Obtaining a signed certificate for a dispersed storage network

• US 8,776,186 B2
• Filed: 08/17/2012
• Issued: 07/08/2014
• Est. Priority Date: 10/04/2011
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Resch, Jason K., Leggette, Wesley, Baptist, Andrew
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US13/588,259
• Publication Number:
  US 20130086642A1
• Time in Patent Office: 690 Days
• Field of Search: 726/4, 713/156, 713/175
• US Class Current: 726/4
• CPC Class Codes: G06F 11/00 Error detection; Error correction; Monitoring error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 11/1446 Point-in-time backing up or restoration of persistent data
• CPC Class Codes: G06F 15/17331 Distributed shared memory [DSM], e.g. remote direct memory access [RDMA]
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 2211/1028 Distributed, i.e. distributed RAID systems with parity
• CPC Class Codes: G06F 3/06 Digital input from, or digital output to, record carriers , e.g. RAID, emulated record carriers or networked record carriers
• CPC Class Codes: G06F 3/0604 Improving or facilitating administration, e.g. storage management
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 2209/04 Masking or blinding
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A method begins by a dispersed storage (DS) processing module generating a certificate signing request (CSR) that includes a certificate and a certificate extension, wherein the certificate includes information regarding a requesting device and wherein the certificate extension includes information regarding an accessible dispersed storage network (DSN) address range for the requesting device. The method continues with the DS processing module outputting the CSR to a certificate authority of a DSN and receiving a signed certificate from the certificate authority, wherein the signed certificate includes a certification signature of the certificate authority authenticating the certificate and the certificate extension. The method continues with the DS processing module storing the signed certificate for use when generating a DSN access request, wherein the DSN access request is requesting access to dispersed storage error encoded data in the DSN at an address within the accessible DSN address range.

Claims

1. A method comprises:

generating a certificate signing request (CSR) that includes a certificate and a certificate extension, wherein the certificate includes information regarding a requesting device and wherein the certificate extension includes information regarding an accessible dispersed storage network (DSN) address range for the requesting device;

outputting the CSR to a certificate authority of a DSN;

receiving a signed certificate from the certificate authority, wherein the signed certificate includes a certification signature of the certificate authority authenticating the certificate and the certificate extension; and

storing the signed certificate for use when generating a DSN access request, wherein the DSN access request is requesting access to dispersed storage error encoded data in the DSN at an address within the accessible DSN address range.

2. The method of claim 1, wherein the generating the CSR further comprises:

receiving the certificate extension from the certificate authority or a DSN managing device;

or

retrieving the certificate extension from local memory; and

generating the certificate to include at least one of;

a version, a serial number, an algorithm identifier (ID), an issuer name, a time validity indicator, a subject ID, a public key algorithm, a public key, an issuer universal unique identifier (UUID), and a subject UUID.

3. The method of claim 1, wherein the certificate extension comprises:

a first private enterprise number (PEN);

a second PEN;

a first extension value; and

a second extension value, wherein the first PEN is associated with the first extension value that defines a starting address of the accessible DSN address range and wherein the second PEN is associated with the second extension value that defines an ending address of the accessible DSN address range.

4. The method of claim 1, wherein the certificate extension further comprises at least one of:

information regarding a unique identifier of the requesting device, wherein the certificate authority generated the unique identifier of the requesting device;

information regarding a unique identifier of the DSN, wherein the certificate authority generated the unique identifier of the DSN;

information regarding a device type of the requesting device;

information regarding account permissions of the requesting device; and

information regarding credential permissions of the requesting device.

5. The method of claim 4, wherein the certificate extension comprises:

a first private enterprise number (PEN);

a second PEN;

a third PEN;

a fourth PEN;

a fifth PEN;

a first extension value;

a second extension value;

a third extension value;

a fourth extension value; and

a fifth extension value, wherein;

the first PEN is associated with the first extension value that includes the unique identifier of the requesting device;

the second PEN is associated with the second extension value that includes the unique identifier of the DSN;

the third PEN is associated with the third extension value that includes the device type;

the fourth PEN is associated with the fourth extension value that includes the account permissions; and

the fifth PEN is associated with the fifth extension value that includes the credential permissions.

6. The method of claim 1 further comprises:

prior to storing the signed certificate, indicating that the signed certificate is valid when a device universal unique identifier (UUID) of the certificate extension compares favorably to a device UUID contained in the signed certificate.

7. A method comprises:

receiving, from a requesting device, a dispersed storage network (DSN) access request that includes a DSN address and a signed certificate, wherein the signed certificate includes a certificate and a certificate extension, wherein the certificate includes information regarding a requesting device, and wherein the certificate extension includes information regarding an accessible dispersed storage network (DSN) address range for the requesting device;

determining whether the DSN address is within the accessible DSN address range for the requesting device; and

when the DSN address is within the accessible DSN address range for the requesting device, processing the DSN access request.

8. The method of claim 7, wherein the receiving the DSN access request comprises:

validating the signed certificate by one or more of;

indicating that the signed certificate is valid when validation of a certificate signature of the signed certificate utilizing a public key of the signed certificate is favorable;

indicating that the signed certificate is valid when a certificate issuer identifier (ID) of the signed certificate compares favorably to a validated certificate issuer ID; and

indicating that the signed certificate is valid when a time of validity indicator of the signed certificate compares favorably to a current time.

