DISTRIBUTED STORAGE NETWORK WITH ENHANCED SECURITY MONITORING

• US 20180077173A1
• Filed: 09/09/2016
• Published: 03/15/2018
• Est. Priority Date: 09/09/2016
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Motwani, Manish, Ober, Brian F., Resch, Jason K.
• Granted Patent: US 10,225,271 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 3/061 Improving I/O performance
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/062 Securing storage systems
• CPC Class Codes: G06F 3/0635 by changing the path, e.g. traffic rerouting, path reconfiguration
• CPC Class Codes: G06F 3/064 Management of blocks
• CPC Class Codes: G06F 3/0653 Monitoring storage devices or systems
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H03M 13/1515 Reed-Solomon codes
• CPC Class Codes: H03M 13/616 Matrix operations, especially for generator matrices or check matrices, e.g. column or row permutations
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A method includes receiving a data access request from a requesting device regarding one or more encoded data slices. A data object is dispersed storage error encoded into a plurality of sets of encoded data slices that are stored in storage units of a dispersed storage network (DSN). The method further includes determining whether one or more of the data access request, the requesting device, and the data object is affiliated with a DSN entity flagged for enhanced security monitoring. When the one or more of the data access request, the requesting device, and the data object is affiliated with the DSN entity flagged for enhanced security monitoring, the method further includes determining enhanced security monitoring parameters; generating security monitoring information in accordance with the enhanced security monitoring parameters; determining a DSN security threat level; and implementing a security protocol based on the DSN security threat level.

Claims

1. A method comprises:

receiving, by a computing device in a dispersed storage network (DSN), a data access request from a requesting device regarding one or more encoded data slices, wherein a data object is dispersed storage error encoded into a plurality of sets of encoded data slices that includes the one or more encoded data slices, and wherein the plurality of sets of encoded data slices are stored in storage units of the DSN;

determining, by the computing device, whether one or more of the data access request, the requesting device, and the data object is affiliated with a DSN entity flagged for enhanced security monitoring;

when the one or more of the data access request, the requesting device, and the data object is affiliated with the DSN entity flagged for enhanced security monitoring;

determining, by the computing device, enhanced security monitoring parameters;

generating, by the computing device, security monitoring information regarding the one or more of the data access request, the requesting device, and the data object in accordance with the enhanced security monitoring parameters;

interpreting, by at least one of the computing device and a security device of the DSN, the security monitoring information to determine a DSN security threat level; and

implementing, by the at least one of the computing device and the security device, a security protocol based on the DSN security threat level.

2. The method of claim 1, wherein the DSN entity comprises one of:

a device;

a set of devices;

a data file;

a data object;

a data container; and

a vault.

3. The method of claim 1, wherein the determining whether the one or more of the data access request, the requesting device, and the data object is affiliated with the DSN entity flagged for enhanced security monitoring comprises one or more of:

determining that the data object is stored in or is to be stored in a vault flagged for enhanced security monitoring;

determining that the requesting device is flagged for enhanced security monitoring;

determining that the requesting device is not authorized to issue the data access request regarding the one or more encoded data slices;

determining that the data access request is requesting an unauthorized edit of the one or more encoded data slices;

determining that the one or more of the storage units is flagged for enhanced security monitoring;

determining that content of the data object includes one or more content trigger words or phrases;

determining that a data object name or a file name associated with the data object includes one or more naming trigger words or phrases; and

determining that a signature associated with the data object includes one or more signature trigger words or phrases.

4. The method of claim 1, wherein the enhanced security monitoring parameters comprises one or more of:

current monitoring;

historical monitoring;

a monitoring level; and

data access restrictions.

5. The method of claim 1, wherein the security monitoring information comprises one or more of:

auditing and logging information;

copying all accessed data for review by an authority agent;

notifying the authority agent of specific data accesses; and

generating a copy of data that a requesting device flagged for enhanced security monitoring requests for deletion.

6. The method of claim 1 further comprises:

when the enhanced security monitoring parameters includes historical data;

retrieving historical security monitoring information regarding the one or more of the data access request, the requesting device, and the data object affiliated with the DSN entity flagged for enhanced security monitoring; and

combining the historical security monitoring information with current security monitoring information associated with the data access request to produce the security monitoring information.

7. The method of claim 1, wherein the determining whether the one or more of the data access request, the requesting device, and the data object is affiliated with the DSN entity flagged for enhanced security monitoring comprises:

identifying an atypical mannerism of the data access request; and

determining that, as a result of the atypical mannerism, the requesting device is the DSN entity flagged for enhanced security monitoring.

8. The method of claim 1, wherein the determining whether the one or more of the data access request, the requesting device, and the data object is affiliated with the DSN entity flagged for enhanced security monitoring comprises:

receiving, from an authority agent, an indicator that the one or more of the data access request, the requesting device, and the data object is affiliated with the DSN entity flagged for enhanced security monitoring.

