Obtaining a signed certificate for a dispersed storage network
View Patent ↗A method begins by a dispersed storage (DS) processing module generating a certificate signing request (CSR) that includes a certificate and a certificate extension, wherein the certificate includes information regarding a requesting device and wherein the certificate extension includes information regarding an accessible dispersed storage network (DSN) address range for the requesting device. The method continues with the DS processing module outputting the CSR to a certificate authority of a DSN and receiving a signed certificate from the certificate authority, wherein the signed certificate includes a certification signature of the certificate authority authenticating the certificate and the certificate extension. The method continues with the DS processing module storing the signed certificate for use when generating a DSN access request, wherein the DSN access request is requesting access to dispersed storage error encoded data in the DSN at an address within the accessible DSN address range.
1. A method for execution by a computing device of a dispersed storage network (DSN), the method comprises:
sending certificate information to a storage unit of the DSN, wherein the certificate information includes information regarding a user device;
receiving, from the storage unit, a certificate signing request that at least partially include the certificate information;
after validation, sending the certificate signing request to a certificate authority device of the DSN;
receiving, from the certificate authority device, a signed certificate; and
after validation, sending the signed certificate to the storage unit such that the storage unit can certify access requests from the user device.
2. The method of claim 1 , wherein the certificate information comprises one or more pieces of information from a list of pieces of information that includes:
a universally unique identifier;
a DSN identifier; and
a device type.
3. The method of claim 1 , wherein the certificate information comprises:
information regarding each of a plurality of user devices, wherein the plurality of user devices includes the user device, and wherein each of the plurality of user devices have a common logical storage vault identifier.
4. The method of claim 1 , wherein validating the certificate signing request comprises:
comparing the certificate information of the certificate signing request to the certificate information sent to the storage unit; and
when the certificate information of the certificate signing request compares favorably to the certificate information sent to the storage unit, validating the certificate signing request.
5. The method of claim 1 further comprises:
the signed certificate includes a signature of the certificate authority device and at least a portion of the certificate signing request; and
wherein validating the signed certificate includes:
comparing the certificate signing request of the signed certificate to the certificate signing request sent to the certificate authority device; and
when the certificate signing request of the signed certificate compares favorably to the certificate signing request sent to the certificate authority device, validating the signed certificate.
6. The method of claim 1 , wherein the signed certificate comprises:
a certificate bundle field;
a certificate signature algorithm field; and
a certificate signature field.
7. The method of claim 6 , wherein the certificate bundle field comprises:
a certificate; and
one or more certificate extensions from a list of certificate extensions.
8. A dispersed storage (DS) module comprises:
a first module, when operable within a computing device, causes the computing device to:
send certificate information to a storage unit of a dispersed storage network (DSN), wherein the certificate information includes information regarding a user device;
a second module, when operable within the computing device, causes the computing device to:
receive, from the storage unit, a certificate signing request that at least partially include the certificate information;
a third module, when operable within the computing device, causes the computing device to:
after validation, send the certificate signing request to a certificate authority device of the DSN;
the second module, when operable within the computing device, further causes the computing device to:
receive, from the certificate authority device, a signed certificate; and
the third module, when operable within the computing device, further causes the computing device to:
after validation, send the signed certificate to the storage unit such that the storage unit can certify access requests from the user device.
9. The DS module of claim 8 , wherein the certificate information comprises one or more pieces of information from a list of pieces of information that includes:
a universally unique identifier;
a DSN identifier; and
a device type.
10. The DS module of claim 8 , wherein the certificate information comprises:
information regarding each of a plurality of user devices, wherein the plurality of user devices includes the user device, and wherein each of the plurality of user devices have a common logical storage vault identifier.
11. The DS module of claim 8 , wherein the third module, when operable within the computing device, further causes the computing device to validate the certificate signing request by:
comparing the certificate information of the certificate signing request to the certificate information sent to the storage unit; and
when the certificate information of the certificate signing request compares favorably to the certificate information sent to the storage unit, validating the certificate signing request.
12. The DS module of claim 8 further comprises:
the signed certificate includes a signature of the certificate authority device and at least a portion of the certificate signing request; and
wherein the third module, when operable within the computing device, further causes the computing device to validating the signed certificate includes:
comparing the certificate signing request of the signed certificate to the certificate signing request sent to the certificate authority device; and
when the certificate signing request of the signed certificate compares favorably to the certificate signing request sent to the certificate authority device, validating the signed certificate.
13. The DS module of claim 8 , wherein the signed certificate comprises:
a certificate bundle field;
a certificate signature algorithm field; and
a certificate signature field.
14. The DS module of claim 13 , wherein the certificate bundle field comprises:
a certificate; and
one or more certificate extensions from a list of certificate extensions.