Authenticating use of a dispersed storage network

• US 8,813,204 B2
• Filed: 06/14/2013
• Issued: 08/19/2014
• Est. Priority Date: 08/27/2009
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Leggette, Wesley
• Primary Examiner(s): Pwu, Jeffrey
• Assistant Examiner(s): Anderson, Michael D
• Application Number:
  US13/917,922
• Publication Number:
  US 20130283394A1
• Time in Patent Office: 431 Days
• Field of Search: 726/27
• US Class Current: 726/7
• CPC Class Codes: G06F 11/1004 to protect a block of data words, e.g. CRC or checksum G06F11/1076 takes precedence; security arrangements for protecting computers or computer systems against unauthorized activity G06F21/00
• CPC Class Codes: G06F 11/1024 Identification of the type of error
• CPC Class Codes: G06F 11/1092 Rebuilding, e.g. when physically replacing a failing disk
• CPC Class Codes: G06F 12/1483 using an access-table, e.g. matrix or list
• CPC Class Codes: G06F 13/00 Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units interface circuits for specific input/output devices G06F3/00 ; multiprogram control therefor G06F9/46; multiprocessor systems G06F15/16
• CPC Class Codes: G06F 15/16 Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs coordinating program control therefor G06F9/52; in regulating and control system G05B
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

A method begins with a managing unit authenticating an access request regarding a set of encoded data slices, which represents an encoded data segment. The method continues, when the access request is authenticated, by generating storage unit access requests based on the access request regarding the set of encoded data slices. The method continues with the managing unit authenticating the storage unit access requests. When the storage unit access requests are authenticated, the method continues with the storage units executing the storage unit access requests to fulfill the access request regarding the set of encoded data slices.

Claims

1. A method for a multi-phase authentication process in a dispersed storage network (DSN), where a data segment of data is encoded in accordance with a dispersed storage error encoding function to produce a set of encoded data slices and wherein the set of encoded data slices is stored in storage units of the DSN, the method comprises:

authenticating, by a managing unit of the DSN, an access request regarding the set of encoded data slices;

when the access request is authenticated, generating, based on the access request regarding the set of encoded data slices, storage unit access requests to access the storage units;

authenticating, by the managing unit, the storage unit access requests; and

when the storage unit access requests are authenticated, executing, by the storage units, the storage unit access requests to fulfill the access request regarding the set of encoded data slices.

2. The method of claim 1 further comprises:

receiving, by a distributed storage (DS) module, a dispersed storage network (DSN) access request from a requesting device, wherein the DSN access request identifies the data segment;

generating, by the DS module, an authentication request regarding the DSN access request, wherein the authentication request includes a signed certificate of the DS module and identity of the requesting device; and

sending, by the DS module, the authentication request to the managing unit.

3. The method of claim 2, wherein the authenticating the access request comprises at least one of:

verifying the signed certificate of the DS module;

verifying the identity of the requestor device; and

sending, by the managing unit, a favorable authentication response to the DS module when the at least one of the signed certificate of the DS module and the identity of the requestor have been verified.

4. The method of claim 1, wherein the generating the storage unit access requests comprises:

receiving a favorable authentication response as an indication that the access request is authenticated;

after receiving the favorable authentication response, accessing, by a distributed storage (DS) module, a permissions list to verify that a requesting device has permission to request the access request;

when the requestor has permission, generating, by the DS module, the storage unit access requests; and

sending, by the DS module, the storage unit access requests to the storage units.

5. The method of claim 4 further comprises:

receiving, by one of the storage units, one of the storage unit access requests that includes a signed certificate of the DS module, identity of the requesting device, and one or more DSN addresses;

sending, by the one of the storage units, a second authentication request regarding the one of the storage unit access requests to the managing unit, wherein the second authentication request includes a signed certificate of the one of the storage units and the identity of the requesting device; and

sending, by the managing unit as part of the authenticating the storage unit access requests, a second favorable authentication response to the one of the storage units when the signed certificate of the one of the storage units and the identity of the requesting device are validated.

6. The method of claim 1, wherein the access request comprises one of:

a read access request;

a write access request;

a delete access request; and

an edit access request.

7. A distributed storage network (DSN) comprises:

a managing unit;

a distributed storage (DS) processing module; and

storage units, wherein;

the managing unit is operable to authenticate an access request regarding a set of encoded data slices, wherein a data segment of data is encoded in accordance with a dispersed storage error encoding function to produce the set of encoded data slices and wherein the set of encoded data slices is stored in the storage units;

the DS processing module is operable, when the access request is authenticated, to generate storage unit access requests based on the access request regarding the set of encoded data slices;

the managing unit is further operable to authenticate the storage unit access requests; and

the storage units are operable, when the storage unit access requests are authenticated, to execute the storage unit access requests to fulfill the access request regarding the set of encoded data slices.

8. The DSN of claim 7 further comprises:

the DS processing module further operable to receive a dispersed storage network (DSN) access request from a requesting device, wherein the DSN access request identifies the data segment;

the DS processing module further operable to generate an authentication request regarding the DSN access request, wherein the authentication request includes a signed certificate of the DS processing module and identity of the requesting device; and

the DS processing module further operable to send the authentication request to the managing unit.

9. The DSN of claim 8, wherein the managing unit is further operable to authenticate the access request by:

verifying at least one of the signed certificate of the DS processing module and the identity of the requestor device; and

sending a favorable authentication response to the DS processing module when the at least one of the signed certificate of the DS module and the identity of the requestor have been verified.

10. The DSN of claim 7, wherein the DS processing module is further operable to generate the storage unit access requests by:

receiving a favorable authentication response as an indication that the access request is authenticated;

after receiving the favorable authentication response, accessing a permissions list to verify that a requesting device has permission to request the access request;

when the requestor has permission, generating the storage unit access requests; and

sending the storage unit access requests to the storage units.

11. The DSN of claim 10 further comprises:

receiving, by one of the storage units, one of the storage unit access requests that includes a signed certificate of the DS module, identity of the requesting device, and one or more DSN addresses;

sending, by the one of the storage units, a second authentication request regarding the one of the storage unit access requests to the managing unit, wherein the second authentication request includes a signed certificate of the one of the storage units and the identity of the requesting device; and

sending, by the managing unit as part of the authenticating the storage unit access requests, a second favorable authentication response to the one of the storage units when the signed certificate of the one of the storage units and the identity of the requesting device are validated.

12. The DSN of claim 7, wherein the access request comprises one of:

a read access request;

a write access request;

a delete access request; and

an edit access request.