HIERARCHIES OF CREDENTIAL AND ACCESS CONTROL SHARING BETWEEN DSN MEMORIES

• US 20170289171A1
• Filed: 01/03/2017
• Published: 10/05/2017
• Est. Priority Date: 03/29/2016
• Status: Active Grant

• Current Assignee: Workday Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Resch, Jason K.
• Granted Patent: US 10,831,381 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 11/1092 Rebuilding, e.g. when physically replacing a failing disk
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2133 Verifying human interaction, e.g., Captcha
• CPC Class Codes: G06F 3/0604 Improving or facilitating administration, e.g. storage management
• CPC Class Codes: G06F 3/061 Improving I/O performance
• CPC Class Codes: G06F 3/0611 in relation to response time
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/0631 by allocating resources to storage systems
• CPC Class Codes: G06F 3/0635 by changing the path, e.g. traffic rerouting, path reconfiguration
• CPC Class Codes: G06F 3/064 Management of blocks
• CPC Class Codes: G06F 3/0644 Management of space entities, e.g. partitions, extents, pools
• CPC Class Codes: G06F 3/0647 Migration mechanisms
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/485 Task life-cycle, e.g. stopping, restarting, resuming execution G06F9/4881 takes precedence
• CPC Class Codes: G06F 9/4881 Scheduling strategies for dispatcher, e.g. round robin, multi-level priority queues
• CPC Class Codes: H03M 13/05 using block codes, i.e. a predetermined number of check bits joined to a predetermined number of information bits H03M13/2906 takes precedence
• CPC Class Codes: H03M 13/1515 Reed-Solomon codes
• CPC Class Codes: H03M 13/373 : with erasure correction and erasure determination, e.g. for packet loss recovery or setting of erasures for the decoding of Reed-Solomon codes
• CPC Class Codes: H03M 13/616 : Matrix operations, especially for generator matrices or check matrices, e.g. column or row permutations
• CPC Class Codes: H04L 61/10 : of different types
• CPC Class Codes: H04L 61/50 : Address allocation
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/104 : Grouping of entities
• CPC Class Codes: H04L 63/108 : when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 67/1097 : for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 67/56 : Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54

Abstract

A method includes detecting a change to one or more of: a credential of set of storage units supporting a logical storage vault and access control information for a user group affiliated with the logical storage vault. The method further includes, in response to the detecting, determining, whether the logical storage vault is in a relationship with another logical storage vault. When the logical storage vault is in the relationship, determining whether the logical storage vault is an originating vault or a subservient vault. When the logical storage vault is the originating vault, sending updated access control information to the second set of storage units regarding a change to the access control information. When the logical storage vault is the subservient vault, sending an updated credential of the set of storage units to the computing device regarding a change to the credential of the set of storage units.

Claims

1. A method comprises:

detecting, by a computing device, a change to one or more of;

a credential of set of storage units supporting a logical storage vault and access control information for a user group affiliated with the logical storage vault; and

in response to the detecting;

determining, by the computing device, whether the logical storage vault is in a relationship with another logical storage vault, wherein the another logical storage vault is supported by a second set of storage units;

when the logical storage vault is in the relationship with the other logical storage vault, determining whether the logical storage vault is an originating vault or a subservient vault with respect to the other logical storage vault;

when the logical storage vault is the originating vault, sending, by the set of storage units, updated access control information to the second set of storage units regarding a change to the access control information; and

when the logical storage vault is the subservient vault, sending, by the set of storage units, an updated credential of the set of storage units to the computing device regarding a change to the credential of the set of storage units.

2. The method of claim 1, wherein the credential comprises one or more of:

a signed certificate;

a key;

an authorization token;

a user name and password pair;

an authorization time frame indicator;

a permission list;

a type of services granted; and

an encryption key.

3. The method of claim 1, wherein the access control information comprises one or more of:

authentication information;

permission regarding one or more of storing data, reading data, deleting data, and retrieving a list of slice names; and

one or more security parameters.

4. The method of claim 1 further comprises:

determining that the logical storage vault is in a unidirectional relationship with the other logical storage vault;

determining that the logical storage vault is the originating vault when, in accordance with the unidirectional relationship, a group of user devices affiliated with the logical storage vault have access privileges to the other logical storage vault; and

determining that the logical storage vault is the subservient vault when, in accordance with the unidirectional relationship, a second group of user devices affiliated with the other logical storage vault have access privileges to the logical storage vault.

