Dispersed storage network slice name verification

• US 9,047,218 B2
• Filed: 02/04/2011
• Issued: 06/02/2015
• Est. Priority Date: 04/26/2010
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Resch, Jason K., Quigley, John, Leggette, Wesley
• Primary Examiner(s): ABRAHAM, ESAW T
• Application Number:
  US13/021,510
• Publication Number:
  US 20110264989A1
• Time in Patent Office: 1,579 Days
• Field of Search: 714/758, 714/770, 714/781, 714/799
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0727 in a storage system, e.g. in a DASD or network based storage system drivers for digital recording or reproducing units G06F3/06; circuits for error detection or correction within digital recording or reproducing units G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097
• CPC Class Codes: G06F 11/076 by exceeding a count or rate limit, e.g. word- or bit count limit
• CPC Class Codes: G06F 11/0763 by bit configuration check, e.g. of formats or tags
• CPC Class Codes: G06F 11/1004 to protect a block of data words, e.g. CRC or checksum G06F11/1076 takes precedence; security arrangements for protecting computers or computer systems against unauthorized activity G06F21/00
• CPC Class Codes: G06F 11/1008 in individual solid state devices G06F11/1004 takes precedence
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 11/1092 Rebuilding, e.g. when physically replacing a failing disk
• CPC Class Codes: G06F 11/1464 for networked environments
• CPC Class Codes: G06F 11/2094 Redundant storage or storage space G06F11/2056 takes precedence
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/70 Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
• CPC Class Codes: G06F 2211/1028 Distributed, i.e. distributed RAID systems with parity
• CPC Class Codes: H04L 2209/30 Compression, e.g. Merkle-Damgard construction
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method begins by a processing module dispersed storage error encoding data to produce a plurality of sets of encoded data slices in accordance with dispersed storage error coding parameters. The method continues with the processing module determining a plurality of sets of slice names corresponding to the plurality of sets of encoded data slices. The method continues with the processing module determining integrity information for the plurality of sets of slice names and sending the plurality of sets of encoded data slices, the plurality of sets of slice names, and the integrity information to a dispersed storage network memory for storage therein.

Claims

1. A method comprises:

dispersed storage error encoding data to produce a plurality of sets of encoded data slices in accordance with dispersed storage error coding parameters;

determining a plurality of sets of slice names corresponding to the plurality of sets of encoded data slices;

determining integrity information for the plurality of sets of slice names; and

sending the plurality of sets of encoded data slices, the plurality of sets of slice names, and the integrity information to a dispersed storage network (DSN) memory for storage therein.

2. The method of claim 1, wherein the determining the integrity information further comprises:

for a first integrity method;

generating individual integrity information for at least some of the slice names of at least some of the plurality of sets of slice names; and

generating the integrity information based on the individual integrity information;

for a second integrity method;

generating set integrity information for each set of slice names of at least some of the plurality of sets of slice names; and

generating the integrity information based on the set integrity information;

for a third integrity method;

generating pillar integrity information for each pillar set of slice names of at least some of the plurality of sets of slice names; and

generating the integrity information based on the pillar integrity information;

for a fourth integrity method;

generating data file integrity information for at least some of the plurality of sets of slice names; and

generating the integrity information based on the data file integrity information; and

for a fifth integrity method;

generating combined integrity information for at least some of the encoded data slices of the plurality of sets of encoded data slices and for at least some of the slices names of at least some of the plurality of sets of slice names; and

generating the integrity information based on the combined integrity information.

3. The method of claim 2 further comprises:

performing the first integrity method, the fourth integrity method, and at least one of the second and third integrity methods to generate the integrity information.

