Access control in a dispersed storage network

• US 8,683,119 B2
• Filed: 02/04/2011
• Issued: 03/25/2014
• Est. Priority Date: 03/15/2010
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Leggette, Wesley
• Primary Examiner(s): Verbrugge, Kevin
• Application Number:
  US13/021,589
• Publication Number:
  US 20110225362A1
• Time in Patent Office: 1,145 Days
• Field of Search: None
• US Class Current: 711/114
• CPC Class Codes: G06F 11/2094 Redundant storage or storage space G06F11/2056 takes precedence
• CPC Class Codes: G06F 12/1425 the protection being physical, e.g. cell, word, block
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/0638 Organizing or formatting or addressing of data
• CPC Class Codes: G06F 3/0689 Disk arrays, e.g. RAID, JBOD
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A method begins by a processing module receiving a data storage request that includes data and determining dispersed storage error encoding parameters for dispersed error encoding storage of data. The method continues with the processing module dispersed storage error encoding the data in accordance with the dispersed storage error encoding parameters to produce a set of encoded data slices and establishing access control information for each encoded data slice of the set encoded data slices in accordance with the dispersed storage error encoding parameters to produce a set of access control information. The method continues with the processing module appending a corresponding one of the set of access control information to each of the set of encoded data slices to produce a set of appended slices and outputting the set of appended slices to a set of dispersed storage units.

Claims

1. A method comprises:

receiving a data storage request that includes data;

determining dispersed storage error encoding parameters for storage of the data;

dispersed storage error encoding the data in accordance with the dispersed storage error encoding parameters to produce a set of encoded data slices;

establishing access control information for each encoded data slice of the set encoded data slices in accordance with the dispersed storage error encoding parameters to produce a set of access control information;

for each of the encoded data slices in the set of encoded data slices, appending a corresponding one of the set of access control information to produce a set of appended slices; and

outputting the set of appended slices to a set of dispersed storage (DS) units.

2. The method of claim 1, wherein the access control information comprises at least one of:

a requester identifier (ID) allowed to access the data;

a requester ID disallowed to access the data;

a requester ID allowed to access an encoded data slice of the set of encoded data slices associated with an allowed slice name;

a requester ID disallowed to access the encoded data slice of the set of encoded data slices associated with a disallowed slice name; and

an access type indicator.

3. The method of claim 1, wherein the establishing the set of access control information comprises at least one of:

extracting the set of access control information from the data storage request; and

retrieving the set of access control information based on at least one of a data identifier (ID), a user device ID, a data type, an analysis of the data, a priority indicator, a security indicator, a performance indicator, a vault lookup, a list, a command, a message, and a predetermination.

4. The method of claim 1, wherein the establishing the set of access control information comprises at least one of:

for at least a decode threshold number of encoded data slices of the set of encoded data slices, establishing the access control information to grant access to one or more specific requesting units;

for at least a pillar width number minus the decode threshold number of encoded data slices of the set of encoded data slices, establishing the access control information to deny access to one or more other specific requesting units;

for at least the decode threshold number of encoded data slices of the set of encoded data slices, establishing the access control information to grant access to a specific requesting code; and

for at least the decode threshold number of encoded data slices of the set of encoded data slices, establishing the access control information to grant read-only access to one or more specific requesting units.

5. In a dispersed storage network (DSN) that includes a plurality of dispersed storage (DS) units, a method for execution by each of the plurality of DS units comprises:

receiving a slice access request message that includes a slice name, a type of access request, and a requester identifier (ID);

obtaining access control information based on at least one of the slice name and the requestor ID;

determining whether the slice access request message is allowable based on the access control information; and

when the slice access request message is allowable, accessing an encoded data slice of a set of encoded data slices in accordance with the slice access request message.

6. The method of claim 5 further comprises:

when the slice access request message compares is not allowable, outputting a slice access denial response message.

7. The method of claim 5, wherein the obtaining the access control information comprises at least one of:

retrieving the access control information from a memory based on the slice name; and

sending an access control information request message to a dispersed storage (DS) managing unit, wherein the access control information request message includes the slice name, and receiving an access control information response message, wherein the access control information response message includes the access control information.

8. The method of claim 5, wherein the determining whether the slice access request message is allowable comprises at least one of:

determining that the requester ID is allowed access to the encoded data slice;

determining that the requester ID is not allowed access to the encoded data slice;

determining that the requester ID is allowed access to the encoded data slice for the type of access request; and

determining that the requester ID is not allowed access to the encoded data slice for the type of access request.

