Authenticating use of a dispersed storage network
View Patent ↗A method begins with a managing unit authenticating an access request regarding a set of encoded data slices, which represents an encoded data segment. The method continues, when the access request is authenticated, by generating storage unit access requests based on the access request regarding the set of encoded data slices. The method continues with the managing unit authenticating the storage unit access requests. When the storage unit access requests are authenticated, the method continues with the storage units executing the storage unit access requests to fulfill the access request regarding the set of encoded data slices.
1. A method for a multi-phase authentication process in a dispersed storage network (DSN), where a data segment of data is encoded in accordance with a dispersed storage error encoding function to produce a set of encoded data slices and wherein the set of encoded data slices is stored in storage units of the DSN, the method comprises:
authenticating, by a managing unit of the DSN, an access request regarding the set of encoded data slices;
when the access request is authenticated, generating, based on the access request regarding the set of encoded data slices, storage unit access requests to access the storage units;
authenticating, by the managing unit, the storage unit access requests; and
when the storage unit access requests are authenticated, executing, by the storage units, the storage unit access requests to fulfill the access request regarding the set of encoded data slices.
2. The method of claim 1 further comprises:
receiving, by a distributed storage (DS) module, a dispersed storage network (DSN) access request from a requesting device, wherein the DSN access request identifies the data segment;
generating, by the DS module, an authentication request regarding the DSN access request, wherein the authentication request includes a signed certificate of the DS module and identity of the requesting device; and
sending, by the DS module, the authentication request to the managing unit.
3. The method of claim 2 , wherein the authenticating the access request comprises at least one of:
verifying the signed certificate of the DS module;
verifying the identity of the requestor device; and
sending, by the managing unit, a favorable authentication response to the DS module when the at least one of the signed certificate of the DS module and the identity of the requestor have been verified.
4. The method of claim 1 , wherein the generating the storage unit access requests comprises:
receiving a favorable authentication response as an indication that the access request is authenticated;
after receiving the favorable authentication response, accessing, by a distributed storage (DS) module, a permissions list to verify that a requesting device has permission to request the access request;
when the requestor has permission, generating, by the DS module, the storage unit access requests; and
sending, by the DS module, the storage unit access requests to the storage units.
5. The method of claim 4 further comprises:
receiving, by one of the storage units, one of the storage unit access requests that includes a signed certificate of the DS module, identity of the requesting device, and one or more DSN addresses;
sending, by the one of the storage units, a second authentication request regarding the one of the storage unit access requests to the managing unit, wherein the second authentication request includes a signed certificate of the one of the storage units and the identity of the requesting device; and
sending, by the managing unit as part of the authenticating the storage unit access requests, a second favorable authentication response to the one of the storage units when the signed certificate of the one of the storage units and the identity of the requesting device are validated.
6. The method of claim 1 , wherein the access request comprises one of:
a read access request;
a write access request;
a delete access request; and
an edit access request.
7. A distributed storage network (DSN) comprises:
a managing unit;
a distributed storage (DS) processing module; and
storage units, wherein:
the managing unit is operable to authenticate an access request regarding a set of encoded data slices, wherein a data segment of data is encoded in accordance with a dispersed storage error encoding function to produce the set of encoded data slices and wherein the set of encoded data slices is stored in the storage units;
the DS processing module is operable, when the access request is authenticated, to generate storage unit access requests based on the access request regarding the set of encoded data slices;
the managing unit is further operable to authenticate the storage unit access requests; and
the storage units are operable, when the storage unit access requests are authenticated, to execute the storage unit access requests to fulfill the access request regarding the set of encoded data slices.
8. The DSN of claim 7 further comprises:
the DS processing module further operable to receive a dispersed storage network (DSN) access request from a requesting device, wherein the DSN access request identifies the data segment;
the DS processing module further operable to generate an authentication request regarding the DSN access request, wherein the authentication request includes a signed certificate of the DS processing module and identity of the requesting device; and
the DS processing module further operable to send the authentication request to the managing unit.
9. The DSN of claim 8 , wherein the managing unit is further operable to authenticate the access request by:
verifying at least one of the signed certificate of the DS processing module and the identity of the requestor device; and
sending a favorable authentication response to the DS processing module when the at least one of the signed certificate of the DS module and the identity of the requestor have been verified.
10. The DSN of claim 7 , wherein the DS processing module is further operable to generate the storage unit access requests by:
receiving a favorable authentication response as an indication that the access request is authenticated;
after receiving the favorable authentication response, accessing a permissions list to verify that a requesting device has permission to request the access request;
when the requestor has permission, generating the storage unit access requests; and
sending the storage unit access requests to the storage units.
11. The DSN of claim 10 further comprises:
receiving, by one of the storage units, one of the storage unit access requests that includes a signed certificate of the DS module, identity of the requesting device, and one or more DSN addresses;
sending, by the one of the storage units, a second authentication request regarding the one of the storage unit access requests to the managing unit, wherein the second authentication request includes a signed certificate of the one of the storage units and the identity of the requesting device; and
sending, by the managing unit as part of the authenticating the storage unit access requests, a second favorable authentication response to the one of the storage units when the signed certificate of the one of the storage units and the identity of the requesting device are validated.
12. The DSN of claim 7 , wherein the access request comprises one of:
a read access request;
a write access request;
a delete access request; and
an edit access request.