Obfuscating a transaction in a dispersed storage system

• US 9,607,168 B2
• Filed: 05/30/2014
• Issued: 03/28/2017
• Est. Priority Date: 09/29/2009
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Grube, Gary W., Markison, Timothy W., Resch, Jason K.
• Primary Examiner(s): Poinvil, Frantzy
• Application Number:
  US14/292,318
• Publication Number:
  US 20140279104A1
• Time in Patent Office: 1,033 Days
• Field of Search: 705 3- 44
• US Class Current: 1/1
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2211/1028 Distributed, i.e. distributed RAID systems with parity
• CPC Class Codes: G06Q 20/202 Interconnection or interaction of plural electronic cash registers [ECR] or to host computer, e.g. network details, transfer of information from host to ECR or from ECR to ECR
• CPC Class Codes: G06Q 20/206 comprising security or operator identification provisions, e.g. password entry
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification

Abstract

A method begins by a processing module receiving a data segment for dispersed storage. The method continues with the processing module encoding the data segment in accordance with an error coding dispersed storage function to produce a plurality of error coded data slices. The method continues with the processing module generating a slice name for an error coded data slice of the plurality of error coded data slices, wherein the slice name includes a dispersed storage routing information section and a data identification section. The method continues with the processing module performing a securing function on at least the data identification section to produce a secure data identification section. The method continues with the processing module replacing, within the slice name, the data identification section with the secure data identification section to produce a secure slice name.

Claims

1. A method for performing a commerce transaction utilizing a plurality of encoded data slices to communicate the commerce transaction, in which the commerce transaction is communicated via a plurality of distributed storage units that are configured to store different encoded data slices, the method comprising:

determining dispersal parameters in a transaction unit that has a processor to process the commerce transaction, in which the dispersal parameters identify the plurality of distributed storage units for storing respective encoded data slices of a first plurality of encoded data slices pertaining to an authorization request message to request a performance of the commerce transaction and in which the authorization request message is generated by a remote processing unit that transmits the respective encoded data slices to respective distributed storage units based on the dispersal parameters;

retrieving, at the transaction unit, at least a threshold number of the first plurality of encoded data slices stored in the plurality of distributed storage units identified by the dispersal parameters, the threshold number being less than a number of distributed storage units storing the first plurality of encoded data slices;

processing, by use of the processor at the transaction unit, to re-create the authorization request message from at least the threshold number of the first plurality of encoded data slices retrieved;

processing, by use of the processor at the transaction unit, an authorization request contained in the authorization request message and generating an authorization request response to the authorization request;

encoding, by use of the processor at the transaction unit, the authorization request response into a second plurality of encoded data slices; and

transmitting, from the transaction unit, respective encoded data slices of the second plurality of encoded data slices to the plurality of distributed storage units based on the dispersal parameter, in order for the remote processing unit, that transmitted the authorization request message, to retrieve at least the threshold number of the second plurality of encoded data slices to complete the commerce transaction.

2. The method of claim 1, wherein when determining the dispersal parameters in the transaction unit, the transaction unit obtains the dispersal parameters from a distributed storage management unit.

3. The method of claim 1, wherein the dispersal parameters are determined by an authorization protocol.

4. The method of claim 1, wherein when retrieving at least the threshold number of the first plurality of encoded data slices, individual data slices have a slice name that includes dispersed routing information and a transaction name of the commerce transaction.

5. The method of claim 1, wherein the commerce transaction is a financial transaction.

6. The method of claim 1, wherein the remote processing unit is a point-of-sale unit.

7. The method of claim 1, wherein the remote processing unit processes point-of-sale transactions for generating the authorization request message.

8. The method of claim 1 further comprising, settling the commerce transaction by the transaction unit after completing the commerce transaction, wherein the transaction unit updates an account information pertaining to the completed commerce transaction and transmits the updated account information encoded into multiple data slices containing encoded account information via the plurality of distributed storage units.

9. The method of claim 1 further comprising, settling the commerce transaction by the transaction unit after completing the commerce transaction, wherein the transaction unit updates an account information pertaining to the completed commerce transaction, aggregates account information of multiple completed commerce transactions and transmits the updated aggregated account information encoded into multiple data slices containing encoded aggregated account information via the plurality of distributed storage units.

10. The method of claim 1 further comprising, settling the commerce transaction by the transaction unit after completing the commerce transaction, wherein the transaction unit updates an account information pertaining to the completed commerce transaction, and at a predetermined time period, aggregates account information of multiple completed commerce transactions and transmits the updated aggregated account information encoded into multiple data slices containing encoded aggregated account information via the plurality of distributed storage units.