4. The method of claim 2 further comprises:

for the first integrity method, performing one or more of a hash function, cyclic redundancy check, encryption function, and parity check on a slice name of the at least some of the slice names of at least some of the plurality of sets of slice names to generate the individual integrity information;

for the second integrity method, performing one or more of the hash function, the cyclic redundancy check, the encryption function, and the parity check on the set of slice names of at least some of the plurality of sets of slice names to generate the set integrity information;

for the third integrity method, performing one or more of the hash function, the cyclic redundancy check, the encryption function, and the parity check on the pillar set of slice names of at least some of the plurality of sets of slice names to generate the pillar integrity information;

for the fourth integrity method, performing one or more of the hash function, the cyclic redundancy check, the encryption function, and the parity check on the at least some of the plurality of sets of slice names to generate the data file integrity information; and

for the fifth integrity method, performing one or more of a hash function, cyclic redundancy check, encryption function, and parity check on an encoded data slice of the at least some of the encoded data slices of the plurality of set of encoded data slices and an associated slice name of the at least some of the slice names of the plurality of sets of slice names to generate the combined integrity information.

5. The method of claim 4 further comprises:

the hash function including a hashed message authentication code (HMAC) that uses a shared key; and

the encryption function including an encryption algorithm that utilizes a private key, which is paired to a public key.

6. A computer comprises:

an interface;

a memory; and

a processing module operable to;

dispersed storage error encode data to produce a plurality of sets of encoded data slices in accordance with dispersed storage error coding parameters;

determine a plurality of sets of slice names corresponding to the plurality of sets of encoded data slices;

determine integrity information for the plurality of sets of slice names; and

send, via the interface, the plurality of sets of encoded data slices, the plurality of sets of slice names, and the integrity information to a dispersed storage network (DSN) memory for storage therein.

7. The computer of claim 6, wherein the processing module further functions to determine the integrity information by:

for a first integrity method;

generating individual integrity information for at least some of the slices names of at least some of the plurality of sets of slices names; and

generating the integrity information based on the individual integrity information;

for a second integrity method;

generating set integrity information for each set of slice names of at least some of the plurality of sets of slice names; and

generating the integrity information based on the set integrity information;

for a third integrity method;

generating pillar integrity information for each pillar set of slice names of at least some of the plurality of sets of slice names; and

generating the integrity information based on the pillar integrity information;

for a fourth integrity method;

generating data file integrity information for at least some of the plurality of sets of slice names; and

generating the integrity information based on the data file integrity information; and

for a fifth integrity method;

generating combined integrity information for at least some of the encoded data slices of the plurality of sets of encoded data slices and for at least some of the slices names of at least some of the plurality of sets of slice names; and

generating the integrity information based on the combined integrity information.

8. The computer of claim 7, wherein the processing module further functions to:

perform the first integrity method, the fourth integrity method, and at least one of the second and third integrity methods to generate the integrity information.

9. The computer of claim 7, wherein the processing module further functions to:

for the first integrity method, perform one or more of a hash function, cyclic redundancy check, encryption function, and parity check on a slice name of the at least some of the slices names of at least some of the plurality of sets of slices names to generate the individual integrity information;

for the second integrity method, perform one or more of the hash function, the cyclic redundancy check, the encryption function, and the parity check on the set of slice names of at least some of the plurality of sets of slice names to generate the set integrity information;

for the third integrity method, perform one or more of the hash function, the cyclic redundancy check, the encryption function, and the parity check on the pillar set of slice names of at least some of the plurality of sets of slice names to generate the pillar integrity information;

for the fourth integrity method, perform one or more of the hash function, the cyclic redundancy check, the encryption function, and the parity check on the at least some of the plurality of sets of slice names to generate the data file integrity information; and

for the fifth integrity method, performing one or more of a hash function, cyclic redundancy check, encryption function, and parity check on an encoded data slice of the at least some of the encoded data slices of the plurality of sets of encoded data slices and an associated slice name of the at least some of the slice names of the plurality of sets of slice names to generate the combined integrity information.

10. The computer of claim 9 further comprises:

the hash function including a hashed message authentication code (HMAC) that uses a shared key; and

the encryption function including an encryption algorithm that utilizes a private key, which is paired to a public key.