Dispersed storage network (DSN) and system with improved security

• US 9,927,978 B2
• Filed: 02/27/2017
• Issued: 03/27/2018
• Est. Priority Date: 12/29/2009
• Status: Expired due to Fees

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Abhijeet, Kumar, Dhuse, Greg R., Gladwin, S. Christopher, Grube, Gary W., Markison, Timothy W., Resch, Jason K.
• Primary Examiner(s): MENGESHA, MULUGETA A
• Application Number:
  US15/444,104
• Publication Number:
  US 20170168717A1
• Time in Patent Office: 393 Days
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 21/107 License processing; Key processing
• CPC Class Codes: G06F 21/1083 Partial license transfers
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06F 3/0604 Improving or facilitating administration, e.g. storage management
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/064 Management of blocks
• CPC Class Codes: G06F 3/0644 Management of space entities, e.g. partitions, extents, pools
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H03M 13/1515 Reed-Solomon codes
• CPC Class Codes: H03M 13/35 Unequal or adaptive error protection, e.g. by providing a different level of protection according to significance of source information or by adapting the coding according to the change of transmission channel characteristics
• CPC Class Codes: H03M 13/3761 using code combining, i.e. using combining of codeword portions which may have been transmitted separately, e.g. Digital Fountain codes, Raptor codes or Luby Transform [LT] codes
• CPC Class Codes: H03M 13/616 Matrix operations, especially for generator matrices or check matrices, e.g. column or row permutations
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 65/70 Media network packetisation
• CPC Class Codes: H04L 65/764 at the destination reformatting of additional data in video clients H04N21/4355
• CPC Class Codes: H04L 67/06 : specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/1097 : for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/085 : Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0869 : involving random numbers or seeds
• CPC Class Codes: H04L 9/0894 : Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/14 : using a plurality of keys or algorithms
• CPC Class Codes: H04N 21/2181 : comprising remotely distributed storage units, e.g. when movies are replicated over a plurality of video servers distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097
• CPC Class Codes: H04N 21/23116 : involving data replication, e.g. over plural servers synchronization of replicated data G06F11/1658; error detection or correction by means of data replication G06F11/2053; replication in distributed file systems G06F16/10; replication in distributed file systems G06F16/27; replication or mirroring of data in data networks H04L67/1095
• CPC Class Codes: H04N 21/232 : Content retrieval operation locally within server, e.g. reading video streams from disk arrays storage management G06F3/0604; details of querying and searching of video data from a database G06F16/739

Abstract

A computing device includes an interface configured to interface and communicate with a dispersed storage network (DSN), a memory that stores operational instructions, and a processing module operably coupled to the interface and to the memory, wherein the processing module, when operable within the computing device based on the operational instructions, is configured to perform various operations including to receive, via the interface, content retrieval messages for a data object. Then, based on the content retrieval messages for the data object and respectively for each associated data segment, the processing module determines respective groups of unique pillar combinations of at least read threshold number of EDSs, retrieves the respective groups of unique pillar combinations of at least read threshold number of EDSs from storage units (SUs) within the DSN, and provides the respective groups of unique pillar combinations of at least read threshold number of EDSs respectively to recipient device(s).

Claims

1. A computing device comprising:

an interface configured to interface and communicate with a dispersed or distributed storage network (DSN);

memory that stores operational instructions; and

a processing module operably coupled to the interface and to the memory, wherein the processing module, when operable within the computing device based on the operational instructions, is configured to;

receive a first request for a data object from another computing device at or during a first time, wherein the data object is segmented into a plurality of data segments, wherein a data segment of the plurality of data segments is dispersed error encoded in accordance with dispersed error encoding parameters to produce a set of encoded data slices (EDSs) that is on pillar width, and wherein a decode threshold number of EDSs are needed to recover the data segment;

for the data segment of the plurality of data segments and based on the first request for the data object, provide to the another computing device a first unique pillar combination of at least the decode threshold number of EDSs stored within a plurality of storage units (SUs) within the DSN;

receive a second request for the data object from the another computing device at or during a second time that is different than the first time; and

for the data segment of the plurality of data segments and based on the second request for the data object, provide to the another computing device a second unique pillar combination of the at least the decode threshold number of EDSs stored within the plurality of SUs within the DSN.

2. The computing device of claim 1, wherein the processing module, when operable within the computing device based on the operational instructions, is further configured to:

receive the first request for the data object from the another computing device based on a first user request provided to the another computing device;

receive the second request for the data object from the another computing device based on a second user request provided to the another computing device;

receive a third request for the data object from at least one other computing device that is different than the another computing device at or during a third time that is different than the first time and the second time based on a third user request provided to the at least one other computing device; and

for the data segment of the plurality of data segments and based on the third request for the data object, provide to the at least one other computing device a third unique pillar combination of the at least the decode threshold number of EDSs stored within the plurality of SUs within the DSN.

