Dispersed storage network with slice rebuilding and methods for use therewith

• US 9,798,621 B2
• Filed: 05/30/2014
• Issued: 10/24/2017
• Est. Priority Date: 08/27/2009
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Resch, Jason K., Baptist, Andrew
• Primary Examiner(s): CHANNAVAJJALA, SRIRAMA T
• Application Number:
  US14/292,285
• Publication Number:
  US 20140337666A1
• Time in Patent Office: 1,243 Days
• CPC Class Codes: G06F 11/1004 to protect a block of data words, e.g. CRC or checksum G06F11/1076 takes precedence; security arrangements for protecting computers or computer systems against unauthorized activity G06F21/00
• CPC Class Codes: G06F 11/1024 Identification of the type of error
• CPC Class Codes: G06F 11/1092 Rebuilding, e.g. when physically replacing a failing disk
• CPC Class Codes: G06F 12/1483 using an access-table, e.g. matrix or list
• CPC Class Codes: G06F 13/00 Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units interface circuits for specific input/output devices G06F3/00 ; multiprogram control therefor G06F9/46; multiprocessor systems G06F15/16
• CPC Class Codes: G06F 15/16 Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs coordinating program control therefor G06F9/52; in regulating and control system G05B
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

In a dispersed storage network where slices of secure user data are stored on geographically separated storage units (44), a managing unit (18) connected to the network (20) may seek to broadcast and update secure access control list information across the network (20). Upon a target device (e.g., devices 12, 14, 16, 18, or 44) receiving the broadcast the target device creates and sends an access control list change notification message to all other system devices that should have received the same broadcast if the broadcast is a valid request to update access control list information. The target device waits for responses from the other system devices to validate that the broadcast has been properly sent to a threshold number of other system devices before taking action to operationally change local data in accordance with the broadcast.

Claims

1. A method for execution by a computing device in a dispersed storage network (DSN), the method comprising:

executing by at least one processor of the computing device the steps of;

determining a slice name corresponding to a rebuilt slice that corresponds to a set of encoded data slices (EDSs) that is generated based on a data object that is segmented into a plurality of data segments, wherein a data segment of the plurality of data segments is dispersed error encoded in accordance with dispersed error encoding parameters to produce the set of EDSs;

determining a storage unit for storing the rebuilt slice in the DSN;

reconstructing the rebuilt slice based on other EDSs of the set of EDSs in accordance with the dispersed error encoding parameters;

sending, via an interface circuitry of the computing device and via the DSN, an authentication request to the storage unit that includes a request to store the rebuilt slice in the storage unit;

receiving, via the interface circuitry of the computing device and via the DSN, receiving an authentication response; and

sending, via the interface circuitry of the computing device and via the DSN, the rebuilt slice to the storage unit to be stored therein, when the authentication response indicates that the authentication request is authenticated.

2. The method of claim 1 wherein the rebuilt slice corresponds to one of:

a corrupted slice in the DSN, and a missing slice in the DSN.

3. The method of claim 1 wherein the storage unit authenticates the authentication request based on a permissions list.

4. The method of claim 1 wherein the rebuilt slice includes the slice name and wherein the storage unit determines when to store the rebuilt slice, based on the slice name.

5. The method of claim 4 wherein the storage unit determines when to store the rebuilt slice by determining if the slice name corresponds to one of:

a missing slice, and a corrupted slice.

6. The method of claim 4 wherein the storage unit determines when to store the rebuilt slice based on a version identifier included in the rebuilt slice.

7. The method of claim 1 wherein the storage unit authenticates the authentication request further based on an identification of a requesting device that generates the authentication request.

8. The method of claim 1 wherein the at least one processor is included in one of:

another storage unit in the DSN, a storage integrity processing unit in the DSN, and a managing unit in the DSN.

9. A processing unit adapted to be coupled to a dispersed storage network (DSN), the processing unit comprising:

input/output interface circuitry adapted to be coupled to the DSN and configured to support communications via the DSN;

memory configured to store operational instructions; and

processing circuitry operably coupled to the input/output interface circuitry and to the memory, wherein the processing circuitry, when operable within the processing unit based on the operational instructions, is configured to;

determine a slice name corresponding to a rebuilt slice that corresponds to a set of encoded data slices (EDSs) that is generated based on a data object that is segmented into a plurality of data segments, wherein a data segment of the plurality of data segments is dispersed error encoded in accordance with dispersed error encoding parameters to produce the set of EDSs;

determine a storage unit for storing the rebuilt slice in the DSN;

reconstruct the rebuilt slice based on other EDSs of the set of EDSs in accordance with the dispersed error encoding parameters;

send, via the input/output interface circuitry and via the DSN, an authentication request to the storage unit that includes a request to store the rebuilt slice in the storage unit;

receive, via the input/output interface circuitry and via the DSN, an authentication response; and

send, via the input/output interface circuitry and via the DSN, the rebuilt slice to the storage unit to be stored therein, when the authentication response indicates that the authentication request is authenticated.

10. The processing unit of claim 9 wherein the rebuilt slice corresponds to one of:

a corrupted slice in the DSN, and a missing slice in the DSN.

11. The processing unit of claim 9 wherein the storage unit authenticates the authentication request based on a permissions list.

12. The processing unit of claim 9 wherein the rebuilt slice includes the slice name and wherein the storage unit determines when to store the rebuilt slice, based on the slice name.

13. The processing unit of claim 12 wherein the storage unit determines when to store the rebuilt slice by determining if the slice name corresponds to one of:

a missing slice, and a corrupted slice.

14. The processing unit of claim 12 wherein the storage unit determines when to store the rebuilt slice based on a version identifier included in the rebuilt slice.

15. The processing unit of claim 9 wherein the storage unit authenticates the authentication request further based on an identification of a requesting device that generates the authentication request.

16. The processing unit of claim 9 wherein the processing unit is one of:

another storage unit in the DSN, a storage integrity processing unit in the DSN, and a managing unit in the DSN.

17. A computer readable storage medium comprises:

at least one memory section that stores operational instructions that, when executed by one or more processing modules of one or more computing devices of a dispersed storage network (DSN), causes the one or more computing devices to;

determine a slice name corresponding to a rebuilt slice that corresponds to a set of encoded data slices (EDSs) that is generated based on a data object that is segmented into a plurality of data segments, wherein a data segment of the plurality of data segments is dispersed error encoded in accordance with dispersed error encoding parameters to produce the set of EDSs;

determine a storage unit for storing the rebuilt slice in the DSN;

reconstruct the rebuilt slice based on other EDSs of the set of EDSs in accordance with the dispersed error encoding parameters;

send, via an interface circuitry and via the DSN, an authentication request to the storage unit that includes a request to store the rebuilt slice in the storage unit;

receive, via the interface circuitry and via the DSN, an authentication response; and

send, via the interface circuitry and via the DSN, the rebuilt slice to the storage unit, when the authentication response indicates that the authentication request is authenticated.

18. The computer readable storage medium of claim 17 wherein the rebuilt slice corresponds to one of:

a corrupted slice in the DSN, and a missing slice in the DSN.

19. The computer readable storage medium of claim 17 wherein the rebuilt slice includes the slice name and wherein the storage unit determines when to store the rebuilt slice, based on determining if the slice name corresponds to one of:

a missing slice, and a corrupted slice.

20. The computer readable storage medium of claim 17 wherein the rebuilt slice includes a version identifier and wherein the storage unit determines when to store the rebuilt slice, based on an analysis of the version identifier.