VAULT PROVISIONING WITHIN DISPERSED OR DISTRIBUTED STORAGE NETWORK (DSN)

• US 20170300259A1
• Filed: 07/06/2017
• Published: 10/19/2017
• Est. Priority Date: 08/29/2013
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Cilfone, Bart R., Horan, Scott M., Leggette, Wesley B., Eggum, Adam D., Resch, Jason K.
• Granted Patent: US 10,489,071 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 9/5016 the resource being the memory
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A computing device includes an interface configured to interface and communicate with a dispersed storage network (DSN), a memory that stores operational instructions, and a processing module operably coupled to the interface and memory such that the processing module, when operable within the computing device based on the operational instructions, is configured to perform various operations. The computing device receives, from another computing device, a vault provisioning request and processes the vault provisioning request to determine whether the other computing device is authorized to request provisioning of another vault within the DSN. When the other computing device is authorized, the computing device generates a vault within the DSN in response to the vault provisioning request from the other computing device and updates access control information within the DSN to include an initial access control for the vault and an identifier of the other computing device.

Claims

1. A computing device comprising:

an interface configured to interface and communicate with a dispersed or distributed storage network (DSN);

memory that stores operational instructions; and

a processing module operably coupled to the interface and to the memory, wherein the processing module, when operable within the computing device based on the operational instructions, is configured to;

receive, via the DSN and via the interface from another computing device, a vault provisioning request, wherein a vault within the DSN includes a virtual memory block provisioned across a plurality of storage units (SUs) within the DSN to store a data object, wherein the data object is segmented into a plurality of data segments, wherein a data segment of the plurality of data segments is dispersed error encoded in accordance with dispersed error encoding parameters to produce a set of encoded data slices (EDSs) to be stored within the vault within the DSN;

process the vault provisioning request to determine whether the another computing device is authorized to request provisioning of another vault within the DSN; and

when the another computing device is determined to be authorized;

generate the another vault within the DSN in response to the vault provisioning request from the another computing device; and

update access control information within the DSN to include an initial access control for the another vault and an identifier of the another computing device.

2. The computing device of claim 1, wherein the vault provisioning request includes a vault name and a vault template name, and wherein the processing module, when operable within the computing device based on the operational instructions, is further configured to:

generate a plurality of vault templates based on at least one of manager input, a previous vault, DSN network configuration information, DSN capabilities, a vault list, or an expected vault list;

determine whether the another computing device is authorized to request provisioning of the vault within the DSN based on the another computing device being authorized to request provisioning of the vault within the DSN as indicated within a registry of the DSN; and

when the another computing device is determined to be authorized;

select a vault template from the plurality of vault templates based on the vault template name;

activate the another vault within the DSN in response to the vault provisioning request from the another computing device and based on the vault template selected from the plurality of vault templates;

generate a vault provisioning response that indicates activation of the another vault within the DSN; and

transmit, via the interface and via the DSN, the vault provisioning response to the another computing device.

3. The computing device of claim 2, wherein a vault template of a corresponding vault of the plurality of vault templates includes a field that includes at least one of:

a template name field that includes a name entry for the vault template, a width field that includes a width entry corresponding to a dispersed storage pillar width parameter, a decode threshold field that includes a decode threshold entry corresponding to a dispersed storage decode threshold parameter, a storage pools field that includes entries of identifiers of SUs of one or more storage pools, a storage quotas field that includes entries of storage quota maximums associated with one or users of the corresponding vault, a codecs field that includes one or more entries of codecs utilized in dispersed storage error coding of other EDSs of another data object to be stored in the corresponding vault, or system configuration of a Decentralized, or Distributed, Agreement Protocol (DAP) of the DSN.

4. The computing device of claim 2, wherein the processing module, when operable within the another computing device based on the operational instructions, is further configured to:

activate the another vault within the DSN including to store the another vault in the registry of the DSN and publish the registry to a plurality of other computing devices of the DSN as a registry publication.

