Dispersed storage network (DSN) and system with improved security

• US 9,672,108 B2
• Filed: 07/20/2016
• Issued: 06/06/2017
• Est. Priority Date: 12/29/2009
• Status: Expired due to Fees

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Dhuse, Greg R., Gladwin, S. Christopher, Grube, Gary W., Markison, Timothy W., Resch, Jason K., Abhijeet, Kumar
• Primary Examiner(s): MENGESHA, MULUGETA A
• Application Number:
  US15/214,970
• Publication Number:
  US 20160328296A1
• Time in Patent Office: 321 Days
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 21/107 License processing; Key processing
• CPC Class Codes: G06F 21/1083 Partial license transfers
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06F 3/0604 Improving or facilitating administration, e.g. storage management
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/064 Management of blocks
• CPC Class Codes: G06F 3/0644 Management of space entities, e.g. partitions, extents, pools
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H03M 13/1515 Reed-Solomon codes
• CPC Class Codes: H03M 13/35 Unequal or adaptive error protection, e.g. by providing a different level of protection according to significance of source information or by adapting the coding according to the change of transmission channel characteristics
• CPC Class Codes: H03M 13/3761 using code combining, i.e. using combining of codeword portions which may have been transmitted separately, e.g. Digital Fountain codes, Raptor codes or Luby Transform [LT] codes
• CPC Class Codes: H03M 13/616 Matrix operations, especially for generator matrices or check matrices, e.g. column or row permutations
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 65/70 Media network packetisation
• CPC Class Codes: H04L 65/764 at the destination reformatting of additional data in video clients H04N21/4355
• CPC Class Codes: H04L 67/06 : specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/1097 : for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/085 : Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0869 : involving random numbers or seeds
• CPC Class Codes: H04L 9/0894 : Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/14 : using a plurality of keys or algorithms
• CPC Class Codes: H04N 21/2181 : comprising remotely distributed storage units, e.g. when movies are replicated over a plurality of video servers distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097
• CPC Class Codes: H04N 21/23116 : involving data replication, e.g. over plural servers synchronization of replicated data G06F11/1658; error detection or correction by means of data replication G06F11/2053; replication in distributed file systems G06F16/10; replication in distributed file systems G06F16/27; replication or mirroring of data in data networks H04L67/1095
• CPC Class Codes: H04N 21/232 : Content retrieval operation locally within server, e.g. reading video streams from disk arrays storage management G06F3/0604; details of querying and searching of video data from a database G06F16/739

Abstract

A computing device includes an interface configured to interface and communicate with a dispersed storage network (DSN), a memory that stores operational instructions, and a processing module operably coupled to the interface and to the memory, wherein the processing module, when operable within the computing device based on the operational instructions, is configured to perform various operations including to receive, via the interface, content retrieval messages for a data object. Then, based on the content retrieval messages for the data object and respectively for each associated data segment, the processing module determines respective groups of unique pillar combinations of at least read threshold number of EDSs, retrieves the respective groups of unique pillar combinations of at least read threshold number of EDSs from storage units (SUs) within the DSN, and provides the respective groups of unique pillar combinations of at least read threshold number of EDSs respectively to recipient device(s).

Claims

1. A method for execution by one or more computing devices of a dispersed storage network (DSN) regarding recording of broadcast multi-media content that is to be broadcast at a particular broadcast time, the method comprising:

receiving a plurality of content retrieval messages for a data object, wherein the data object is segmented into a plurality of data segments, wherein a data segment of the plurality of data segments is dispersed error encoded in accordance with dispersed error encoding parameters to produce a set of encoded data slices (EDSs) that is of pillar width, wherein a read threshold number of EDSs provides for reconstruction of the data segment;

based on the plurality of content retrieval messages for the data object and respectively for each data segment of the plurality of data segments;

determining respective pluralities of unique pillar combinations of at least read threshold number of EDSs;

retrieving the respective pluralities of unique pillar combinations of at least read threshold number of EDSs from a plurality of storage units (SUs) within the DSN; and

providing the respective pluralities of unique pillar combinations of at least read threshold number of EDSs respectively to a plurality of recipient devices based on the plurality of content retrieval messages for the data object.

2. The method of claim 1 further comprising, for the data segment of the plurality of data segments:

providing a first unique pillar combination of at least read threshold number of EDSs to a first recipient device based on a first content retrieval message of the plurality of content retrieval messages for the data object; and

providing a second unique pillar combination of at least read threshold number of EDSs to a second recipient device based on a second content retrieval message of the plurality of content retrieval messages for the data object.