9. The method of claim 1, wherein the implementing a security protocol comprises one or more of:

denying further access to the DSN by the requesting device;

verifying integrity of the one or more encoded data slices;

verifying integrity of the plurality of sets of encoded data slices;

denying access to the one or more encoded data slices;

denying access to the plurality of sets of encoded data slices; and

restricting access to one or more of the storage units.

10. A computer readable memory comprises:

a first memory element that stores operational instructions that, when executed by a computing device of a dispersed storage network (DSN), causes the computing device to;

receive a data access request from a requesting device regarding one or more encoded data slices, wherein a data object is dispersed storage error encoded into a plurality of sets of encoded data slices that includes the one or more encoded data slices, and wherein the plurality of sets of encoded data slices are stored in storage units of the DSN;

a second memory element that stores operational instructions that, when executed by the computing device, causes the computing device to;

determine whether one or more of the data access request, the requesting device, and the data object is affiliated with a DSN entity flagged for enhanced security monitoring;

when the one or more of the data access request, the requesting device, and the data object is affiliated with the DSN entity flagged for enhanced security monitoring;

a third memory element that stores operational instructions that, when executed by the computing device, causes the computing device to;

determine enhanced security monitoring parameters;

generate security monitoring information regarding the one or more of the data access request, the requesting device, and the data object in accordance with the enhanced security monitoring parameters; and

a fourth memory element that stores operational instructions that, when executed by at least one of the computing device and a security device of the DSN, causes the at least one of the computing device and the security device to;

interpret the security monitoring information to determine a DSN security threat level; and

implement a security protocol based on the DSN security threat level.

11. The computer readable memory of claim 10, wherein the DSN entity comprises one of:

a device;

a set of devices;

a data file;

a data object;

a data container; and

a vault.

12. The computer readable memory of claim 10, wherein the second memory element further stores operational instructions that, when executed by the computing device, causes the computing device to determine whether the one or more of the data access request, the requesting device, and the data object is affiliated with the DSN entity flagged for enhanced security monitoring by one or more of:

determining that the data object is stored in or is to be stored in a vault flagged for enhanced security monitoring;

determining that the requesting device is flagged for enhanced security monitoring;

determining that the requesting device is not authorized to issue the data access request regarding the one or more encoded data slices;

determining that the data access request is requesting an unauthorized edit of the one or more encoded data slices;

determining that the one or more of the storage units is flagged for enhanced security monitoring;

determining that content of the data object includes one or more content trigger words or phrases;

determining that a data object name or a file name associated with the data object includes one or more naming trigger words or phrases; and

determining that a signature associated with the data object includes one or more signature trigger words or phrases.

13. The computer readable memory of claim 10, wherein the enhanced security monitoring parameters comprises one or more of:

current monitoring;

historical monitoring;

a monitoring level; and

data access restrictions.

14. The computer readable memory of claim 10, wherein the security monitoring information comprises one or more of:

auditing and logging information;

copying all accessed data for review by an authority agent;

notifying the authority agent of specific data accesses; and

generating a copy of data that a requesting device flagged for enhanced security monitoring requests for deletion.

15. The computer readable memory of claim 10, wherein the third memory element further stores operational instructions that, when executed by the computing device, causes the computing device to:

when the enhanced security monitoring parameters includes historical data;

retrieve historical security monitoring information regarding the one or more of the data access request, the requesting device, and the data object affiliated with the DSN entity flagged for enhanced security monitoring; and

combine the historical security monitoring information with current security monitoring information associated with the data access request to produce the security monitoring information.

16. The computer readable memory of claim 10, wherein the second memory element further stores operational instructions that, when executed by the computing device, causes the computing device to determine whether the one or more of the data access request, the requesting device, and the data object is affiliated with the DSN entity flagged for enhanced security monitoring by:

identifying an atypical mannerism of the data access request; and

determining that, as a result of the atypical mannerism, the requesting device is the DSN entity flagged for enhanced security monitoring.

17. The computer readable memory of claim 10, wherein the second memory element further stores operational instructions that, when executed by the computing device, causes the computing device to determine whether the one or more of the data access request, the requesting device, and the data object is affiliated with the DSN entity flagged for enhanced security monitoring by:

receiving, from an authority agent, an indicator that the one or more of the data access request, the requesting device, and the data object is affiliated with the DSN entity flagged for enhanced security monitoring.

18. The computer readable memory of claim 10, wherein the fourth memory element that stores operational instructions that, when executed by the at least one of the computing device and a security device, causes the at least one of the computing device and the security device to implement the security protocol by one or more of:

denying further access to the DSN by the requesting device;

verifying integrity of the one or more encoded data slices;

verifying integrity of the plurality of sets of encoded data slices;

denying access to the one or more encoded data slices;

denying access to the plurality of sets of encoded data slices; and

restricting access to one or more of the storage units.