Authentication of devices of a dispersed storage network

• US 9,077,734 B2
• Filed: 07/12/2011
• Issued: 07/07/2015
• Est. Priority Date: 08/02/2010
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Baptist, Andrew, Leggette, Wesley, Resch, Jason K.
• Primary Examiner(s): Hailu, Teshome
• Assistant Examiner(s): LE, THANH H
• Application Number:
  US13/180,673
• Publication Number:
  US 20120030740A1
• Time in Patent Office: 1,456 Days
• Field of Search: 713/169
• US Class Current: 1/1
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A method begins by a first processing module generating a dispersed storage network (DSN) authentication request frame that includes authenticating data and an authenticating code, wherein the authenticating code references a valid authenticating process. The method continues with the first processing module transmitting the DSN authentication request frame to a second processing module. The method continues with the second processing module determining whether the second processing module includes the valid authentication process referenced by the authentication code. When the second processing module includes the valid authentication process, processing, by the second processing module, the authenticating data in accordance with the valid authentication process to produce processed authenticating data. The method continues with the second processing module generating a DSN authentication response frame that includes the processed authenticating data and transmitting the DSN authentication response frame to the first processing module.

Claims

1. A method for authenticating devices within a dispersed storage network (DSN), the method comprises:

generating, by a first device of the devices, a DSN authentication request frame that includes authenticating data and an authenticating code, wherein the authenticating code references a valid authenticating process of a plurality of valid authenticating processes;

transmitting, by the first device, the DSN authentication request frame to a second device of the devices;

determining, by the second device, whether the second device includes the valid authentication process referenced by the authentication code;

when the second device includes the valid authentication process, processing, by the second device, the authenticating data in accordance with the valid authentication process to produce processed authenticating data;

generating, by the second device, a DSN authentication response frame that includes the processed authenticating data; and

transmitting, by the second device, the DSN authentication response frame to the first device.

2. The method of claim 1 further comprises:

comparing, by the first device, the processed authenticating data with anticipated processed authenticating data;

when the processed authenticating data compares favorably with the anticipated processed authenticating data, indicating, by the first device, authentication of the second device; and

when the processed authenticating data compares unfavorably with the anticipated processed authenticating data, indicating, by the first device, failure of authentication of the second device.

3. The method of claim 1 further comprises:

when the second device does not include the valid authentication process, transmitting, by the second device, a DSN response message indicating that the second device does not include the valid authentication process;

in response to the DSN response message, selecting, by the first device, a second valid authentication process of the plurality of valid authenticating processes;

generating, by the first device, a second DSN authentication request frame that includes the authenticating data and a second authenticating code, wherein the second authenticating code references the second valid authenticating process; and

transmitting, by the first device, the second DSN authentication request frame to the second device.

4. The method of claim 3, wherein the selecting the second valid authentication process comprises at least one of:

transmitting, by the first device, a request message to a DSN manager requesting the second valid authentication process;

receiving, by the first device, a response message that includes at least one of the second valid authentication process and the second authenticating code;

validating, by the first device, a received list of authentication mechanisms included in the DSN response message to produce valid mechanisms; and

selecting, by the first device, a valid mechanism of the valid mechanisms as the second valid authentication process.

5. The method of claim 1 further comprises:

when the second device does not include the valid authentication process, transmitting, by the second device, a request for the valid authentication process to a DSN manager; and

receiving, by the second device, a response message that includes the valid authentication process.

6. The method of claim 1 further comprises:

when the second device does not include the valid authentication process, transmitting, by the second device, a DSN response message indicating that the second device does not include the valid authentication process; and

in response to the DSN response message, transmitting, by the first device, a subsequent response message that includes the valid authentication process.

7. A method for authenticating a device within a dispersed storage network (DSN), the method comprises:

generating a DSN authentication request frame that includes authenticating data and an authenticating code, wherein the authenticating code references a valid authenticating process of a plurality of valid authenticating processes;

transmitting the DSN authentication request frame to the device;

receiving a DSN authentication response frame that includes processed authenticating data, wherein the device processed the authenticating data in accordance with the valid authentication process to produce the processed authenticating data;

comparing the processed authenticating data with anticipated processed authenticating data;

when the processed authenticating data compares favorably with the anticipated processed authenticating data, indicating authentication of the device; and

when the processed authenticating data compares unfavorably with the anticipated processed authenticating data, indicating failure of authentication of the device.

8. The method of claim 7 further comprises:

receiving, from the device, a DSN response message indicating that the device does not include the valid authentication process;

in response to the DSN response message, selecting a second valid authentication process of the plurality of valid authenticating processes;

generating a second DSN authentication request frame that includes the authenticating data and a second authenticating code, wherein the second authenticating code references the second valid authenticating process; and

transmitting the second DSN authentication request frame to the device.

9. The method of claim 8, wherein the selecting the second valid authentication process comprises:

transmitting a request message to a DSN manager requesting the second valid authentication process; and

receiving a response message that includes at least one of the second valid authentication process and the second authenticating code.

10. A method for a device to be authenticated within a dispersed storage network (DSN), the method comprises:

receiving a DSN authentication request frame that includes authenticating data and an authenticating code, wherein the authenticating code references a valid authenticating process of a plurality of valid authenticating processes;

determining whether the device includes the valid authentication process referenced by the authentication code;

when the device includes the valid authentication process, processing the authenticating data in accordance with the valid authentication process to produce processed authenticating data;

generating a DSN authentication response frame that includes the processed authenticating data; and

transmitting the DSN authentication response frame.

11. The method of claim 10 further comprises:

when the device does not include the valid authentication process, transmitting a DSN response message indicating that the device does not include the valid authentication process; and

receiving a second DSN authentication request frame that includes the authenticating data and a second authenticating code, wherein the second authenticating code references a second valid authenticating process of the plurality of valid authenticating processes.

