Accessing data utilizing entity registration in multiple dispersed storage networks

• US 8,683,205 B2
• Filed: 05/11/2011
• Issued: 03/25/2014
• Est. Priority Date: 05/19/2010
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Resch, Jason K., Grube, Gary W., Markison, Timothy W.
• Primary Examiner(s): Pham, Luu
• Assistant Examiner(s): Tolentino, Roderick
• Application Number:
  US13/105,136
• Publication Number:
  US 20110289577A1
• Time in Patent Office: 1,049 Days
• Field of Search: 713168-176, 726 26- 30
• US Class Current: 713/176
• CPC Class Codes: G06F 11/1092 Rebuilding, e.g. when physically replacing a failing disk
• CPC Class Codes: G06F 11/2094 Redundant storage or storage space G06F11/2056 takes precedence
• CPC Class Codes: G06F 2211/1028 Distributed, i.e. distributed RAID systems with parity
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal

Abstract

A method begins by a processing module determining whether a data access request is requesting access to data stored in a plurality of dispersed storage networks (DSNs). The method continues with the processing module determining whether one of the plurality of DSNs is a home DSN to a requesting entity when the data access request is requesting access to data stored in the plurality of DSNs. The method continues with the processing module utilizing a local signed certificate to access one or more dispersed storage (DS) units of the home DSN, validating a global signed certificate with one or more DS units of a non-home DSN of the plurality of DSNs to produce a valid global signed certificate, and utilizing the valid signed certificate to access the one or more DS units of the non-home DSN when the plurality of DSNs includes the home DSN.

Claims

1. A method comprises:

determining whether a data access request is requesting access to a data segment of data stored in a plurality of dispersed storage networks (DSNs), wherein the data segment is dispersed storage error encoded to produce a set of encoded data slices and the set of encoded data slices are stored in storage units of the plurality of DSNs;

in response to the data access request to the data segment stored in the plurality of DSNs, determining whether one of the plurality of DSNs is a home DSN of a requesting entity;

in response to determining the plurality of DSNs includes the home DSN;

utilizing a local signed certificate to access one or more storage units of the home DSN to access one or more encoded data slices of the set of encoded data slices;

validating a global signed certificate with one or more DS units of a non-home DSN of the plurality of DSNs to produce a valid global signed certificate; and

utilizing the valid global signed certificate to access the one or more DS units of the non-home DSN to access another one or more encoded data slices of the set of encoded data slices; and

,

in response to determining the DSN is the non-home DSN;

validating a global signed certificate with storage units of the non-home DSN to produce the valid global signed certificate; and

utilizing the valid global signed certificate to access the set of DS units of the non-home DSN regarding at least some encoded data slices of the set of encoded data slices.

2. The method of claim 1, wherein the validating the global signed certificate with the one or more DS units of the non-home DSN comprises at least one of:

validating the global signed certificate with each of the one or more DS units of the non-home DSN of the plurality of DSNs to produce a set of valid global signed certificates; and

validating the global signed certificate with a proxy unit of the one or more DS units of the non-home DSN of the plurality of DSNs to produce the valid global signed certificate.

3. The method of claim 1, wherein the validating the global signed certificate with the one or more DS units of the non-home DSN comprises:

obtaining the global signed certificate from a local memory or from a certificate authority;

sending the global signed certificate to the one or more DS units of the non-home DSN;

receiving a challenge message from the one or more DS units of the non-home DSN;

generating a challenge response message in accordance with the challenge message and based on the global signed certificate;

sending the challenge response message to the one or more DS units of the non-home DSN; and

receiving validation from the one or more DS units of the non-home DSN.

4. The method of claim 1, wherein the set of encoded data slices comprises one of:

a threshold number of encoded data slices that is required to reproduce the data segment;

a pillar number of encoded data slices, wherein the pillar number represents a total number of encoded data slices created when the data segment was dispersed storage error encoded;

a first sub-set of encoded data slices and a second sub-set of encoded data slices, wherein the first sub-set of encoded data slices corresponds to the threshold number of encoded data slices or the pillar number of encoded data slices and the second sub-set of encoded data slices is a replication of the first sub-set of encoded data slices.

5. A computer comprises:

an interface;

a memory; and

a processing module configured to;

determine whether a data access request is requesting access to a data segment of data stored in a plurality of dispersed storage networks (DSNs), wherein the data segment is dispersed storage error encoded to produce a set of encoded data slices and the set of encoded data slices are stored in storage units of the plurality of DSNs;

in response to the data access request to the data segment stored in the plurality of DSNs, determine whether one of the plurality of DSNs is a home DSN of a requesting entity;

in response to determining the plurality of DSNs includes the home DSN;

utilize a local signed certificate to access one or more storage units of the home DSN to access one or more encoded data slices of the set of encoded data slices;

validate a global signed certificate with one or more DS units of a non-home DSN of the plurality of DSNs to produce a valid global signed certificate; and

utilize the valid global signed certificate to access the one or more DS units of the non-home DSN to access another one or more encoded data slices of the set of encoded data slices; and

in response to determining the DSN is the non-home DSN;

validate a global signed certificate with storage units of the non-home DSN to produce the valid global signed certificate; and

utilize the valid global signed certificate to access the set of DS units of the non-home DSN regarding at least some encoded data slices of the set of encoded data slices.

6. The computer of claim 5, wherein the processing module functions to validate the global signed certificate with the one or more DS units of the non-home DSN by at least one of:

validating the global signed certificate with each of the one or more DS units of the non-home DSN of the plurality of DSNs to produce a set of valid global signed certificates; and

validating the global signed certificate with a proxy unit of the one or more DS units of the non-home DSN of the plurality of DSNs to produce the valid global signed certificate.

7. The computer of claim 5, wherein the processing module functions to validate the global signed certificate with the one or more DS units of the non-home DSN by:

obtaining the global signed certificate from a local memory or, via the interface, from a certificate authority;

sending, via the interface, the global signed certificate to the one or more DS units of the non-home DSN;

receiving, via interface, a challenge message from the one or more DS units of the non-home DSN;

generating a challenge response message in accordance with the challenge message and based on the global signed certificate;

sending, via the interface, the challenge response message to the one or more DS units of the non-home DSN; and

receiving, via the interface, validation from the one or more DS units of the non-home DSN.

8. The computer of claim 5, wherein the set of encoded data slices comprises one of:

a threshold number of encoded data slices that is required to reproduce the data segment;

a pillar number of encoded data slices, wherein the pillar number represents a total number of encoded data slices created when the data segment was dispersed storage error encoded;

a first sub-set of encoded data slices and a second sub-set of encoded data slices, wherein the first sub-set of encoded data slices corresponds to the threshold number of encoded data slices or the pillar number of encoded data slices and the second sub-set of encoded data slices is a replication of the first sub-set of encoded data slices.