the DSN;

selecting one of a plurality of identity units based on the data access request;

determining, via the selected one of the plurality of identity units, whether to allow the data access request;

processing the data access request, when the data access request is allowed via the selected one of the plurality of identity units.

2. The method of claim 1 wherein the data access request includes requesting entity credentials and indicates a request type.

3. The method of claim 1 wherein the one of the plurality of identity units is selected based on at least one of:

the requesting entity credentials, or the request type.

4. The method of claim 1 wherein the data access request includes requesting entity credentials and wherein determining whether to allow the data access request, includes reviewing the requesting entity credentials via the selected one of the plurality of identity units.

5. The method of claim 1 wherein the data access request indicates a request type and a requesting entity, and wherein when the data access request is allowed, processing the data access request is further conditioned on whether the requesting entity is authorized to perform the request type.

6. The method of claim 5 wherein when the data access request is allowed, the data access request is denied when the requesting entity is not authorized to perform the request type.

7. The method of claim 1 further comprising:

denying the data access request, when the data access request is not allowed via the selected one of the plurality of identity units.

8. A dispersed storage and task (DST) processing unit comprises:

at least one module, when operable within a computing device, that causes the computing device to;

receive a data access request for at least one data segment stored in a dispersed storage network (DSN);

select one of a plurality of identity units based on the data access request;

determine, via the selected one of the plurality of identity units, whether to allow the data access request;

process the data access request, when the data access request is allowed via the selected one of the plurality of identity units.

9. The DST processing unit of claim 8 wherein the data access request includes requesting entity credentials and indicates a request type.

10. The DST processing unit of claim 8 wherein the one of the plurality of identity units is selected based on at least one of:

the requesting entity credentials, or the request type.

11. The DST processing unit of claim 8 wherein the data access request includes requesting entity credentials and wherein determining whether to allow the data access request, includes reviewing the requesting entity credentials via the selected one of the plurality of identity units.

12. The DST processing unit of claim 8 wherein the data access request indicates a request type and a requesting entity, and wherein when the access request is allowed, processing the data access request is further conditioned on whether the requesting entity is authorized to perform the request type.

13. The DST processing unit of claim 12 wherein when the data access request is allowed, the data access request is denied when the requesting entity is not authorized to perform the request type.

14. The DST processing unit of claim 8 wherein the at least one module, when operable within the computing device, further causes the computing device to:

deny the data access request, when the data access request is not allowed via the selected one of the plurality of identity units.

determining the foster storage approach includes determining one of;

a performance optimized mode, and a reliability optimized mode.

15. A computer readable storage medium comprises:

at least one memory section that stores operational instructions that, when executed by one or more processing modules of one or more computing devices of a dispersed storage network (DSN), causes the one or more computing devices to;

receive a data access request for at least one data segment stored in the DSN;

select one of a plurality of identity units based on the data access request;

determine, via the selected one of the plurality of identity units, whether to allow the data access request;

process the data access request, when the data access request is allowed via the selected one of the plurality of identity units.

16. The computer readable storage medium of claim 15 wherein the data access request includes requesting entity credentials and indicates a request type.

17. The computer readable storage medium of claim 16 wherein the one of the plurality of identity units is selected based on at least one of:

the requesting entity credentials, or the request type.

18. The computer readable storage medium of claim 15 wherein the data access request includes requesting entity credentials and wherein determining whether to allow the data access request, includes reviewing the requesting entity credentials via the selected one of the plurality of identity units.

19. The computer readable storage medium of claim 15 wherein the data access request indicates a request type and a requesting entity, and wherein when the data access request is allowed, processing the data access request is further conditioned on whether the requesting entity is authorized to perform the request type.

20. The computer readable storage medium of claim 15 wherein the operational instructions, when executed by the one or more processing modules of the one or more computing devices of the dispersed storage network (DSN), further causes the one or more computing devices to:

deny the data access request, when the data access request is not allowed via the selected one of the plurality of identity units.