5. The computing device of claim 1, wherein:

the set of EDSs are distributedly stored among a subset of the plurality of SUs that correspond to the vault within the DSN;

a decode threshold number of EDSs are needed to recover the data segment;

a read threshold number of EDSs provides for reconstruction of the data segment; and

a write threshold number of EDSs provides for a successful transfer of the set of EDSs from a first at least one location in the DSN to a second at least one location in the DSN.

6. The computing device of claim 1 further comprising:

a managing unit that is remotely located from the another computing device within the DSN and also remotely located from at least one SU of the plurality of SUs within the DSN.

7. The computing device of claim 1 further comprising:

a SU of the plurality of SUs within the DSN, a wireless smart phone, a laptop, a tablet, a personal computers (PC), a work station, or a video game device.

8. The computing device of claim 1, wherein the DSN includes at least one of a wireless communication system, a wire lined communication systems, a non-public intranet system, a public internet system, a local area network (LAN), or a wide area network (WAN).

9. A computing device comprising:

an interface configured to interface and communicate with a dispersed or distributed storage network (DSN);

memory that stores operational instructions; and

a processing module operably coupled to the interface and to the memory, wherein the processing module, when operable within the computing device based on the operational instructions, is configured to;

generate a plurality of vault templates based on at least one of manager input, a previous vault, DSN network configuration information, DSN capabilities, a vault list, or an expected vault list;

receive, via the DSN and via the interface from another computing device, a vault provisioning request that includes a vault name and a vault template name, wherein a vault within the DSN includes a virtual memory block provisioned across a plurality of storage units (SUs) within the DSN to store a data object, wherein the data object is segmented into a plurality of data segments, wherein a data segment of the plurality of data segments is dispersed error encoded in accordance with dispersed error encoding parameters to produce a set of encoded data slices (EDSs) to be stored within the vault within the DSN, wherein the set of EDSs are distributedly stored among a subset of the plurality of SUs that correspond to the vault within the DSN, wherein a decode threshold number of EDSs are needed to recover the data segment, wherein a read threshold number of EDSs provides for reconstruction of the data segment, and wherein a write threshold number of EDSs provides for a successful transfer of the set of EDSs from a first at least one location in the DSN to a second at least one location in the DSN;

process the vault provisioning request to determine whether the another computing device is authorized to request provisioning of another vault within the DSN based on the another computing device being authorized to request provisioning of the vault within the DSN as indicated within a registry of the DSN; and

when the computing device is determined to be authorized;

select a vault template from the plurality of vault templates based on the vault template name;

activate the another vault within the DSN in response to the vault provisioning request from the another computing device and based on the vault template selected from the plurality of vault templates;

update access control information within the DSN to include an initial access control for the another vault and an identifier of the another computing device;

generate a vault provisioning response that indicates activation of the another vault within the DSN; and

transmit, via the interface and via the DSN, the vault provisioning response to the another computing device.

10. The computing device of claim 9, wherein a vault template of a corresponding vault of the plurality of vault templates includes a field that includes at least one of:

a template name field that includes a name entry for the vault template, a width field that includes a width entry corresponding to a dispersed storage pillar width parameter, a decode threshold field that includes a decode threshold entry corresponding to a dispersed storage decode threshold parameter, a storage pools field that includes entries of identifiers of SUs of one or more storage pools, a storage quotas field that includes entries of storage quota maximums associated with one or users of the corresponding vault, a codecs field that includes one or more entries of codecs utilized in dispersed storage error coding of other EDSs of another data object to be stored in the corresponding vault, or system configuration of a Decentralized, or Distributed, Agreement Protocol (DAP) of the DSN.

11. The computing device of claim 9, wherein the processing module, when operable within the computing device based on the operational instructions, is further configured to:

activate the another vault within the DSN including to store the another vault in the registry of the DSN and publish the registry to a plurality of other computing devices of the DSN as a registry publication.