9. The method of claim 5, wherein the accessing the encoded data slice of the set of encoded data slices comprises at least one of:

retrieving the encoded data slice based on the slice name and outputting the encoded data slice;

extracting a replacement slice from the slice access request message and replacing the encoded data slice affiliated with the slice name with the replacement slice;

extracting the encoded data slice from the slice access request message and storing the encoded data slice;

deleting the encoded data slice based on the slice name; and

retrieving slice attributes associated with the encoded data slice based on the slice name and outputting the slice attributes.

10. A computer comprises:

an interface;

a memory; and

a processing module operable to;

receive, via the interface, a data storage request that includes data;

determine dispersed storage error encoding parameters for storage of data;

dispersed storage error encode the data in accordance with the dispersed storage error encoding parameters to produce a set of encoded data slices;

establish access control information for each encoded data slice of the set encoded data slices in accordance with the dispersed storage error encoding parameters to produce a set of access control information;

for each of the encoded data slices in the set of encoded data slices, append a corresponding one of the set of access control information to produce a set of appended slices; and

output, via the interface, the set of appended slices to a set of dispersed storage (DS) units.

11. The computer of claim 10, wherein the access control information comprises at least one of:

a requester identifier (ID) allowed to access the data;

a requester ID disallowed to access the data;

a requester ID allowed to access an encoded data slice of the set of encoded data slices associated with an allowed slice name;

a requester ID disallowed to access the encoded data slice of the set of encoded data slices associated with a disallowed slice name; and

an access type indicator.

12. The computer of claim 10, wherein the processing module functions to establish the set of access control information by at least one of:

extracting the set of access control information from the data storage request; and

retrieving the set of access control information based on at least one of a data identifier (ID), a user device ID, a data type, an analysis of the data, a priority indicator, a security indicator, a performance indicator, a vault lookup, a list, a command, a message, and a predetermination.

13. The computer of claim 10, wherein the processing module functions to establish the set of access control information by at least one of:

establishing the access control information to grant access to one or more specific requesting units for at least a decode threshold number of encoded data slices of the set of encoded data slices;

establishing the access control information to deny access to one or more other specific requesting units for at least a pillar width number minus the decode threshold number of encoded data slices of the set of encoded data slices;

establishing the access control information to grant access to a specific requesting code for at least the decode threshold number of encoded data slices of the set of encoded data slices; and

establishing the access control information to grant read-only access to one or more specific requesting units for at least the decode threshold number of encoded data slices of the set of encoded data slices.

14. A dispersed storage (DS) unit of a plurality of DS units in a dispersed storage network (DSN) comprises:

an interface;

a memory; and

a processing module operable to;

receive, via the interface, a slice access request message that includes a slice name, a type of access request, and a requester identifier (ID);

obtain access control information based on at least one of the slice name and the requestor ID;

determine whether the slice access request message is allowable based on the access control information; and

access, via the memory, an encoded data slice of a set of encoded data slices in accordance with the slice access request message when the slice access request message is allowable.

15. The computer of claim 14, wherein the processing module further functions to:

output, via the interface, a slice access denial response message when the slice access request message compares is not allowable.

16. The computer of claim 14, wherein the processing module functions to obtain the access control information by at least one of:

retrieving the access control information from the memory based on the slice name; and

sending, via the interface, an access control information request message to a dispersed storage (DS) managing unit, wherein the access control information request message includes the slice name, and receiving, via interface, an access control information response message, wherein the access control information response message includes the access control information.

17. The computer of claim 14, wherein the processing module further functions to determine whether the slice access request message is allowable by at least one of:

determining that the requester ID is allowed access to the encoded data slice;

determining that the requester ID is not allowed access to the encoded data slice;

determining that the requester ID is allowed access to the encoded data slice for the type of access request; and

determining that the requester ID is not allowed access to the encoded data slice for the type of access request.

18. The computer of claim 14, wherein the processing module further functions to access the encoded data slice of the set of encoded data slices by at least one of:

retrieving, from the memory, the encoded data slice based on the slice name and outputting, via the interface, the encoded data slice;

extracting a replacement slice from the slice access request message and replacing, in the memory, the encoded data slice affiliated with the slice name with the replacement slice;

extracting the encoded data slice from the slice access request message and storing, in the memory, the encoded data slice;

deleting, in the memory, the encoded data slice based on the slice name; and

retrieving, from the memory, slice attributes associated with the encoded data slice based on the slice name and outputting, via the interface, the slice attributes.