Time based dispersed storage access

• US 8,990,585 B2
• Filed: 09/20/2010
• Issued: 03/24/2015
• Est. Priority Date: 12/29/2009
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Grube, Gary W., Markison, Timothy W.
• Primary Examiner(s): HERZOG, MADHURI R
• Application Number:
  US12/886,368
• Publication Number:
  US 20110161679A1
• Time in Patent Office: 1,646 Days
• Field of Search: 726 1- 4, 726/21, 726 26- 30, 713164-167, 713189-194, 709201-203, 709217-229, 707687-699
• US Class Current: 713/193
• CPC Class Codes: G06F 11/00 Error detection; Error correction; Monitoring error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00
• CPC Class Codes: G06F 11/08 Error detection or correction by redundancy in data representation, e.g. by using checking codes
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 16/182 Distributed file systems
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2211/1028 Distributed, i.e. distributed RAID systems with parity
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 2012/6467 Information loss recovery, e.g. error correction, prediction
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A method begins with a processing module receiving a data retrieval request and obtaining a real-time indicator corresponding to when the data retrieval request was received. The method continues with the processing module determining a time-based data access policy based on the data retrieval request and the real-time indicator and accessing a plurality of dispersed storage (DS) units in accordance with the time-based data access policy to retrieve encoded data slices. The method continues with the processing module decoding the threshold number of encoded data slices in accordance with an error coding dispersal storage function when a threshold number of the encoded data slices have been retrieved.

Claims

1. A method comprises:

receiving a data retrieval request to retrieve data, wherein the data is segmented into a plurality of data segments and respective data segments are encoded into a plurality of encoded data slices and stored in different dispersed storage (DS) units of a plurality of DS units of a dispersed storage network, in which respective numbered slices of the plurality of data segments are stored in a same DS unit of the plurality of DS units, and wherein only a threshold number of encoded data slices for a particular data segment are needed to recover the particular data segment;

determining based on an access policy which of the plurality of DS units storing the encoded data slices of the data segments are available for access to retrieve the encoded data slices for day and time corresponding to the data retrieval request;

determining if a requestor or a requesting device requesting the data retrieval has authorized access to the plurality of DS units;

accessing available DS units to retrieve the encoded data slices from the available DS units based on the access policy, provided the requestor or requesting device requesting the data retrieval has the authorized access; and

retrieving a threshold number of encoded data slices from the available DS units for each of the data segments to recover the data.

2. The method of claim 1, wherein the accessing the available DS units comprises:

identifying a first set of DS units of the plurality of DS units that are accessible during a first time interval in accordance with the access policy; and

identifying a second set of DS units of the plurality of DS units that are accessible during a second time interval in accordance with the access policy, wherein a number of DS units in each of the first and second sets of DS units is less than the threshold number of encoded data slices.

3. The method of claim 1 further comprises:

when the threshold number of encoded data slices for the respective data segments are not accessible for retrieval, generating a status message in accordance with the access policy.

4. The method of claim 1, wherein the determining based on the access policy is based on one or more of:

a previous time-based data access policy;

a policy schedule;

a data identifier;

a real-time indicator;

a requester identifier;

a data type;

a priority indicator;

a security indicator; and

a dispersed storage network (DSN) status indicator.

5. The method of claim 1, wherein the determining based on the access policy further comprises:

adjusting the access policy based on priority of the requesting device issuing the data retrieval request.

6. The method of claim 1, wherein the determining based on the access policy comprises:

extracting the access policy from the data retrieval request when priority of the requesting device issuing the data retrieval request is at a first priority level.

7. A method comprises:

receiving a data write request to store data from a requesting device;

segmenting the data into a plurality of data segments;

encoding respective data segments in accordance with an error coding dispersal storage function to generate a plurality of encoded data slices for storage in different dispersed storage (DS) units of a plurality of DS units of a dispersed storage network, in which respective numbered slices of the plurality of data segments are to be stored in a same DS unit of the plurality of DS units, and wherein only a threshold number of encoded data slices for a particular data segment are needed to recover the particular data segment;

identifying based on an access policy which of the plurality of DS units for storing the encoded data slices of the data segments are available for access to store the encoded data slices for day and time corresponding to storing the encoded data slices

outputting the encoded data slices to the available DS units in accordance with the access policy.

