SECURITY RESPONSE PROTOCOL BASED ON SECURITY ALERT ENCODED DATA SLICES OF A DISTRIBUTED STORAGE NETWORK

• US 20180077159A1
• Filed: 09/12/2016
• Published: 03/15/2018
• Est. Priority Date: 09/12/2016
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Motwani, Manish, Ober, Brian F., Resch, Jason K.
• Granted Patent: US 10,547,615 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/308 retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A method includes receiving, from a requesting device, an access request for at least one security alert encoded data slice of a set of security alert encoded data slices. A security alert message is dispersed storage error encoded into the set of security alert encoded data slices and stored in a set of storage units of a dispersed storage network (DSN). The set of storage units further stores a plurality of sets of encoded data slices, which corresponds to a data object that is dispersed storage error encoded. The method further includes, based on the access request for the at least one security alert encoded data slice, identifying the requesting device as an unauthorized DSN device. The method further includes initiating a security response protocol within the DSN.

Claims

1. A method for execution by a device of a dispersed storage network (DSN), the method comprises:

receiving, from a requesting device, an access request that includes at least one security alert encoded data slice of a set of security alert encoded data slices, wherein a security alert message is dispersed storage error encoded into the set of security alert encoded data slices and stored in a set of storage units of the DSN, wherein the set of storage units further stores a plurality of sets of encoded data slices, wherein a data object is dispersed storage error encoded into the plurality of sets of encoded data slices; and

based on the access request for the at least one security alert encoded data slice;

identifying the requesting device as an unauthorized DSN device; and

initiating a security response protocol within the DSN.

2. The method of claim 1, wherein the identifying the requesting device as the unauthorized DSN device comprises:

interpreting metadata associated with the at least one security alert encoded data slice to determine that an authentic DSN device would not request access to the at least one security alert encoded data slice.

3. The method of claim 1 further comprises:

storing, by a security module of the DSN, the set of security alert encoded data slices in the set of storage units within a first DSN address range, wherein the set of storage units further stores first pluralities of sets of encoded data slices within the first DSN address range; and

storing, by the security module of the DSN, a second set of security alert encoded data slices in the set of storage units within a second DSN address range, wherein the set of storage units further stores second pluralities of sets of encoded data slices within the second DSN address range.

4. The method of claim 1, wherein the access request comprises:

a request to access a list of encoded data slices of the plurality of sets of encoded data slices, wherein the list of encoded data slices includes the at least one security alert encoded data slice.

5. The method of claim 1 further comprises:

receiving, by a computing device of the DSN, the access request from a second computing device;

interpreting, by the computing device, the access request to identify at least one DSN address;

determining, by the computing device, that the at least one DSN address corresponds to the security alert message; and

determining, by the computing device, that the second computing device is an unauthorized DSN device.

6. The method of claim 1 further comprises:

receiving, by a storage unit of the set of storage units, the access request from the requesting device that allegedly provides DSN services for a second computing device;

obtaining, by the storage unit, metadata associated with the at least one security alert encoded data slice;

determining, by the storage unit and based on the metadata, that the at least one security alert encoded data slice corresponds to the security alert message; and

determining, by the storage unit, that the requesting device is an unauthorized DSN device.

7. The method of claim 1, wherein the security response protocol comprises one or more of:

denying the access request;

denying further access to a DSN vault in which the plurality of sets of encoded data slices is stored;

banning the requesting device from accessing the DSN; and

directing the access request to a special DSN vault, wherein, when the access request is directed to the special DSN vault;

returning arbitrary data to the requesting device;

determining a level of security threat posed by the requesting device based on activity in the special DSN vault; and

generating security tracking information based on the level of security threat posed by the requesting device.

8. The method of claim 1 further comprises:

monitoring, by a security module of the DSN, the access request being transmitted from a second computing device of the DSN to a first computing device of the DSN;

determining, by the security module, at least one DSN address for the at least one security alert encoded data slice;

determining, by the security module, that the at least one DSN address corresponds to the security alert message; and

determining, by the security module, that the second computing device is an unauthorized DSN device.

9. The method of claim 1 further comprises:

monitoring, by a security module of the DSN, the access request for a first security alert encoded data slice being transmitted from a first computing device to a first storage unit of the set of storage units, wherein the first computing device provides DSN services for a second computing device;

obtaining, by the security module, metadata associated with the at least one security alert encoded data slice;

determining, by the security module and based on the metadata, that the at least one security alert encoded data slice corresponds to the security alert message; and

determining, by the security module, that the first computing device is an unauthorized DSN device.