3. The method of claim 1 further comprising:

for a first data segment of the plurality of data segments;

providing a first unique pillar combination of at least read threshold number of EDSs corresponding to the first data segment of the plurality of data segments to a first recipient device based on a first content retrieval message of the plurality of content retrieval messages for the data object; and

providing a second unique pillar combination of at least read threshold number of EDSs corresponding to the first data segment of the plurality of data segments to a second recipient device based on a second content retrieval message of the plurality of content retrieval messages for the data object; and

for a second data segment of the plurality of data segments;

providing a first unique pillar combination of at least read threshold number of EDSs corresponding to the second data segment of the plurality of data segments to the first recipient device based on the first content retrieval message of the plurality of content retrieval messages for the data object; and

providing a second unique pillar combination of at least read threshold number of EDSs corresponding to the second data segment of the plurality of data segments to the second recipient device based on the second content retrieval message of the plurality of content retrieval messages for the data object.

4. The method of claim 1 further comprising:

determining a plurality of numbers or vectors for the plurality of content retrieval messages for the data object, wherein each number or vector is based on a different respective one of the plurality of content retrieval messages for the data object;

generating respective pluralities of sequences for the plurality of content retrieval messages for the data object by applying the plurality of numbers or vectors to a pseudorandom sequence generator, wherein each sequence is based on a different respective one of the plurality of numbers or vectors being applied to the pseudorandom sequence generator;

for a first data segment of the plurality of data segments;

determining a first unique pillar combination of at least read threshold number of EDSs corresponding to the first data segment of the plurality of data segments based on a first element of a first sequence of the respective pluralities of sequences; and

determining a second unique pillar combination of at least read threshold number of EDSs corresponding to the first data segment of the plurality of data segments based on a first element of a second sequence of the respective pluralities of sequences; and

for a second data segment of the plurality of data segments;

determining a first unique pillar combination of at least read threshold number of EDSs corresponding to the second data segment of the plurality of data segments based on a second element of the first sequence of the respective pluralities of sequences; and

determining a second unique pillar combination of at least read threshold number of EDSs corresponding to the second data segment of the plurality of data segments based on a second element of the second sequence of the respective pluralities of sequences.

5. The method of claim 1, wherein a content retrieval message of the plurality of content retrieval messages for a data object includes at least one of:

a content identification code (ID), a user ID, digital rights management (DRM) information, DRM policy, read operational parameters utilized to retrieve EDSs of data segments of the data object from memory of the plurality of SUs within the DSN, or a content type indicator associated with the data object.

6. The method of claim 1, wherein determining one of the respective pluralities of unique pillar combinations of at least read threshold number of EDSs is based on at least one of:

a user identification code (ID), a vault lookup, a pillar combination table lookup, a previously assigned unique pillar combination, a previously utilized pillar combination associated with the user ID, a list of data segments and pillar combinations, a data segment ID, write operational parameters utilized when the data object was stored in memory of the plurality of SUs within the DSN, content of a content retrieval message of the plurality of content retrieval messages for a data object, content ID, digital rights management (DRM) information, DRM policy, read operational parameters utilized to retrieve EDSs of data segments of the data object from memory of the plurality of SUs within the DSN, DSN system parameters, or a content type indicator associated with the data object.

7. The method of claim 1, wherein a content retrieval message of the plurality of content retrieval messages for the data object is associated with at least one of a set top box, a user device, a DSN managing unit, a storage integrity processing unit, a DSN processing unit, a DSN unit, a SU of the plurality of SUs within the DSN, a wireless smart phone, a laptop, a tablet, a personal computers (PC), a work station, or a video game device.

8. The method of claim 1, wherein the one or more computing devices includes a SU of the plurality of SUs within the DSN, a wireless smart phone, a laptop, a tablet, a personal computers (PC), a work station, or a video game device.

9. The method of claim 1, wherein the DSN includes at least one of a wireless communication system, a wire lined communication systems, a non-public intranet system, a public internet system, a local area network (LAN), or a wide area network (WAN).

10. A computing device comprising:

an interface configured to interface and communicate with a dispersed storage network (DSN);

memory that stores operational instructions; and

a processing module operably coupled to the interface and to the memory, wherein the processing module, when operable within the computing device based on the operational instructions, is configured to;

receive, via the interface, a plurality of content retrieval messages for a data object, wherein the data object is segmented into a plurality of data segments, wherein a data segment of the plurality of data segments is dispersed error encoded in accordance with dispersed error encoding parameters to produce a set of encoded data slices (EDSs) that is of pillar width, wherein a read threshold number of EDSs provides for reconstruction of the data segment;

based on the plurality of content retrieval messages for the data object and respectively for each data segment of the plurality of data segments;

determine respective pluralities of unique pillar combinations of at least read threshold number of EDSs;

retrieve the respective pluralities of unique pillar combinations of at least read threshold number of EDSs from a plurality of storage units (SUs) within the DSN; and

provide the respective pluralities of unique pillar combinations of at least read threshold number of EDSs respectively to a plurality of recipient devices based on the plurality of content retrieval messages for the data object.

