Virtualized data storage vaults on a dispersed data storage network

• US 9,092,439 B2
• Filed: 05/12/2011
• Issued: 07/28/2015
• Est. Priority Date: 10/09/2007
• Status: Expired due to Fees

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Gladwin, S. Christopher, Dhuse, Greg, Thornton, Vance, Motwani, Manish, Volvovski, Ilya, Leggette, Wesley, Bellanca, Jamie, Toledano, Sarah, Foster, Lynn, Mark, Zachary
• Primary Examiner(s): Corrielus, Jean M
• Application Number:
  US13/106,577
• Publication Number:
  US 20110213940A1
• Time in Patent Office: 1,538 Days
• Field of Search: 707/705, 707/783, 707/784, 707/785, 707/792, 707/829, 707/741, 711/154, 711/156, 711/170, 711/162, 709/226, 709/223, 726/26, 713/165
• US Class Current: 1/1
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 11/1092 Rebuilding, e.g. when physically replacing a failing disk
• CPC Class Codes: G06F 16/10 File systems; File servers
• CPC Class Codes: G06F 16/182 Distributed file systems
• CPC Class Codes: G06F 16/2272 Management thereof
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: Y10S 707/959 Network

Abstract

A method begins with a slice server receiving a request to access a virtual digital data storage vault. The method continues by determining whether the virtual digital data storage vault is a first virtual digital data storage vault or a second virtual digital data storage vault. The slice server supports a portion of each of the first and the second virtual digital data storage vaults. When the virtual digital data storage vault is the first or the second virtual digital data storage vault, the method continues by determining whether the request is valid. When the request is valid, the method continues by executing the request to generate a response.

Claims

1. A method comprises:

receiving, by a computer, a plurality of requests from a plurality of user devices;

for a first request of the plurality of requests;

determining, by the computer, a first vault structure and a first user account;

identifying, by the computer, a first set of storage servers based on the first vault structure;

sending, by the computer, the first request to the first set of storage servers;

validating, by at least a first minimum reconstruction number of storage servers of the first set of storage servers, the first request to produce, when valid, a first set of valid response slices;

receiving, by the computer, the first set of valid response slices from the at least the first minimum reconstruction number of storage servers;

decoding, by the computer using a first information dispersal algorithm, the first set of valid response slices to reconstruct a first response; and

for a second request of the plurality of requests;

determining, by the computer, a second vault structure and a second user account;

identifying, by the computer, a second set of storage servers based on the second vault structure;

sending, by the computer, the second request to the second set of storage servers;

validating, by at least a second minimum reconstruction number of storage servers of the second set of storage servers, the second request to produce, when valid, a second set of valid response slices;

receiving, by the computer, the second set of valid response slices from the at least the second minimum reconstruction number of storage servers; and

decoding, by the computer using a second information dispersal algorithm, the second set of valid response slices to reconstruct a second response.

2. The method of claim 1 further comprises:

for a third request of the plurality of requests;

determining, by the computer, the first vault structure and a third user account;

identifying, by the computer, the first set of storage servers based on the first vault structure;

sending, by the computer, the third request to the first set of storage servers;

validating, by at least the first minimum reconstruction number of storage servers of the first set of storage servers, the third request to produce, when valid, a third set of valid response slices;

receiving, by the computer, the third set of valid response slices from the at least the first minimum reconstruction number of storage servers; and

decoding, by the computer using the first information dispersal algorithm, the third set of valid response slices to reconstruct a third response.

3. The method of claim 1, wherein the validating, by the at least the first minimum reconstruction number of storage servers of the first set of storage servers, the first request comprises:

validating a user account identified based on the first user account; and

when the first user account is valid, validating the request based on permissions associated with the first user account.

4. The method of claim 1 further comprises:

validating, by a storage server of the at least the first minimum reconstruction number of storage servers of the first set of storage servers includes;

accessing a list of virtual digital data storage vaults supported by the storage server, wherein the list corresponds to a set of a plurality of dispersed data storage networks; and

determining whether the first vault structure is on the list.