9. The method of claim 7 further comprises:

determining whether the DSN access request is authorized by at least one of;

indicating that the DSN access request is authorized when a device identifier (ID) of the certificate extension compares favorably to a requesting entity ID of the DSN access request;

indicating that the DSN access request is authorized when a DSN ID of the certificate extension compares favorably to a retrieved DSN ID; and

indicating that the DSN access request is authorized when a device type of the certificate extension compares favorably to an allowable device type associated with the DSN access request.

10. A dispersed storage (DS) module comprises:

a first module, when operable within a computing device, causes the computing device to;

generate a certificate signing request (CSR) that includes a certificate and a certificate extension, wherein the certificate includes information regarding a requesting device and wherein the certificate extension includes information regarding an accessible dispersed storage network (DSN) address range for the requesting device;

a second module, when operable within the computing device, causes the computing device to;

output the CSR to a certificate authority of a DSN;

a third module, when operable within the computing device, causes the computing device to;

receive a signed certificate from the certificate authority, wherein the signed certificate includes a certification signature of the certificate authority authenticating the certificate and the certificate extension; and

a fourth module, when operable within the computing device, causes the computing device to;

store the signed certificate for use when generating a DSN access request, wherein the DSN access request is requesting access to dispersed storage error encoded data in the DSN at an address within the accessible DSN address range.

11. The DS module of claim 10, wherein the first module further functions to generate the CSR by:

receiving the certificate extension from the certificate authority or a DSN managing device;

or

retrieving the certificate extension from local memory; and

generating the certificate to include at least one of;

a version, a serial number, an algorithm identifier (ID), an issuer name, a time validity indicator, a subject ID, a public key algorithm, a public key, an issuer universal unique identifier (UUID), and a subject UUID.

12. The DS module of claim 10, wherein the certificate extension comprises:

a first private enterprise number (PEN);

a second PEN;

a first extension value; and

a second extension value, wherein the first PEN is associated with the first extension value that defines a starting address of the accessible DSN address range and wherein the second PEN is associated with the second extension value that defines an ending address of the accessible DSN address range.

13. The DS module of claim 10, wherein the certificate extension further comprises at least one of:

information regarding a unique identifier of the requesting device, wherein the certificate authority generated the unique identifier of the requesting device;

information regarding a unique identifier of the DSN, wherein the certificate authority generated the unique identifier of the DSN;

information regarding a device type of the requesting device;

information regarding account permissions of the requesting device; and

information regarding credential permissions of the requesting device.

14. The DS module of claim 13, wherein the certificate extension comprises:

a first private enterprise number (PEN);

a second PEN;

a third PEN;

a fourth PEN;

a fifth PEN;

a first extension value;

a second extension value;

a third extension value;

a fourth extension value; and

a fifth extension value, wherein;

the first PEN is associated with the first extension value that includes the unique identifier of the requesting device;

the second PEN is associated with the second extension value that includes the unique identifier of the DSN;

the third PEN is associated with the third extension value that includes the device type;

the fourth PEN is associated with the fourth extension value that includes the account permissions; and

the fifth PEN is associated with the fifth extension value that includes the credential permissions.

15. The DS module of claim 10, wherein the fourth module further functions to:

prior to storing the signed certificate, indicate that the signed certificate is valid when a device universal unique identifier (UUID) of the certificate extension compares favorably to a device UUID contained in the signed certificate.

16. A dispersed storage (DS) module comprises:

a first module, when operable within a computing device, causes the computing device to;

receive, from a requesting device, a dispersed storage network (DSN) access request that includes a DSN address and a signed certificate, wherein the signed certificate includes a certificate and a certificate extension, wherein the certificate includes information regarding a requesting device, and wherein the certificate extension includes information regarding an accessible dispersed storage network (DSN) address range for the requesting device;

a second module, when operable within the computing device, causes the computing device to;

determine whether the DSN address is within the accessible DSN address range for the requesting device; and

a third module, when operable within the computing device, causes the computing device to;

when the DSN address is within the accessible DSN address range for the requesting device, process the DSN access request.

17. The DS module of claim 16, wherein the first module functions to receive the DSN access request by:

validating the signed certificate by one or more of;

indicating that the signed certificate is valid when validation of a certificate signature of the signed certificate utilizing a public key of the signed certificate is favorable;

indicating that the signed certificate is valid when a certificate issuer identifier (ID) of the signed certificate compares favorably to a validated certificate issuer ID; and

indicating that the signed certificate is valid when a time of validity indicator of the signed certificate compares favorably to a current time.

18. The DS module of claim 16, wherein the first module further functions to:

determine whether the DSN access request is authorized by at least one of;

indicating that the DSN access request is authorized when a device identifier (ID) of the certificate extension compares favorably to a requesting entity ID of the DSN access request;

indicating that the DSN access request is authorized when a DSN ID of the certificate extension compares favorably to a retrieved DSN ID; and

indicating that the DSN access request is authorized when a device type of the certificate extension compares favorably to an allowable device type associated with the DSN access request.