3. The computing device of claim 1, wherein the processing module, when operable within the computing device based on the operational instructions, is further configured to:

at or during the first time;

determine a first number or vector based on the first request for the data object from the another computing device;

apply the first number or vector to a pseudorandom sequence generator to generate a first sequence for the first request for the data object; and

determine the first unique pillar combination of the at least the decode threshold number of EDSs stored within the plurality of SUs within the DSN based on a firsts element of the first sequence;

at or during the second time;

determine a second number or vector based on the second request for the data object from the another computing device;

apply the second number or vector to a pseudorandom sequence generator to generate a second sequence for the second request for the data object; and

determine the second unique pillar combination of the at least the decode threshold number of EDSs stored within the plurality of SUs within the DSN based on a second element of the second sequence.

4. The computing device of claim 1, wherein at least one of the first request for the data object from the another computing device or the second request for the data object from the another computing device includes at least one of:

a content identification code (ID), a user ID, digital rights management (DRM) information, DRM policy, read operational parameters utilized to retrieve EDSs of data segments of the data object from memory of the plurality of SUs within the DSN, or a content type indicator associated with the data object.

5. The computing device of claim 1, wherein the processing module, when operable within the computing device based on the operational instructions, is further configured to:

determine at least one of the first unique pillar combination of the at least the decode threshold number of EDSs or the second unique pillar combination of the at least the decode threshold number of EDSs based on at least one of;

a user identification code (ID), a vault lookup, a pillar combination table lookup, a previously assigned unique pillar combination, a previously utilized pillar combination associated with the user ID, a list of data segments and pillar combinations, a data segment ID, write operational parameters utilized when the data object was stored in memory of the plurality of SUs within the DSN, content of at least one of the first request for the data object from the another computing device or the second request for the data object from the another computing device, content ID, digital rights management (DRM) information, DRM policy, read operational parameters utilized to retrieve EDSs of data segments of the data object from memory of the plurality of SUs within the DSN, DSN system parameters, or a content type indicator associated with the data object.

6. The computing device of claim 1, wherein the computing device is located at a first premises that is remotely located from at least one SU of the plurality of SUs within the DSN.

7. The computing device of claim 1 further comprising:

a SU of the plurality of SUs within the DSN, a wireless smart phone, a laptop, a tablet, a personal computers (PC), a work station, or a video game device.

8. The computing device of claim 1, wherein the DSN includes at least one of a wireless communication system, a wire lined communication system, a non-public intranet system, a public internet system, a local area network (LAN), or a wide area network (WAN).

9. A computing device comprising:

an interface configured to interface and communicate with a dispersed or distributed storage network (DSN);

memory that stores operational instructions; and

a processing module operably coupled to the interface and to the memory, wherein the processing module, when operable within the computing device based on the operational instructions, is configured to;

receive a first request for a data object from a first other computing device at or during a first time based on a first user request from a user, wherein the data object is segmented into a plurality of data segments, wherein a data segment of the plurality of data segments is dispersed error encoded in accordance with dispersed error encoding parameters to produce a set of encoded data slices (EDSs) that is on pillar width, and wherein a decode threshold number of EDSs are needed to recover the data segment;

for the data segment of the plurality of data segments and based on the first request for the data object, provide to the first other computing device a first unique pillar combination of at least the decode threshold number of EDSs stored within a plurality of storage units (SUs) within the DSN;

receive a second request for the data object from a second other computing device at or during a second time that is different than the first time based on a second user request from the user; and

for the data segment of the plurality of data segments and based on the second request for the data object, provide to the second other computing device a second unique pillar combination of the at least the decode threshold number of EDSs stored within the plurality of SUs within the DSN.

10. The computing device of claim 9, wherein at least one of the first request for the data object from the first other computing device or the second request for the data object from the second other computing device includes at least one of:

a content identification code (ID), a user ID, digital rights management (DRM) information, DRM policy, read operational parameters utilized to retrieve EDSs of data segments of the data object from memory of the plurality of SUs within the DSN, or a content type indicator associated with the data object.