5. The method of claim 4 further comprises:

generating an error when the first vault structure is not on the list or when the first request is invalid.

6. The method of claim 1, wherein the first vault structure comprises at least one of:

identity of the first information dispersal algorithm;

information regarding operating the first information dispersal algorithm;

total storage available to a first vault associated with the first vault structure;

amount of storage that presently occupied by data segments;

an indication of encryption;

an indication of data compression;

an indication of a particular integrity check; and

an access control list.

7. A non-transitory storage device comprises:

a first memory section that stores operational instructions that, when executed by a computer, causes the computer to;

receive a plurality of requests from a plurality of user devices;

for a first request of the plurality of requests;

a second memory section that stores operational instructions that, when executed by the computer, causes the computer to;

determine a first vault structure and a first user account;

identify a first set of storage servers based on the first vault structure;

send the first request to the first set of storage servers;

receive a first set of valid response slices from the at least a first minimum reconstruction number of storage servers of the first set of storage servers; and

decode, using a first information dispersal algorithm, the first set of valid response slices to reconstruct a first response; and

a third memory section that stores operational instructions that, when executed by a storage server of the at least the first minimum reconstruction number of storage servers, causes the storage server to;

validate the first request to produce, when valid, a first valid response slice of the first set of valid response slices;

for a second request of the plurality of requests;

the second memory section that stores operational instructions that, when executed by the computer, causes the computer to;

determine a second vault structure and a second user account;

identify a second set of storage servers based on the second vault structure;

send the second request to the second set of storage servers;

receive a second set of valid response slices from at least a second minimum reconstruction number of storage servers of the second set of storage servers;

decode, using a second information dispersal algorithm, the second set of valid response slices to reconstruct a second response; and

a fourth memory section that stores operational instructions that, when executed by a second storage server of the at least the second minimum reconstruction number of storage servers, causes the second storage server to;

validate the second request to produce, when valid, a second valid response slice of the second set of valid response slices.

8. The non-transitory storage device of claim 7 further comprises:

for a third request of the plurality of requests;

the second memory section that stores operational instructions that, when executed by the computer, causes the computer to;

determine the first vault structure and a third user account;

identify the first set of storage servers based on the first vault structure;

send the first request to the first set of storage servers;

receive a third set of valid response slices from the at least the first minimum reconstruction number of storage servers;

decode, using the first information dispersal algorithm, the third set of valid response slices to reconstruct a third response; and

a fifth memory section that stores operational instructions that, when executed by the first storage server of the at least the first minimum reconstruction number of storage servers, causes the second storage server to;

validate the third request to produce, when valid, a third valid response slice of the third set of valid response slices.

9. The non-transitory storage device of claim 7, wherein the third memory section further stores operational instructions that, when executed by the storage server of the at least the first minimum reconstruction number of storage servers, causes the storage server to validate the first request by:

validating a user account identified based on the first user account; and

when the first user account is valid, validating the request based on permissions associated with the first user account.

10. The non-transitory storage device of claim 7, wherein the third memory section further stores operational instructions that, when executed by the storage server of the at least the first minimum reconstruction number of storage servers, causes the storage server to validate the first request by:

accessing a list of virtual digital data storage vaults supported by the storage server, wherein the list corresponds to a set of a plurality of dispersed data storage networks; and

determining whether the first vault structure is on the list.

11. The non-transitory storage device of claim 10, wherein the third memory section further stores operational instructions that, when executed by the storage server of the at least the first minimum reconstruction number of storage servers, causes the storage server to:

generate an error when the first vault structure is not on the list or when the first request is invalid.

12. The non-transitory storage device of claim 7, wherein the first vault structure comprises at least one of:

identity of the first information dispersal algorithm;

information regarding operating the first information dispersal algorithm;

total storage available to a first vault associated with the first vault structure;

amount of storage that presently occupied by data segments;

an indication of encryption;

an indication of data compression;

an indication of a particular integrity check; and

an access control list.