5. The method of claim 1 further comprises:

determining that the logical storage vault is in a bidirectional relationship with the other logical storage vault;

determining that the logical storage vault is both the originating vault and the subservient vault when, in accordance with the bidirectional relationship, a group of user devices affiliated with the logical storage vault have access privileges to the other logical storage vault and a second group of user devices affiliated with the other logical storage vault have access privileges to the logical storage vault.

6. The method of claim 1 further comprises:

in response to the detecting;

determining, by the computing device, whether the logical storage vault is in a second relationship with a second other logical storage vault, wherein the second other logical storage vault is supported by a third set of storage units;

when the logical storage vault is in the second relationship with the second other logical storage vault, determining whether the logical storage vault is a second originating vault or a second subservient vault with respect to the second other logical storage vault;

when the logical storage vault is the second originating vault, sending, by the set of storage units, the updated access control information to the third set of storage units; and

when the logical storage vault is the second subservient vault, utilizing, by the computing device, the updated credential for data access requests in accordance with the second relationship.

7. The method of claim 1 further comprises:

the set of storage units being affiliated with a first dispersed storage network (DSN) of a plurality of DSNs; and

the second set of storage units being affiliated with a second DSN of the plurality of DSNs.

8. A computer readable memory comprises:

a first memory that stores operational instructions that, when executed by a computing device, causes the computing device to;

detect a change to one or more of;

a credential of set of storage units supporting a logical storage vault and access control information for a user group affiliated with the logical storage vault; and

a second memory that stores operational instructions that, when executed by the computing device, cause the computing device to;

in response to the detecting

determine whether the logical storage vault is in a relationship with another logical storage vault, wherein the another logical storage vault is supported by a second set of storage units; and

when the logical storage vault is in the relationship with the other logical storage vault, determine whether the logical storage vault is an originating vault or a subservient vault with respect to the other logical storage vault; and

a third memory that stores operational instructions that, when executed by the set of storage units, cause the set of storage units to;

when the logical storage vault is the originating vault, send updated access control information to the second set of storage units regarding a change to the access control information; and

when the logical storage vault is the subservient vault, send an updated credential of the set of storage units to the computing device regarding a change to the credential of the set of storage units.

9. The computer readable memory of claim 8, wherein the credential comprises one or more of:

a signed certificate;

a key;

an authorization token;

a user name and password pair;

an authorization time frame indicator;

a permission list;

a type of services granted; and

an encryption key.

10. The computer readable memory of claim 8, wherein the access control information comprises one or more of:

authentication information;

permission regarding one or more of storing data, reading data, deleting data, and retrieving a list of slice names; and

one or more security parameters.

11. The computer readable memory of claim 8, wherein the second memory further stores operational instructions that, when executed by the computing device, cause the computing device to:

determine that the logical storage vault is in a unidirectional relationship with the other logical storage vault;

determine that the logical storage vault is the originating vault when, in accordance with the unidirectional relationship, a group of user devices affiliated with the logical storage vault have access privileges to the other logical storage vault; and

determine that the logical storage vault is the subservient vault when, in accordance with the unidirectional relationship, a second group of user devices affiliated with the other logical storage vault have access privileges to the logical storage vault.

12. The computer readable memory of claim 8, wherein the second memory further stores operational instructions that, when executed by the computing device, cause the computing device to:

determine that the logical storage vault is in a bidirectional relationship with the other logical storage vault;

determine that the logical storage vault is both the originating vault and the subservient vault when, in accordance with the bidirectional relationship, a group of user devices affiliated with the logical storage vault have access privileges to the other logical storage vault and a second group of user devices affiliated with the other logical storage vault have access privileges to the logical storage vault.

13. The computer readable memory of claim 8 further comprises:

the second memory further stores operational instructions that, when executed by the computing device, cause the computing device to;

in response to the detecting;

determine whether the logical storage vault is in a second relationship with a second other logical storage vault, wherein the second other logical storage vault is supported by a third set of storage units; and

when the logical storage vault is in the second relationship with the second other logical storage vault, determine whether the logical storage vault is a second originating vault or a second subservient vault with respect to the second other logical storage vault; and

the third memory further stores operational instructions that, when executed by the set of storage units, cause the set of storage units to;

when the logical storage vault is the second originating vault, send the updated access control information to the third set of storage units; and

a fourth memory that stores operational instructions that, when executed by the computing device, cause the computing device to;

when the logical storage vault is the second subservient vault, utilize the updated credential for data access requests in accordance with the second relationship.

14. The computer readable memory of claim 8 further comprises:

the set of storage units being affiliated with a first dispersed storage network (DSN) of a plurality of DSNs; and

the second set of storage units being affiliated with a second DSN of the plurality of DSNs.