Entity registration in multiple dispersed storage networks

• US 9,357,009 B2
• Filed: 12/31/2014
• Issued: 05/31/2016
• Est. Priority Date: 05/19/2010
• Status: Expired due to Fees

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Resch, Jason K., Grube, Gary W., Markison, Timothy W.
• Primary Examiner(s): Tolentino, Roderick
• Application Number:
  US14/587,781
• Publication Number:
  US 20150113140A1
• Time in Patent Office: 517 Days
• Field of Search: 726 2- 6
• US Class Current: 1/1
• CPC Class Codes: G06F 11/1092 Rebuilding, e.g. when physically replacing a failing disk
• CPC Class Codes: G06F 11/2094 Redundant storage or storage space G06F11/2056 takes precedence
• CPC Class Codes: G06F 2211/1028 Distributed, i.e. distributed RAID systems with parity
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal

Abstract

A method begins by receiving an access request for a user device. The method continues with the DS processing unit determining whether the user device has the DSN as a local DSN. When the user device does not have the DSN as the local DSN, the method continues with the DS processing unit determining whether the user device has a valid signed global certificate. When the user device does not have a valid signed global certificate, the method continues with the DS processing unit or by the user device sending a DSN registration request to the system authority unit. The method continues with the system authority unit generating the valid signed global certificate for the user device upon successful execution of processing the DSN registration request. The method continues with the DS processing unit executing the access request for the user device upon receipt of the valid signed global certificate.

Claims

1. A method comprises:

receiving, by a dispersed storage (DS) processing unit of a dispersed storage network (DSN) of a DSN system, an access request for a user device, wherein the DSN system includes a plurality of DSNs, a system management unit, and a system authority unit and wherein the DSN includes the DS processing unit, a DS managing unit, and a plurality of storage units;

determining, by the DS processing unit, whether the user device has the DSN as a local DSN;

when the user device does have the DSN as the local DSN;

determining, by the DS processing unit, whether the user device has a valid signed local certificate; and

when the user device does have the valid signed local certificate, executing, by the DS processing unit, the access request for the user device;

when the user device does not have the DSN as the local DSN;

determining, by the DS processing unit, whether the user device has a valid signed global certificate;

when the user device does not have a valid signed global certificate;

sending, by the DS processing unit or by the user device, a DSN registration request to the system authority unit;

generating, by the system authority unit, the valid signed global certificate for the user device upon successful execution of processing the DSN registration request;

and executing, by the DS processing unit, the access request for the user device upon receipt of the valid signed global certificate.

2. The method of claim 1, wherein the sending the DSN registration request comprises:

outputting a registration request message that includes requesting access to the DSN system;

receiving a registration response message that includes a global universal unique identifier (UUID);

generating a global public-private key pair;

generating a global certificate signing request (CSR) based on the global UUID and a private key of the global public-private key pair;

sending the global CSR to system authority unit; and

receiving the valid signed global certificate.

3. The method of claim 1 further comprises:

when the user device does not have a valid signed local certificate;

sending, by the DS processing unit or by the user device, a local DSN registration request to the system authority unit;

generating, by the system authority unit, the valid signed local certificate for the user device upon successful execution of processing the local DSN registration request; and

executing, by the DS processing unit, the access request for the user device upon receipt of the valid signed local certificate.

4. The method of claim 1 further comprises:

when user device does have valid signed global certificate, executing, by the DS processing unit, the access request for the user device.

5. The method of claim 1 further comprises:

determining whether the access request is requesting access to multiple DSNs of the DSN system;

when the access request is requesting access to multiple DSNs, determining whether one of the multiple DSNs is the local DSN;

when the one of the multiple DSNs is the local DSN;

accessing storage units of the local DSN using a valid local signed certificate; and

accessing storage units of other DSNs of the multiple DSNs using the valid global signed certificate; and

when the one of the multiple DSNs is not the local DSN, accessing storage units of the multiple DSNs using the valid global signed certificate.

