Slice retrieval in accordance with an access sequence in a dispersed storage network

• US 9,063,881 B2
• Filed: 02/04/2011
• Issued: 06/23/2015
• Est. Priority Date: 04/26/2010
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Grube, Gary W., Markison, Timothy W.
• Primary Examiner(s): Decady, Albert
• Assistant Examiner(s): KABIR, ENAMUL MD
• Application Number:
  US13/021,552
• Publication Number:
  US 20110265143A1
• Time in Patent Office: 1,600 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0727 in a storage system, e.g. in a DASD or network based storage system drivers for digital recording or reproducing units G06F3/06; circuits for error detection or correction within digital recording or reproducing units G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097
• CPC Class Codes: G06F 11/076 by exceeding a count or rate limit, e.g. word- or bit count limit
• CPC Class Codes: G06F 11/0763 by bit configuration check, e.g. of formats or tags
• CPC Class Codes: G06F 11/1004 to protect a block of data words, e.g. CRC or checksum G06F11/1076 takes precedence; security arrangements for protecting computers or computer systems against unauthorized activity G06F21/00
• CPC Class Codes: G06F 11/1008 in individual solid state devices G06F11/1004 takes precedence
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 11/1092 Rebuilding, e.g. when physically replacing a failing disk
• CPC Class Codes: G06F 11/1464 for networked environments
• CPC Class Codes: G06F 11/2094 Redundant storage or storage space G06F11/2056 takes precedence
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/70 Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
• CPC Class Codes: G06F 2211/1028 Distributed, i.e. distributed RAID systems with parity
• CPC Class Codes: H04L 2209/30 Compression, e.g. Merkle-Damgard construction
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method begins by a processing module receiving a data retrieval request to retrieve data stored as a plurality of sets of encoded data slices in a dispersed storage network memory. The method continues with the processing module determining an access sequence for retrieving the plurality of sets of encoded data slices in accordance with the access sequence, entering a loop to produce recovered decoded data that includes sending a slice retrieval message for a set of encoded data slices of the plurality of sets of encoded data slices, receiving at least a decode threshold number of encoded data slices of the set to produce received encoded data slices, dispersed storage error decoding the received encoded data slices to produce the recovered decoded data, and exiting the loop when a set of encoded data slices is not requested in accordance with a system maintained access sequence.

Claims

1. A method for secured controlled access to store data, the method comprises:

determining, by a requesting computing device, a security access sequence for retrieving a plurality of sets of encoded data slices from a dispersed storage network (DSN) memory, wherein the stored data is encoded in accordance with a dispersed storage error encoding function to produce the plurality of sets of encoded data slices, wherein the stored data is divided into a plurality of data segments, and wherein a data segment of the plurality of data segments is encoded into one set of the plurality of sets of encoded data slices;

sending, by the requesting computing device to storage units of the DSN, a plurality of sets of slice retrieval messages for the plurality of sets of encoded data slices in accordance with a data segment retrieval order of the security access sequence;

while the data segment retrieval order corresponds to a retrieval order of a system maintained access sequence, sequentially sending, by one of the storage units, an encoded data slice from each set of the plurality of sets of encoded data slices;

when the data segment retrieval order ceases to correspond to the retrieval order of the system maintained access sequence, cease sending, by the one of the storage units, an encoded data slice from remaining sets of the plurality of sets of encoded data slices;

receiving, by the requesting computing device, encoded data slices of one of the plurality of sets of encoded data slices from at least some of the storage units; and

when a decode threshold number of encoded data slices have been received for the one of the plurality of sets of encoded data slices, dispersed storage error decoding the decode threshold number of encoded data slices to produce a recovered decoded data segment.

2. The method of claim 1 further comprises:

combining the recovered decoded data segment with other recovered decoded data segments to produce a data file.

3. The method of claim 2, wherein the set of encoded data slices comprises at least one of:

encoded data slices of a data segment of a plurality of data segments of the data file; and

encoded data slices of the plurality of data segments having a common pillar number.

4. The method of claim 1, wherein the determining the security access sequence is based on at least one of:

a data ID;

a requester ID;

a source name;

a data type indicator;

a vault lookup;

a predetermination;

a command;

a message;

a dispersed storage (DS) processing unit ID;

a priority indicator;

a performance indicator; and

a reliability indicator.