10. The method of claim 9 further comprises:

monitoring, by the security module, the access request for multiple security alert encoded data slices being transmitted from the first computing device to multiple storage units of the set of storage units;

determining, by the security module, a level of security threat posed by the requesting device based on a number of storage units in the multiple storage units; and

generating, by the security module, security tracking information based on the level of security threat posed by the requesting device.

11. A computer readable memory comprises:

a first memory that stores operational instructions that, when executed by a device of a dispersed storage network (DSN), causes the device to;

receive, from a requesting device, an access request that includes at least one security alert encoded data slice of a set of security alert encoded data slices, wherein a security alert message is dispersed storage error encoded into the set of security alert encoded data slices and stored in a set of storage units of the DSN, wherein the set of storage units further stores a plurality of sets of encoded data slices, wherein a data object is dispersed storage error encoded into the plurality of sets of encoded data slices; and

a second memory that stores operational instructions that, when executed by the device, causes the device to;

based on the access request for the at least one security alert encoded data slice;

identify the requesting device as an unauthorized DSN device; and

initiate a security response protocol within the DSN.

12. The computer readable memory of claim 11, wherein the second memory further stores operational instructions that, when executed by the device, causes the device to identify the requesting device as the unauthorized DSN device by:

interpreting metadata associated with the at least one security alert encoded data slice to determine that an authentic DSN device would not request access to the at least one security alert encoded data slice.

13. The computer readable memory of claim 11 further comprises:

a third memory that stores operational instructions that, when executed by a security module of the DSN, causes the security module to;

store the set of security alert encoded data slices in the set of storage units within a first DSN address range, wherein the set of storage units further stores first pluralities of sets of encoded data slices within the first DSN address range; and

store a second set of security alert encoded data slices in the set of storage units within a second DSN address range, wherein the set of storage units further stores second pluralities of sets of encoded data slices within the second DSN address range.

14. The computer readable memory of claim 11, wherein the access request comprises:

a request to access a list of encoded data slices of the plurality of sets of encoded data slices, wherein the list of encoded data slices includes the at least one security alert encoded data slice.

15. The computer readable memory of claim 11, wherein the first memory further stores operational instructions that, when executed by a computing device of the DSN as the device, causes the computing device to:

receive the access request from a second computing device;

interpret the access request to identify at least one DSN address;

determine that the at least one DSN address corresponds to the security alert message; and

determine that the second computing device is an unauthorized DSN device.

16. The computer readable memory of claim 11, wherein the first memory further stores operational instructions that, when executed by a storage unit of the set of storage units as the device, causes the storage unit to:

receive the access request for the at least one security alert encoded data slice from a first computing device that provides DSN services for a second computing device;

obtain metadata associated with the at least one security alert encoded data slice;

determine, based on the metadata, that the at least one security alert encoded data slice corresponds to the security alert message; and

determine that the first computing device is an unauthorized DSN device.

17. The computer readable memory of claim 11, wherein the security response protocol comprises one or more of:

denying the access request;

denying further access to a DSN vault in which the plurality of sets of encoded data slices is stored;

banning the requesting device from accessing the DSN; and

directing the access request to a special DSN vault, wherein, when the access request is directed to the special DSN vault;

returning arbitrary data to the requesting device;

determining a level of security threat posed by the requesting device based on activity in the special DSN vault; and

generating security tracking information based on the level of security threat posed by the requesting device.

18. The computer readable memory of claim 11, wherein the first memory further stores operational instructions that, when executed by a security module of the DSN as the device, causes the security module to:

monitor the access request for the at least one security alert encoded data slice being transmitted from a second computing device of the DSN to a first computing device of the DSN;

determine at least one DSN address for the at least one security alert encoded data slice;

determine that the at least one DSN address corresponds to the security alert message; and

determine that the second computing device is an unauthorized DSN device.

19. The computer readable memory of claim 11, wherein the first memory further stores operational instructions that, when executed by a security module of the DSN as the device, causes the security module to:

monitor the access request for a first security alert encoded data slice being transmitted from a first computing device to a first storage unit of the set of storage units, wherein the first computing device provides DSN services for a second computing device;

obtain metadata associated with the at least one security alert encoded data slice;

determine, based on the metadata, that the at least one security alert encoded data slice corresponds to the security alert message; and

determine that the first computing device is an unauthorized DSN device.

20. The computer readable memory of claim 19, wherein the first memory further stores operational instructions that, when executed by a security module of the DSN as the device, causes the security module to:

monitor the access request for multiple security alert encoded data slices being transmitted from the first computing device to multiple storage units of the set of storage units;

determine a level of security threat posed by the requesting device based on a number of storage units in the multiple storage units; and

generate security tracking information based on the level of security threat posed by the requesting device.