11. The computing device of claim 10, wherein the processing module, when operable within the computing device based on the operational instructions, is further configured, for the data segment of the plurality of data segments, to:

provide a first unique pillar combination of at least read threshold number of EDSs to a first recipient device based on a first content retrieval message of the plurality of content retrieval messages for the data object; and

provide a second unique pillar combination of at least read threshold number of EDSs to a second recipient device based on a second content retrieval message of the plurality of content retrieval messages for the data object.

12. The computing device of claim 10, wherein the processing module, when operable within the computing device based on the operational instructions, is further configured to:

for a first data segment of the plurality of data segments;

provide a first unique pillar combination of at least read threshold number of EDSs corresponding to the first data segment of the plurality of data segments to a first recipient device based on a first content retrieval message of the plurality of content retrieval messages for the data object; and

provide a second unique pillar combination of at least read threshold number of EDSs corresponding to the first data segment of the plurality of data segments to a second recipient device based on a second content retrieval message of the plurality of content retrieval messages for the data object; and

for a second data segment of the plurality of data segments;

provide a first unique pillar combination of at least read threshold number of EDSs corresponding to the second data segment of the plurality of data segments to the first recipient device based on the first content retrieval message of the plurality of content retrieval messages for the data object; and

provide a second unique pillar combination of at least read threshold number of EDSs corresponding to the second data segment of the plurality of data segments to the second recipient device based on the second content retrieval message of the plurality of content retrieval messages for the data object.

13. The computing device of claim 10, wherein the processing module, when operable within the computing device based on the operational instructions, is further configured to:

determine a plurality of numbers or vectors for the plurality of content retrieval messages for the data object, wherein each number or vector is based on a different respective one of the plurality of content retrieval messages for the data object;

generate respective pluralities of sequences for the plurality of content retrieval messages for the data object by applying the plurality of numbers or vectors to a pseudorandom sequence generator, wherein each sequence is based on a different respective one of the plurality of numbers or vectors being applied to the pseudorandom sequence generator;

for a first data segment of the plurality of data segments;

determine a first unique pillar combination of at least read threshold number of EDSs corresponding to the first data segment of the plurality of data segments based on a first element of a first sequence of the respective pluralities of sequences; and

determine a second unique pillar combination of at least read threshold number of EDSs corresponding to the first data segment of the plurality of data segments based on a first element of a second sequence of the respective pluralities of sequences; and

for a second data segment of the plurality of data segments;

determine a first unique pillar combination of at least read threshold number of EDSs corresponding to the second data segment of the plurality of data segments based on a second element of the first sequence of the respective pluralities of sequences; and

determine a second unique pillar combination of at least read threshold number of EDSs corresponding to the second data segment of the plurality of data segments based on a second element of the second sequence of the respective pluralities of sequences.

14. The computing device of claim 10, wherein a content retrieval message of the plurality of content retrieval messages for a data object includes at least one of:

a content identification code (ID), a user ID, digital rights management (DRM) information, DRM policy, read operational parameters utilized to retrieve EDSs of data segments of the data object from memory of the plurality of SUs within the DSN, or a content type indicator associated with the data object.

15. The computing device of claim 10, wherein the processing module, when operable within the computing device based on the operational instructions, determining one of the respective pluralities of unique pillar combinations of at least read threshold number of EDSs is based on at least one of:

a user identification code (ID), a vault lookup, a pillar combination table lookup, a previously assigned unique pillar combination, a previously utilized pillar combination associated with the user ID, a list of data segments and pillar combinations, a data segment ID, write operational parameters utilized when the data object was stored in memory of the plurality of SUs within the DSN, content of a content retrieval message of the plurality of content retrieval messages for a data object, content ID, digital rights management (DRM) information, DRM policy, read operational parameters utilized to retrieve EDSs of data segments of the data object from memory of the plurality of SUs within the DSN, DSN system parameters, or a content type indicator associated with the data object.

16. The computing device of claim 10, wherein a content retrieval message of the plurality of content retrieval messages for the data object is associated with at least one of a set top box, a user device, a DSN managing unit, a storage integrity processing unit, a DSN processing unit, a DSN unit, a SU of the plurality of SUs within the DSN, a wireless smart phone, a laptop, a tablet, a personal computers (PC), a work station, or a video game device.

17. The computing device of claim 10 further comprising:

a SU of the plurality of SUs within the DSN, a wireless smart phone, a laptop, a tablet, a personal computers (PC), a work station, or a video game device.

18. The computing device of claim 10, wherein the DSN includes at least one of a wireless communication system, a wire lined communication systems, a non-public intranet system, a public internet system, a local area network (LAN), or a wide area network (WAN).