5. The method of claim 1, wherein, while the data segment retrieval order corresponds to the retrieval order of the system maintained access sequence, further comprises:

the security access sequence including at least one of;

a series of ordered slice names of the plurality of sets of encoded data slices;

a series of ordered segment identification codes; and

a series of ordered pillar identification codes; and

the system maintained access sequence including at least one of;

a corresponding series of ordered slice names of the plurality of sets of encoded data slices;

a corresponding series of ordered segment identification codes; and

a corresponding series of ordered pillar identification codes.

6. A method for secured controlled access to stored data, the method comprises:

detecting, by storage units of a dispersed storage network (DSN) memory, a plurality of sets of slice retrieval messages in accordance with a data segment retrieval order of a security access sequence regarding retrieval of data stored as a plurality of sets of encoded data slices in the DSN memory, wherein the data is divided into a plurality of data segments, and wherein a data segment of the plurality of data segments is encoded into one set of the plurality of sets of encoded data slices;

determining, by the storage units, a system maintained access sequence for retrieving the plurality of sets of encoded data slices;

while the data segment retrieval order corresponds to a retrieval order of the system maintained access sequence, sequentially sending, by one of the storage units, an encoded data slice from each set of the plurality of sets of encoded data slices; and

when the data segment retrieval order ceases to correspond to the retrieval order of the system maintained access sequence, sending, by the one of the storage units, a retrieval termination message indicating ceasing sending an encoded data slice from remaining sets of the plurality of sets of encoded data slices.

7. The method of claim 6, wherein the set of encoded data slices comprises at least one of:

encoded data slices of a data segment of a plurality of data segments of the data file; and

encoded data slices of the plurality of data segments having a common pillar number.

8. The method of claim 6, wherein the determining the system maintained access sequence is based on at least one of:

a data ID;

a requester ID;

a source name;

a data type indicator;

a vault lookup;

a predetermination;

a command;

a message;

a dispersed storage (DS) processing unit ID;

a priority indicator;

a performance indicator; and

a reliability indicator.

9. The method of claim 6, wherein the system maintained access sequence comprises at least one of:

a series of ordered slice names of the plurality of sets of slice names;

a series of ordered segment identification codes; and

a series of ordered pillar identification codes.

10. The method of claim 6, wherein the sending the retrieval termination message to the DSN memory comprises at least one of:

sending the retrieval termination message to one or more dispersed storage (DS) units;

sending the retrieval termination message to a DS processing unit; and

sending the retrieval termination message to a DS managing unit.

11. The method of claim 6, wherein the storage units determine that the data segment retrieval order corresponds to the retrieval order of the system maintained access sequence by:

extracting temporal retrieval information of the set of encoded data slices;

ordering the set of encoded data slices in accordance with the temporal retrieval information to produce an actual access sequence; and

comparing the system maintained access sequence with the security access sequence.

12. A non-transitory computer readable storage medium comprises:

a first memory section that stores operational instructions that, when executed by a requesting computing device, causes the requesting computing device to;

determine a security access sequence for retrieving a plurality of sets of encoded data slices from a dispersed storage network (DSN) memory wherein the stored data is encoded in accordance with a dispersed storage error encoding function to produce the plurality of sets of encoded data slices, wherein the stored data is divided into a plurality of data segments, and wherein a data segment of the plurality of data segments is encoded into one set of the plurality of sets of encoded data slices;

a second memory section that stores operational instructions that, when executed by the requesting computing device, causes the requesting computing device to;

send to storage units of the DSN, a plurality of sets of slice retrieval messages for the plurality of sets of encoded data slices in accordance with a data segment retrieval order of the security access sequence; and

a third memory section that stores operational instructions that, when executed by one of the storage units, causes the one of the storage units to;

while the data segment retrieval order corresponds to a retrieval order of a system maintained access sequence, sequentially send an encoded data slice from each set of the plurality of sets of encoded data slices; and

when the data segment retrieval order ceases to correspond to the retrieval order of the system maintained access sequence, cease sending an encoded data slice from remaining sets of the plurality of sets of encoded data slices; and

a fourth memory section that stores operational instructions that, when executed by the requesting computing device, causes the requesting computing device to;

receive encoded data slices of one of the plurality of sets of encoded data slices from at least some of the storage units; and

when a decode threshold number of encoded data slices have been received for the one of the plurality of sets of encoded data slices, dispersed storage error decode the decode threshold number of encoded data slices to produce a recovered decoded data segment.

