Accessing data utilizing entity registration in multiple dispersed storage networks
View Patent ↗A method begins by a processing module determining whether a data access request is requesting access to data stored in a plurality of dispersed storage networks (DSNs). The method continues with the processing module determining whether one of the plurality of DSNs is a home DSN to a requesting entity when the data access request is requesting access to data stored in the plurality of DSNs. The method continues with the processing module utilizing a local signed certificate to access one or more dispersed storage (DS) units of the home DSN, validating a global signed certificate with one or more DS units of a non-home DSN of the plurality of DSNs to produce a valid global signed certificate, and utilizing the valid signed certificate to access the one or more DS units of the non-home DSN when the plurality of DSNs includes the home DSN.
1. A method comprises:
determining whether a data access request is requesting access to a data segment of data stored in a plurality of dispersed storage networks (DSNs), wherein the data segment is dispersed storage error encoded to produce a set of encoded data slices and the set of encoded data slices are stored in storage units of the plurality of DSNs;
in response to the data access request to the data segment stored in the plurality of DSNs, determining whether one of the plurality of DSNs is a home DSN of a requesting entity;
in response to determining the plurality of DSNs includes the home DSN:
utilizing a local signed certificate to access one or more storage units of the home DSN to access one or more encoded data slices of the set of encoded data slices; validating a global signed certificate with one or more DS units of a non-home DSN of the plurality of DSNs to produce a valid global signed certificate; and utilizing the valid global signed certificate to access the one or more DS units of the non-home DSN to access another one or more encoded data slices of the set of encoded data slices; and,
in response to determining the DSN is the non-home DSN:
validating a global signed certificate with storage units of the non-home DSN to produce the valid global signed certificate; and
utilizing the valid global signed certificate to access the set of DS units of the non-home DSN regarding at least some encoded data slices of the set of encoded data slices.
2. The method of claim 1 , wherein the validating the global signed certificate with the one or more DS units of the non-home DSN comprises at least one of:
validating the global signed certificate with each of the one or more DS units of the non-home DSN of the plurality of DSNs to produce a set of valid global signed certificates; and
validating the global signed certificate with a proxy unit of the one or more DS units of the non-home DSN of the plurality of DSNs to produce the valid global signed certificate.
3. The method of claim 1 , wherein the validating the global signed certificate with the one or more DS units of the non-home DSN comprises:
obtaining the global signed certificate from a local memory or from a certificate authority;
sending the global signed certificate to the one or more DS units of the non-home DSN;
receiving a challenge message from the one or more DS units of the non-home DSN;
generating a challenge response message in accordance with the challenge message and based on the global signed certificate;
sending the challenge response message to the one or more DS units of the non-home DSN; and
receiving validation from the one or more DS units of the non-home DSN.
4. The method of claim 1 , wherein the set of encoded data slices comprises one of:
a threshold number of encoded data slices that is required to reproduce the data segment;
a pillar number of encoded data slices, wherein the pillar number represents a total number of encoded data slices created when the data segment was dispersed storage error encoded;
a first sub-set of encoded data slices and a second sub-set of encoded data slices, wherein the first sub-set of encoded data slices corresponds to the threshold number of encoded data slices or the pillar number of encoded data slices and the second sub-set of encoded data slices is a replication of the first sub-set of encoded data slices.
5. A computer comprises:
an interface;
a memory; and
a processing module configured to:
determine whether a data access request is requesting access to a data segment of data stored in a plurality of dispersed storage networks (DSNs), wherein the data segment is dispersed storage error encoded to produce a set of encoded data slices and the set of encoded data slices are stored in storage units of the plurality of DSNs:
in response to the data access request to the data segment stored in the plurality of DSNs, determine whether one of the plurality of DSNs is a home DSN of a requesting entity; in response to determining the plurality of DSNs includes the home DSN:
utilize a local signed certificate to access one or more storage units of the home DSN to access one or more encoded data slices of the set of encoded data slices; validate a global signed certificate with one or more DS units of a non-home DSN of the plurality of DSNs to produce a valid global signed certificate; and utilize the valid global signed certificate to access the one or more DS units of the non-home DSN to access another one or more encoded data slices of the set of encoded data slices; and
in response to determining the DSN is the non-home DSN:
validate a global signed certificate with storage units of the non-home DSN to produce the valid global signed certificate; and utilize the valid global signed certificate to access the set of DS units of the non-home DSN regarding at least some encoded data slices of the set of encoded data slices.
6. The computer of claim 5 , wherein the processing module functions to validate the global signed certificate with the one or more DS units of the non-home DSN by at least one of:
validating the global signed certificate with each of the one or more DS units of the non-home DSN of the plurality of DSNs to produce a set of valid global signed certificates; and
validating the global signed certificate with a proxy unit of the one or more DS units of the non-home DSN of the plurality of DSNs to produce the valid global signed certificate.
7. The computer of claim 5 , wherein the processing module functions to validate the global signed certificate with the one or more DS units of the non-home DSN by:
obtaining the global signed certificate from a local memory or, via the interface, from a certificate authority;
sending, via the interface, the global signed certificate to the one or more DS units of the non-home DSN;
receiving, via interface, a challenge message from the one or more DS units of the non-home DSN;
generating a challenge response message in accordance with the challenge message and based on the global signed certificate;
sending, via the interface, the challenge response message to the one or more DS units of the non-home DSN; and
receiving, via the interface, validation from the one or more DS units of the non-home DSN.
8. The computer of claim 5 , wherein the set of encoded data slices comprises one of:
a threshold number of encoded data slices that is required to reproduce the data segment;
a pillar number of encoded data slices, wherein the pillar number represents a total number of encoded data slices created when the data segment was dispersed storage error encoded;
a first sub-set of encoded data slices and a second sub-set of encoded data slices, wherein the first sub-set of encoded data slices corresponds to the threshold number of encoded data slices or the pillar number of encoded data slices and the second sub-set of encoded data slices is a replication of the first sub-set of encoded data slices.