8. The method of claim 7 further comprises:

identifying the available DS units based on a privilege set for the requesting device.

9. The method of claim 7, wherein the identifying the available DS units based on the access policy comprises:

obtaining a real-time indicator corresponding to when the data write request was received; and

using the access policy based on the real-time indicator.

10. The method of claim 7, wherein the identifying the available DS units comprises:

identifying a priority level of the requesting device.

11. A computer comprises:

an interface; and

a processing module operable to;

receive, via the interface, a data retrieval request to retrieve data, wherein the data is segmented into a plurality of data segments and respective data segments are encoded into a plurality of encoded data slices and stored in different dispersed storage (DS) units of a plurality of DS units of a dispersed storage network, in which respective numbered slices of the plurality of data segments are stored in a same DS unit of the plurality of DS units, and wherein only a threshold number of encoded data slices for a particular data segment are needed to recover the particular data segment;

determine based on an access policy which of the plurality of DS units storing the encoded data slices of the data segments are available for access to retrieve the encoded data slices for day and time corresponding to the data retrieval request;

determine if a requestor or a requesting device requesting the data retrieval has authorized access to the plurality of DS units;

access, via the interface, available DS units to retrieve the encoded data slices from the available DS units based on the access policy, provided the requestor or requesting device requesting the data retrieval has the authorized access; and

decode a threshold number of encoded data slices from the available DS units for each of the data segments to recover the data.

12. The computer of claim 11, wherein the processing module further functions to access the available DS units by:

identifying a first set of DS units of the plurality of DS units that are accessible during a first time interval in accordance with the access policy; and

identifying a second set of DS units of the plurality of DS units that are accessible during a second time interval in accordance with the access policy, wherein a number of DS units in each of the first and second sets of DS units is less than the threshold number of encoded data slices.

13. The computer of claim 11, wherein the processing module further functions to:

generate a status message in accordance with the access policy when the threshold number of encoded data slices for the respective data segments are not accessible for retrieval.

14. The computer of claim 11, wherein the processing module further functions to determine based on the access policy, which is based on one or more of:

a previous time-based data access policy;

a policy schedule;

a data identifier;

a real-time indicator;

a requester identifier;

a data type;

a priority indicator;

a security indicator; and

a dispersed storage network (DSN) status indicator.

15. The computer of claim 11, wherein the processing module further functions to determine based on the access policy by:

adjusting the access policy based on priority of the requesting device issuing the data retrieval request.

16. The computer of claim 11, wherein the processing module further functions to determine based on the access policy by:

extracting the access policy from the data retrieval request when priority of the requesting device issuing the data retrieval request is at a first priority level.

17. A computer comprises:

an interface; and

a processing module operable to;

receive, via the interface, a data write request to store data from a requesting device

segment the data into a plurality of data segments;

encode respective data segments in accordance with an error coding dispersal storage function to generate a plurality of encoded data slices for storage in different dispersed storage (DS) units of a plurality of DS units of a dispersed storage network, in which respective numbered slices of the plurality of data segments are to be stored in a same DS unit of the plurality of DS units, and wherein only a threshold number of encoded data slices for a particular data segment are needed to recover the particular data segment;

identify based on an access policy which of the plurality of DS units for storing the encoded data slices of the data segments are available for access to store the encoded data slices for day and time corresponding to storing the encoded data slices

output, via the interface, the encoded data slices to the available DS units in accordance with the access policy.

18. The computer of claim 17, wherein the processing module further functions to:

identify the DS units based on a privilege set for the requesting device.

19. The computer of claim 17, wherein the processing module further functions to identify the available DS units based on the access policy by:

obtaining a real-time indicator corresponding to when the data write request was received; and

using the access policy based on the real-time indicator.

20. The computer of claim 17, wherein the processing module further functions to identify the available DS units by:

identifying a priority level of the requesting device.