13. The non-transitory computer readable storage medium of claim 12, wherein the fourth memory section that stores operational instructions that, when executed by the requesting computing device, further causes the requesting computing device to:

combine the recovered decoded data segment with other recovered decoded data segments to produce a data file.

14. The non-transitory computer readable storage medium of claim 13, wherein the set of encoded data slices comprises at least one of:

encoded data slices of a data segment of a plurality of data segments of the data file; and

encoded data slices of the plurality of data segments having a common pillar number.

15. The non-transitory computer readable storage medium of claim 12, wherein the first memory section that stores operational instructions that, when executed by the requesting computing device, further causes the requesting computing device to determine the security access sequence based on at least one of:

a data ID;

a requester ID;

a source name;

a data type indicator;

a vault lookup;

a predetermination;

a command;

a message;

a dispersed storage (DS) processing unit ID;

a priority indicator;

a performance indicator; and

a reliability indicator.

16. The non-transitory computer readable storage medium of claim 12, wherein, while the data segment retrieval order corresponds to the retrieval order of the system maintained access sequence further comprises:

the security access sequence including at least one of;

a series of ordered slice names of the plurality of sets of encoded data slices;

a series of ordered segment identification codes; and

a series of ordered pillar identification codes; and

the system maintained access sequence including at least one of;

a corresponding series of ordered slice names of the plurality of sets of encoded data slices;

a corresponding series of ordered segment identification codes; and

a corresponding series of ordered pillar identification codes.

17. A non-transitory computer readable storage medium comprises:

a first memory section that stores operational instructions that, when executed by a storage unit of a dispersed storage network (DSN) memory, causes the storage unit to;

detect, a plurality of slice retrieval messages of a plurality of sets of slice retrieval messages in accordance with a data segment retrieval order of a security access sequence regarding retrieval of data stored as a plurality of sets of encoded data slices in the DSN memory, wherein the data is divided into a plurality of data segments, and wherein a data segment of the plurality of data segments is encoded into one set of the plurality of sets of encoded data slices;

a second memory section that stores operational instructions that, when executed by the storage unit, causes the storage unit to;

determine a system maintained access sequence for retrieving an encoded data slice from each set of the plurality of sets of encoded data slices; and

a third memory section that stores operational instructions that, when executed by the storage unit, causes the storage unit to;

while the data segment retrieval order corresponds to a retrieval order of the system maintained access sequence, sequentially send the encoded data slice from each set of the plurality of sets of encoded data slices; and

when the data segment retrieval order ceases to correspond to the retrieval order of the system maintained access sequence, send a retrieval termination message to indicate ceasing sending an encoded data slice from remaining sets of the plurality of sets of encoded data slices.

18. The non-transitory computer readable storage medium of claim 17, wherein the set of encoded data slices comprises at least one of:

encoded data slices of a data segment of a plurality of data segments of the data file; and

encoded data slices of the plurality of data segments having a common pillar number.

19. The non-transitory computer readable storage medium of claim 17, wherein the second memory section that stores operational instructions that, when executed by the storage unit, further causes the storage unit to determine the system maintained access sequence based on at least one of:

a data ID;

a requester ID;

a source name;

a data type indicator;

a vault lookup;

a predetermination;

a command;

a message;

a dispersed storage (DS) processing unit ID;

a priority indicator;

a performance indicator; and

a reliability indicator.

20. The non-transitory computer readable storage medium of claim 17, wherein the system maintained access sequence comprises at least one of:

a series of ordered slice names of the plurality of sets of slice names;

a series of ordered segment identification codes; and

a series of ordered pillar identification codes.

21. The non-transitory computer readable storage medium of claim 17, wherein the third memory section that stores operational instructions that, when executed by the storage unit, further causes the storage unit to send the retrieval termination message to the DSN memory by at least one of:

sending the retrieval termination message to one or more dispersed storage (DS) units;

sending the retrieval termination message to a DS processing unit; and

sending the retrieval termination message to a DS managing unit.

22. The non-transitory computer readable storage medium of claim 17, wherein the third memory section that stores operational instructions that, when executed by the storage unit, further causes the storage unit to determine that the data segment retrieval order corresponds to a retrieval order of the system maintained access sequence by:

extracting temporal retrieval information of the set of encoded data slices;

ordering the set of encoded data slices in accordance with the temporal retrieval information to produce an actual access sequence; and

comparing the system maintained access sequence with the security access sequence.