Security checks for proxied requests

• US 9,798,467 B2
• Filed: 09/08/2016
• Issued: 10/24/2017
• Est. Priority Date: 12/29/2009
• Status: Expired due to Fees

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Motwani, Manish, Resch, Jason K.
• Primary Examiner(s): Parry, Chris
• Assistant Examiner(s): STILTNER, WEIWEI YE
• Application Number:
  US15/259,764
• Publication Number:
  US 20160378350A1
• Time in Patent Office: 411 Days
• Field of Search: 709213-215, 707602, 707635, 707756
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06F 3/0607 by facilitating the process of upgrading existing storage systems, e.g. for improving compatibility between host and storage device
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/0634 by changing the state or mode of one or more devices
• CPC Class Codes: G06F 3/0637 Permissions
• CPC Class Codes: G06F 3/064 Management of blocks
• CPC Class Codes: G06F 3/0647 Migration mechanisms
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04N 21/2181 : comprising remotely distributed storage units, e.g. when movies are replicated over a plurality of video servers distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097
• CPC Class Codes: H04N 21/23116 : involving data replication, e.g. over plural servers synchronization of replicated data G06F11/1658; error detection or correction by means of data replication G06F11/2053; replication in distributed file systems G06F16/10; replication in distributed file systems G06F16/27; replication or mirroring of data in data networks H04L67/1095
• CPC Class Codes: H04N 21/232 : Content retrieval operation locally within server, e.g. reading video streams from disk arrays storage management G06F3/0604; details of querying and searching of video data from a database G06F16/739
• CPC Class Codes: H04N 21/274 : Storing end-user multimedia data in response to end-user request , e.g. network recorder

Abstract

A method begins by a storage unit of a dispersed storage network (DSN) executing transitioning storage of one or more groups of encoded data slices. The method continues while transitioning storage of the one or more groups of encoded data slices with the storage unit receiving a proxied data access request regarding an encoded data slice from another storage unit of the DSN. The method continues by the storage unit determining whether the other storage unit is an authentic storage unit of the DSN based on at least one of the encoded data slice, a previous version of the distributed agreement protocol, and a new version of the distributed agreement protocol. The method continues by when the other storage unit is the authentic storage unit, processing the proxied data access request to produce a data access response and sending the data access response to the other storage unit.

Claims

1. A method for execution by a storage unit of a dispersed storage network (DSN), the method comprises:

transitioning storage of one or more groups of encoded data slices from storage based on a previous version of a distributed agreement protocol to storage based on a new version of the distributed agreement protocol; and

while transitioning storage of the one or more groups of encoded data slices;

receiving a proxied data access request regarding an encoded data slice from another storage unit of the DSN;

determining whether the other storage unit is an authentic storage unit of the DSN based on at least one of;

the encoded data slice, the previous version of the distributed agreement protocol, and the new version of the distributed agreement protocol;

when the other storage unit is the authentic storage unit, processing the proxied data access request to produce a data access response; and

sending the data access response to the other storage unit.

2. The method of claim 1, wherein the determining whether the other storage unit is the authentic storage unit comprises:

determining the other storage unit is part of the same vault as the storage unit.

3. The method of claim 1, wherein the determining whether the other storage unit is the authentic storage unit comprises:

determining the encoded data slice is mapped to the other storage unit based on the previous version of the distributed agreement protocol.

4. The method of claim 1, wherein the determining whether the other storage unit is the authentic storage unit comprises:

determining that an ongoing migration task from the other storage unit to the storage unit is active.

5. The method of claim 4, wherein determining the ongoing migration task comprises one or more of:

querying a DSN managing unit;

determining the storage unit is concurrently using both the previous and new distributed agreement protocol; and

receiving a message indicating to use the new distributed agreement protocol for data access requests.

6. The method of claim 1, wherein the determining whether the other storage unit is the authentic storage unit comprises:

determining the encoded data slice is mapped to the storage unit based on the new version of the distributed agreement protocol.

7. The method of claim 1 further comprises one of:

when the other storage unit is not the authentic storage unit, denying the proxied data access request;

when the other storage unit is not the authentic storage unit;

identifying a second storage unit based on the encoded data slice and the previous distributed agreement protocol;

sending a request to the second storage unit to verify the proxied data access request; and

when verified, process the request and sending a response to the second storage unit.

8. The method of claim 1 further comprises:

receiving the new version of the distributed agreement protocol and maintaining the previous version of a distributed agreement protocol for processing data access requests regarding the one or more groups of encoded data slices during the transition of storage; and

when the transition of storage is complete, utilizing the new version of a distributed agreement protocol for processing data access requests regarding the one or more groups of encoded data slices.

9. A storage unit comprises:

an interface;

memory; and

a processing module operably coupled to the memory and the interface, wherein the processing module is operable to;

transition storage of one or more groups of encoded data slices from storage based on a previous version of a distributed agreement protocol to storage based on a new version of the distributed agreement protocol; and

while transitioning storage of the one or more groups of encoded data slices;

receive, via the interface, a proxied data access request regarding an encoded data slice from another storage unit of a dispersed storage network (DSN);

determine whether the other storage unit is an authentic storage unit of the DSN based on at least one of;

the encoded data slice, the previous version of the distributed agreement protocol, and the new version of the distributed agreement protocol;

when the other storage unit is the authentic storage unit, process the proxied data access request to produce a data access response; and

send, via the interface, the data access response to the other storage unit.

10. The storage unit of claim 9, wherein the processing module determines whether the other storage unit is the authentic storage unit by:

determining the other storage unit is part of the same vault as the storage unit.

11. The storage unit of claim 9, wherein the processing module determines whether the other storage unit is the authentic storage unit by:

determining the encoded data slice is mapped to the other storage unit based on the previous version of the distributed agreement protocol.

12. The storage unit of claim 9, wherein the processing module determines whether the other storage unit is the authentic storage unit by:

determining that an ongoing migration task from the other storage unit to the storage unit is active.

13. The storage unit of claim 12, wherein the processing module determines the ongoing migration task by one or more of:

querying a DSN managing unit;

determining the storage unit is concurrently using both the previous and new distributed agreement protocol; and

receiving, via the interface, a message indicating to use the new distributed agreement protocol for data access requests.

14. The storage unit of claim 9, wherein the processing module determines whether the other storage unit is the authentic storage unit by:

determining the encoded data slice is mapped to the storage unit based on the new version of the distributed agreement protocol.

15. The storage unit of claim 9, wherein the processing module further functions to perform one of:

when the other storage unit is not the authentic storage unit, denying the proxied data access request;

when the other storage unit is not the authentic storage unit;

identifying a second storage unit based on the encoded data slice and the previous distributed agreement protocol;

sending, via the interface, a request to the second storage unit to verify the proxied data access request; and

when verified, processing the request and sending, via the interface, a response to the second storage unit.

16. The storage unit of claim 9, wherein the processing module further functions to:

receive, via the interface, the new version of the distributed agreement protocol and maintain the previous version of a distributed agreement protocol for processing data access requests regarding the one or more groups of encoded data slices during the transition of storage; and

when the transition of storage is complete, utilize the new version of a distributed agreement protocol for processing data access requests regarding the one or more groups of encoded data slices.