11. The computing device of claim 9, wherein the processing module, when operable within the computing device based on the operational instructions, is further configured to:

determine at least one of the first unique pillar combination of the at least the decode threshold number of EDSs or the second unique pillar combination of the at least the decode threshold number of EDSs based on at least one of;

a user identification code (ID), a vault lookup, a pillar combination table lookup, a previously assigned unique pillar combination, a previously utilized pillar combination associated with the user ID, a list of data segments and pillar combinations, a data segment ID, write operational parameters utilized when the data object was stored in memory of the plurality of SUs within the DSN, content of at least one of the first request for the data object from the first other computing device or the second request for the data object from the second other computing device, content ID, digital rights management (DRM) information, DRM policy, read operational parameters utilized to retrieve EDSs of data segments of the data object from memory of the plurality of SUs within the DSN, DSN system parameters, or a content type indicator associated with the data object.

12. The computing device of claim 9 further comprising:

a SU of the plurality of SUs within the DSN, a wireless smart phone, a laptop, a tablet, a personal computers (PC), a work station, or a video game device.

13. The computing device of claim 9, wherein the DSN includes at least one of a wireless communication system, a wire lined communication system, a non-public intranet system, a public internet system, a local area network (LAN), or a wide area network (WAN).

14. A method for execution by a computing device, the method comprising:

receiving, via an interface of the computing device configured to interface and communicate with a dispersed or distributed storage network (DSN), a first request for a data object from another computing device at or during a first time, wherein the data object is segmented into a plurality of data segments, wherein a data segment of the plurality of data segments is dispersed error encoded in accordance with dispersed error encoding parameters to produce a set of encoded data slices (EDSs) that is on pillar width, and wherein a decode threshold number of EDSs are needed to recover the data segment;

for the data segment of the plurality of data segments and based on the first request for the data object, providing to the another computing device a first unique pillar combination of at least the decode threshold number of EDSs stored within a plurality of storage units (SUs) within the DSN;

receiving, via the interface, a second request for the data object from the another computing device at or during a second time that is different than the first time; and

for the data segment of the plurality of data segments and based on the second request for the data object, providing to the another computing device a second unique pillar combination of the at least the decode threshold number of EDSs stored within the plurality of SUs within the DSN.

15. The method of claim 14 further comprising:

receiving the first request for the data object from the another computing device based on a first user request provided to the another computing device;

receiving the second request for the data object from the another computing device based on a second user request provided to the another computing device;

receiving a third request for the data object from at least one other computing device that is different than the another computing device at or during a third time that is different than the first time and the second time based on a third user request provided to the at least one other computing device; and

for the data segment of the plurality of data segments and based on the third request for the data object, providing to the at least one other computing device a third unique pillar combination of the at least the decode threshold number of EDSs stored within the plurality of SUs within the DSN.

16. The method of claim 14 further comprising:

at or during the first time;

determining a first number or vector based on the first request for the data object from the another computing device;

applying the first number or vector to a pseudorandom sequence generator to generate a first sequence for the first request for the data object; and

determining the first unique pillar combination of the at least the decode threshold number of EDSs stored within the plurality of SUs within the DSN based on a firsts element of the first sequence;

at or during the second time;

determining a second number or vector based on the second request for the data object from the another computing device;

applying the second number or vector to a pseudorandom sequence generator to generate a second sequence for the second request for the data object; and

determining the second unique pillar combination of the at least the decode threshold number of EDSs stored within the plurality of SUs within the DSN based on a second element of the second sequence.

17. The method of claim 14, wherein at least one of the first request for the data object from the another computing device or the second request for the data object from the another computing device includes at least one of:

a content identification code (ID), a user ID, digital rights management (DRM) information, DRM policy, read operational parameters utilized to retrieve EDSs of data segments of the data object from memory of the plurality of SUs within the DSN, or a content type indicator associated with the data object.

18. The method of claim 14 further comprising:

determining at least one of the first unique pillar combination of the at least the decode threshold number of EDSs or the second unique pillar combination of the at least the decode threshold number of EDSs based on at least one of;

a user identification code (ID), a vault lookup, a pillar combination table lookup, a previously assigned unique pillar combination, a previously utilized pillar combination associated with the user ID, a list of data segments and pillar combinations, a data segment ID, write operational parameters utilized when the data object was stored in memory of the plurality of SUs within the DSN, content of at least one of the first request for the data object from the another computing device or the second request for the data object from the another computing device, content ID, digital rights management (DRM) information, DRM policy, read operational parameters utilized to retrieve EDSs of data segments of the data object from memory of the plurality of SUs within the DSN, DSN system parameters, or a content type indicator associated with the data object.

19. The method of claim 14, wherein the computing device includes a SU of the plurality of SUs within the DSN, a wireless smart phone, a laptop, a tablet, a personal computers (PC), a work station, or a video game device.

20. The method of claim 14, wherein the DSN includes at least one of a wireless communication system, a wire lined communication system, a non-public intranet system, a public internet system, a local area network (LAN), or a wide area network (WAN).