6. A computer readable storage device comprises:

a first storage section that stores operational instructions that, when executed by a dispersed storage (DS) processing unit of a dispersed storage network (DSN) of a DSN system, wherein the DSN system includes a plurality of DSNs, a system management unit, and a system authority unit and wherein the DSN includes the DS processing unit, a DS managing unit, and a plurality of storage units, causes the DS processing unit to;

determine whether a user device has the DSN as a local DSN;

a second storage section that stores operational instructions that, when executed by the DS processing unit, causes the DS processing unit to, when the user device does not have the DSN as the local DSN;

determine whether the user device has a valid signed global certificate;

a third storage section that stores operational instructions that, when executed by the DS processing unit or the user device, causes the DS processing unit or the user device to, when the user device does not have the DSN as the local DSN and when the user device does not have a valid signed global certificate;

send a DSN registration request to the system authority unit;

a fourth storage section that stores operational instructions that, when executed by the system authority unit, causes the system authority unit to, when the user device does not have the DSN as the local DSN and when the user device does not have a valid signed global certificate;

generate the valid signed global certificate for the user device upon successful execution of processing the DSN registration request;

and a fifth storage section that stores operational instructions that, when executed by the DS processing unit, causes the DS processing unit to when the user device does not have the DSN as the local DSN and when the user device does not have a valid signed global certificate;

execute an access request for the user device upon receipt of the valid signed global certificate;

the second storage section further stores operational instructions that, when executed by the DS processing unit, causes the DS processing unit to, when the user device does have the DSN as the local DSN;

determine whether the user device has a valid signed local certificate;

and the fifth storage section further stores operational instructions that, when executed by the DS processing unit, causes the DS processing unit to when the user device does have the DSN as the local DSN and when the user device does have a valid signed local certificate;

execute the access request for the user device.

7. The computer readable storage device of claim 6, wherein the third storage section further stores operational instructions that, when executed by the DS processing unit or the user device, causes the DS processing unit or the user device to send the DSN registration request by:

outputting a registration request message that includes requesting access to the DSN system;

receiving a registration response message that includes a global universal unique identifier (UUID);

generating a global public-private key pair;

generating a global certificate signing request (CSR) based on the global UUID and a private key of the global public-private key pair;

sending the global CSR to system authority unit; and

receiving the valid signed global certificate.

8. The computer readable storage device of claim 6 further comprises:

the third storage section further stores operational instructions that, when executed by the DS processing unit or the user device, causes the DS processing unit or the user device to, when the user device does have the DSN as the local DSN and when the user device does not have a valid signed local certificate;

send a local DSN registration request to the system authority unit;

the fourth storage section further stores operational instructions that, when executed by the system authority unit, causes the system authority unit to, when the user device does have the DSN as the local DSN and when the user device does not have a valid signed local certificate;

generate the valid signed local certificate for the user device upon successful execution of processing the local DSN registration request; and

the fifth storage section further stores operational instructions that, when executed by the DS processing unit, causes the DS processing unit to when the user device does have the DSN as the local DSN and when the user device does have the valid signed local certificate;

execute the access request for the user device upon receipt of the valid signed local certificate.

9. The computer readable storage device of claim 6, wherein the fifth storage section further stores operational instructions that, when executed by the DS processing unit, causes the DS processing unit to

when user device does have valid signed global certificate, execute the access request for the user device.

10. The computer readable storage device of claim 6 further comprises:

a sixth storage section that stores operational instructions that, when executed by the DS processing unit, causes the DS processing unit to;

determine whether the access request is requesting access to multiple DSNs of the DSN system;

when the access request is requesting access to multiple DSNs, determine whether one of the multiple DSNs is the local DSN;

when the one of the multiple DSNs is the local DSN;

access storage units of the local DSN using a valid local signed certificate; and

access storage units of other DSNs of the multiple DSNs using the valid global signed certificate; and

when the one of the multiple DSNs is not the local DSN, access storage units of the multiple DSNs using the valid global signed certificate.