11. The method of claim 1, wherein the remote processing unit processes credit card commerce transactions.

12. The method of claim 1, wherein when generating the authorization request response, the processor of the transaction unit generates an approval or denial to the authorization request.

13. A transaction unit configured to perform a commerce transaction utilizing a plurality of encoded data slices to communicate the commerce transaction, in which the commerce transaction is communicated via a plurality of distributed storage units that are configured to store different encoded data slices, the method comprising:

an interface configured to communicate with the plurality of distributed storage units; and

a processor operating with the interface to determine dispersal parameters to process the commerce transaction, in which the dispersal parameters identify the plurality of distributed storage units for storing respective encoded data slices of a first plurality of encoded data slices pertaining to an authorization request message to request a performance of the commerce transaction and in which the authorization request message is generated by a remote processing unit that transmits the respective encoded data slices to respective distributed storage units based on the dispersal parameters, the processor to retrieve, via the interface, at least a threshold number of the first plurality of encoded data slices stored in the plurality of distributed storage units identified by the dispersal parameters and to re-create the authorization request message from at least the threshold number of the first plurality of encoded data slices retrieved, the threshold number being less than a number of distributed storage units storing the first plurality of encoded data slices, the processor to process an authorization request contained in the authorization request message and to generate an authorization request response to the authorization request, and the processor to encode the authorization request response into a second plurality of encoded data slices for transmission, via the interface, of respective encoded data slices of the second plurality of encoded data slices to the plurality of distributed storage units based on the dispersal parameter, in order for the remote processing unit, that transmitted the authorization request message, to retrieve at least the threshold number of the second plurality of encoded data slices to complete the commerce transaction.

14. The transaction unit of claim 13, wherein the processor determines the dispersal parameters by obtaining the dispersal parameters from a distributed storage management unit.

15. The transaction unit of claim 13, wherein the dispersal parameters are determined by an authorization protocol.

16. The transaction unit of claim 13, wherein the remote processing unit processes point-of-sale transactions for generating the authorization request message.

17. The transaction unit of claim 13, wherein the processor is operable to settle the commerce transaction after completing the commerce transaction, wherein the processor updates an account information pertaining to the completed commerce transaction and transmits, via the interface, the updated account information encoded into multiple data slices containing encoded account information via the plurality of distributed storage units.

18. The transaction unit of claim 13, wherein the processor is operable to settle the commerce transaction after completing the commerce transaction, wherein the processor updates an account information pertaining to the completed commerce transaction, aggregates account information of multiple completed commerce transactions and transmits, via the interface, the updated aggregated account information encoded into multiple data slices containing encoded aggregated account information via the plurality of distributed storage units.

19. A method for performing a commerce transaction utilizing a plurality of encoded data slices to communicate the commerce transaction, in which the commerce transaction is communicated via a plurality of distributed storage units that are configured to store different encoded data slices, the method comprising:

initiating the commerce transaction, which is in response to a point-of-sale transaction;

generating, at a remote processing unit, an authorization request to complete the point-of-sale transaction;

encoding, at the remote processing unit, the authorization request into an authorization request message that is encoded into a first plurality of encoded data slices;

determining dispersal parameters to identify the plurality of distributed storage units for storing respective encoded data slices of the first plurality of encoded data slices;

transmitting the first plurality of encoded data slices to the plurality of distributed storage units;

determining the dispersal parameters in a transaction unit that has a processor to process the commerce transaction;

retrieving, at the transaction unit, at least a threshold number of the first plurality of encoded data slices stored in the plurality of distributed storage units identified by the dispersal parameters, the threshold number being less than a number of distributed storage units storing the first plurality of encoded data slices;

processing, by use of the processor at the transaction unit, to re-create the authorization request message from at least the threshold number of the first plurality of encoded data slices retrieved;

processing, by use of the processor at the transaction unit, the authorization request contained in the authorization request message and generating an authorization request response to the authorization request;

encoding, by use of the processor at the transaction unit, the authorization request response into a second plurality of encoded data slices; and

transmitting, from the transaction unit, respective encoded data slices of the second plurality of encoded data slices to the plurality of distributed storage units based on the dispersal parameter, in order for the remote processing unit, that transmitted the authorization request message, to retrieve at least the threshold number of the second plurality of encoded data slices to complete the point-of-sale transaction.

20. The method of claim 19 further comprising, settling the commerce transaction by the transaction unit after completing the commerce transaction, wherein the transaction unit updates an account information pertaining to the completed commerce transaction and transmits the updated account information encoded into multiple data slices containing encoded account information via the plurality of distributed storage units.