12. The method of claim 10 further comprises:

when the device does not include the valid authentication process, transmitting a request for the valid authentication process to a DSN manager; and

receiving a response message that includes the valid authentication process.

13. The method of claim 10 further comprises:

when the device does not include the valid authentication process, transmitting a DSN response message indicating that the device does not include the valid authentication process; and

receiving a subsequent response message that includes the valid authentication process.

14. A dispersed storage network (DSN) comprises:

a first device; and

a second device, wherein;

the first device generates a DSN authentication request frame that includes authenticating data and an authenticating code, wherein the authenticating code references a valid authenticating process of a plurality of valid authenticating processes;

the first device transmits the DSN authentication request frame to the second device;

the second device determines whether the second device includes the valid authentication process referenced by the authentication code;

when the second device includes the valid authentication process, the second device processes the authenticating data in accordance with the valid authentication process to produce processed authenticating data;

the second device generates a DSN authentication response frame that includes the processed authenticating data; and

the second device transmits the DSN authentication response frame to the first device.

15. The DSN of claim 14, wherein the first device further functions to:

compare the processed authenticating data with anticipated processed authenticating data;

when the processed authenticating data compares favorably with the anticipated processed authenticating data, indicate authentication of the second device; and

when the processed authenticating data compares unfavorably with the anticipated processed authenticating data, indicate failure of authentication of the second device.

16. The DSN of claim 14, wherein the first device and second device further function to:

when the second device does not include the valid authentication process, transmit, by the second device, a DSN response message indicating that the second device does not include the valid authentication process;

in response to the DSN response message, select, by the first device, a second valid authentication process of the plurality of valid authenticating processes;

generate, by the first device, a second DSN authentication request frame that includes the authenticating data and a second authenticating code, wherein the second authenticating code references the second valid authenticating process; and

transmit, by the first device, the second DSN authentication request frame to the second device.

17. The DSN of claim 16, wherein the first device functions to select the second valid authentication process by at least one of:

transmitting a request message to a DSN manager requesting the second valid authentication process;

receiving a response message that includes at least one of the second valid authentication process and the second authenticating code; and

validating a received list of authentication mechanisms included in the DSN response message to produce valid mechanisms; and

selecting a valid mechanism of the valid mechanisms as the second valid authentication process.

18. The DSN of claim 14, wherein the second device further functions to:

when the second device does not include the valid authentication process, transmit a request for the valid authentication process to a DSN manager; and

receive a response message that includes the valid authentication process.

19. The DSN of claim 14, wherein the first device and second device further function to:

when the second device does not include the valid authentication process, transmit, by the second device, a DSN response message indicating that the second device does not include the valid authentication process; and

in response to the DSN response message, transmit, by the first device, a subsequent response message that includes the valid authentication process.

20. A computer comprises:

an interface;

a memory; and

a processing module operable to;

generate a DSN authentication request frame that includes authenticating data and an authenticating code, wherein the authenticating code references a valid authenticating process of a plurality of valid authenticating processes;

transmit, via the interface, the DSN authentication request frame to a device within a dispersed storage network (DSN);

receive, via the interface, a DSN authentication response frame that includes processed authenticating data, wherein the device processed the authenticating data in accordance with the valid authentication process to produce the processed authenticating data;

compare the processed authenticating data with anticipated processed authenticating data;

when the processed authenticating data compares favorably with the anticipated processed authenticating data, indicate authentication of the device; and

when the processed authenticating data compares unfavorably with the anticipated processed authenticating data, indicate failure of authentication of the device.

21. The computer of claim 20, wherein the processing module further functions to:

receive, from the device, via the interface, a DSN response message indicating that the device does not include the valid authentication process;

in response to the DSN response message, select a second valid authentication process of the plurality of valid authenticating processes;

generate a second DSN authentication request frame that includes the authenticating data and a second authenticating code, wherein the second authenticating code references the second valid authenticating process; and

transmit, via the interface, the second DSN authentication request frame to the device.

22. The computer of claim 21, wherein the processing module functions to select the second valid authentication process by:

transmitting, via the interface, a request message to a DSN manager requesting the second valid authentication process; and

receiving, via the interface, a response message that includes at least one of the second valid authentication process and the second authenticating code.

23. A computer comprises:

an interface;

a memory; and

a processing module operable to;

receive, via the interface, a DSN authentication request frame that includes authenticating data and an authenticating code, wherein the authenticating code references a valid authenticating process of a plurality of valid authenticating processes;

determine whether the computer includes, in the memory, the valid authentication process referenced by the authentication code;

when the computer includes the valid authentication process, process the authenticating data in accordance with the valid authentication process to produce processed authenticating data;

generate a DSN authentication response frame that includes the processed authenticating data; and

transmit, via the interface, the DSN authentication response frame.

24. The computer of claim 23, wherein the processing module further functions to:

when the computer does not include the valid authentication process, transmit, via the interface, a DSN response message indicating that the computer does not include the valid authentication process; and

receive, via the interface, a second DSN authentication request frame that includes the authenticating data and a second authenticating code, wherein the second authenticating code references a second valid authenticating process of the plurality of valid authenticating processes.

25. The computer of claim 23, wherein the processing module further functions to:

when the computer does not include the valid authentication process, transmit, via the interface, a request for the valid authentication process to a DSN manager; and

receive, via the interface, a response message that includes the valid authentication process.

26. The computer of claim 23, wherein the processing module further functions to:

when the computer does not include the valid authentication process, transmit, via the interface, a DSN response message indicating that the computer does not include the valid authentication process; and

receive, via the interface, a subsequent response message that includes the valid authentication process.