12. The computing device of claim 9 further comprising:

a managing unit, a SU of the plurality of SUs within the DSN, a wireless smart phone, a laptop, a tablet, a personal computers (PC), a work station, or a video game device.

13. The computing device of claim 9, wherein the DSN includes at least one of a wireless communication system, a wire lined communication systems, a non-public intranet system, a public internet system, a local area network (LAN), or a wide area network (WAN).

14. A method for execution by a computing device, the method comprising:

receiving, via an interface configured to interface and communicate with a dispersed or distributed storage network (DSN) and from another computing device, a vault provisioning request, wherein a vault within the DSN includes a virtual memory block provisioned across a plurality of storage units (SUs) within the DSN to store a data object, wherein the data object is segmented into a plurality of data segments, wherein a data segment of the plurality of data segments is dispersed error encoded in accordance with dispersed error encoding parameters to produce a set of encoded data slices (EDSs) to be stored within the vault within the DSN;

processing the vault provisioning request to determine whether the another computing device is authorized to request provisioning of another vault within the DSN; and

when the another computing device is determined to be authorized;

generating the another vault within the DSN in response to the vault provisioning request from the another computing device; and

updating access control information within the DSN to include an initial access control for the another vault and an identifier of the another computing device.

15. The method of claim 14, wherein the vault provisioning request includes a vault name and a vault template name;

and further comprising;

generating a plurality of vault templates based on at least one of manager input, a previous vault, DSN network configuration information, DSN capabilities, a vault list, or an expected vault list;

determining whether the another computing device is authorized to request provisioning of the vault within the DSN based on the another computing device being authorized to request provisioning of the vault within the DSN as indicated within a registry of the DSN; and

when the another computing device is determined to be authorized;

selecting a vault template from the plurality of vault templates based on the vault template name;

activating the another vault within the DSN in response to the vault provisioning request from the another computing device and based on the vault template selected from the plurality of vault templates;

generating a vault provisioning response that indicates activation of the another vault within the DSN; and

transmitting, via the interface and via the DSN, the vault provisioning response to the another computing device.

16. The method of claim 15, wherein a vault template of a corresponding vault of the plurality of vault templates includes a field that includes at least one of:

a template name field that includes a name entry for the vault template, a width field that includes a width entry corresponding to a dispersed storage pillar width parameter, a decode threshold field that includes a decode threshold entry corresponding to a dispersed storage decode threshold parameter, a storage pools field that includes entries of identifiers of SUs of one or more storage pools, a storage quotas field that includes entries of storage quota maximums associated with one or users of the corresponding vault, a codecs field that includes one or more entries of codecs utilized in dispersed storage error coding of other EDSs of another data object to be stored in the corresponding vault, or system configuration of a Decentralized, or Distributed, Agreement Protocol (DAP) of the DSN.

17. The method of claim 15 further comprising:

activating the another vault within the DSN including to store the another vault in the registry of the DSN and publish the registry to a plurality of other computing devices of the DSN as a registry publication.

18. The method of claim 14, wherein:

the set of EDSs are distributedly stored among a subset of the plurality of SUs that correspond to the vault within the DSN;

a decode threshold number of EDSs are needed to recover the data segment;

a read threshold number of EDSs provides for reconstruction of the data segment; and

a write threshold number of EDSs provides for a successful transfer of the set of EDSs from a first at least one location in the DSN to a second at least one location in the DSN.

19. The method of claim 14, wherein the computing device includes a managing unit, a SU of the plurality of SUs within the DSN, a wireless smart phone, a laptop, a tablet, a personal computers (PC), a work station, or a video game device.

20. The method of claim 14, wherein the DSN includes at least one of a wireless communication system, a wire lined communication systems, a non-public intranet system, a public internet system, a local area network (LAN), or a wide area network (WAN).