Acquiring a trusted set of encoded data slices

• US 8,839,368 B2
• Filed: 10/09/2012
• Issued: 09/16/2014
• Est. Priority Date: 11/01/2011
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Grube, Gary W., Markison, Timothy W.
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US13/647,533
• Publication Number:
  US 20130111552A1
• Time in Patent Office: 707 Days
• Field of Search: 726/3
• US Class Current: 726/3
• CPC Class Codes: G06F 11/00 Error detection; Error correction; Monitoring error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00
• CPC Class Codes: G06F 11/10 Adding special bits or symbols to the coded information, e.g. parity check, casting out 9's or 11's
• CPC Class Codes: G06F 11/1012 using codes or arrangements adapted for a specific type of error G06F11/1048 takes precedence
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 11/1092 Rebuilding, e.g. when physically replacing a failing disk
• CPC Class Codes: G06F 2211/1028 Distributed, i.e. distributed RAID systems with parity
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/064 Management of blocks
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 1/0057 Block codes H04L1/0061, H04L1/0064 take precedence
• CPC Class Codes: H04L 2001/0092 Error control systems characterised by the topology of the transmission link
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic

Abstract

A method begins by a dispersed storage (DS) processing module receiving a decode threshold number of encoded data slices of a set of encoded data slices. The method continues with the DS processing module determining whether to evoke a trust verification function and when the trust verification function is to be evoked, selecting one or more encoded data slices of the set of encoded data slices for trust verification to produce one or more selected encoded data slices. The method continues with the DS processing module sending, to a trusted source, a request to receive the one or more selected encoded data slices and when the one or more selected encoded data slices are received from the trusted source, determining that a trusted set of encoded data slices is available based on the decode threshold number of encoded data slices and the received one or more selected encoded data slices.

Claims

1. A method comprises:

receiving, in response to a data segment access request, a decode threshold number of encoded data slices, wherein a data segment of data is encoded using a dispersed storage error coding function to produce a set of encoded data slices and wherein the decode threshold number of encoded data slices is a subset of the set of encoded data slices;

determining whether to evoke a trust verification function after receiving the decode threshold number of encoded data slices;

when the trust verification function is to be evoked, selecting one or more encoded data slices of the set of encoded data slices for trust verification to produce one or more selected encoded data slices;

sending, to a trusted source, a request to receive the one or more selected encoded data slices; and

when the one or more selected encoded data slices are received from the trusted source, determining that a trusted set of encoded data slices is available based on the decode threshold number of encoded data slices and the received one or more selected encoded data slices.

2. The method of claim 1 further comprises:

receiving the decode threshold number of encoded data slices via a private wireless communication network;

sending the request to the trusted source via a public wireless communication network or the private wireless communication network; and

receiving the one or more selected encoded data slices via the public wireless communication network.

3. The method of claim 1, wherein the determining whether to evoke the trust verification function comprises at least one of:

an automated process that is triggered upon receiving the decode threshold number of encoded data slices; and

determining that at least one of the decode threshold number of encoded data slices is of questionable trustworthiness.

4. The method of claim 3, wherein the determining that at least one of the decode threshold number of encoded data slices is of questionable trustworthiness comprises at least one of:

detecting an integrity verification failure of the at least one of the decode threshold number of encoded data slices;

detecting a time delay in receiving the at least one of the decode threshold number of encoded data slices;

decoding the decode threshold number of encoded data slices yields an error in reproducing the data segment;

detecting a communication path variance of the at least one of the decode threshold number of encoded data slices; and

detecting a time stamp variance of the at least one of the decode threshold number of encoded data slices.

5. The method of claim 1, wherein the selecting one or more encoded data slices comprises at least one of:

an automated process that selects the one or more encoded data slices after evoking the trust verification function; and

selecting the one or more encoded data slices based on questionable trustworthiness of at least one of the decode threshold number of encoded data slices.

6. The method of claim 1 further comprises:

receiving, in response to the request, a message from the trusted source indicating that the decode threshold number of encoded data slices is not to be trusted.

7. The method of claim 1, wherein the determining that the trusted set of encoded data slices is available comprises at least one of:

decoding different combinations of the decode threshold number of encoded data slices and the received one or more selected encoded data slices, wherein each different decoding combination reproduces the data segment; and

comparing a trusted data segment integrity value with a calculated data segment integrity value that is derived from decoding the decode threshold number of encoded data slices and the received one or more selected encoded data slices.

8. The method of claim 1 further comprises:

when the trusted set of encoded data slices is available, decoding the trusted set of encoded data slices to reproduce a trusted data segment.

9. A dispersed storage (DS) module comprises:

a first module, when operable within a computing device, causes the computing device to;

receive, in response to a data segment access request, a decode threshold number of encoded data slices, wherein a data segment of data is encoded using a dispersed storage error coding function to produce a set of encoded data slices and wherein the decode threshold number of encoded data slices is a subset of the set of encoded data slices;

a second module, when operable within the computing device, causes the computing device to;

determine whether to evoke a trust verification function after receiving the decode threshold number of encoded data slices; and

when the trust verification function is to be evoked, select one or more encoded data slices of the set of encoded data slices for trust verification to produce one or more selected encoded data slices; and

a third module, when operable within the computing device, causes the computing device to;

send, to a trusted source, a request to receive the one or more selected encoded data slices; and

when the one or more selected encoded data slices are received from the trusted source, determine that a trusted set of encoded data slices is available based on the decode threshold number of encoded data slices and the received one or more selected encoded data slices.

10. The DS module of claim 9 further comprises:

the first module further functions to receive the decode threshold number of encoded data slices via a private wireless communication network;

the third module further functions to;

send the request to the trusted source via a public wireless communication network or the private wireless communication network; and

receive the one or more selected encoded data slices via the public wireless communication network.

11. The DS module of claim 9, wherein the second module functions to determine whether to evoke the trust verification function by at least one of:

an automated process that is triggered upon receiving the decode threshold number of encoded data slices; and

determining that at least one of the decode threshold number of encoded data slices is of questionable trustworthiness.

12. The DS module of claim 11, wherein the second module functions to determine that at least one of the decode threshold number of encoded data slices is of questionable trustworthiness by at least one of:

detecting an integrity verification failure of the at least one of the decode threshold number of encoded data slices;

detecting a time delay in receiving the at least one of the decode threshold number of encoded data slices;

decoding the decode threshold number of encoded data slices yields an error in reproducing the data segment;

detecting a communication path variance of the at least one of the decode threshold number of encoded data slices; and

detecting a time stamp variance of the at least one of the decode threshold number of encoded data slices.

13. The DS module of claim 9, wherein the second module functions to select one or more encoded data slices by at least one of:

an automated process that selects the one or more encoded data slices after evoking the trust verification function; and

selecting the one or more encoded data slices based on questionable trustworthiness of at least one of the decode threshold number of encoded data slices.

14. The DS module of claim 9 further comprises:

the third module further functions to receive, in response to the request, a message from the trusted source indicating that the decode threshold number of encoded data slices is not to be trusted.

15. The DS module of claim 9, wherein the third module functions to determine that the trusted set of encoded data slices is available by at least one of:

decoding different combinations of the decode threshold number of encoded data slices and the received one or more selected encoded data slices, wherein each different decoding combination reproduces the data segment; and

comparing a trusted data segment integrity value with a calculated data segment integrity value that is derived from decoding the decode threshold number of encoded data slices and the received one or more selected encoded data slices.

16. The DS module of claim 9 further comprises:

when the trusted set of encoded data slices is available, the third module further functions to decode the trusted set of encoded data slices to reproduce a trusted data segment.