Cooperative data access request authorization in a dispersed storage network

1. A method for execution by one or more processing modules of one or more computing devices of a dispersed storage network (DSN), the method comprises:

receiving, by storage units of a set of storage units, an access request regarding a set of encoded data slices from a user device, wherein a data object is partitioned to produce a plurality of segments that includes a data segment and another data segment, wherein the data segment is dispersed storage error encoded to produce the set of encoded data slices that are stored in first storage units of the set of storage units, wherein the another data segment is dispersed storage error encoded to produce another set of encoded data that are stored in second storage units of the set of storage units that are different than the first storage units of the set of storage units;

processing access control information associated with the access request to determine whether access to the data object is on a data segment by data segment basis;

based on a determination that access to the data object is on the data segment by data segment basis, interpreting, by a storage unit of the storage units, to determine whether the user device is authorized to access the set of encoded data slices as requested in the access request;

when the storage unit determines that the user device is authorized to access the set of encoded data slices as requested in the access request, identifying the first storage units of the set of storage units, and sending, by the storage unit, a message to proceed with responding to the access request to ether the first storage units of the set of storage units; and

when the storage unit determines that the user device is not authorized to access the set of encoded data slices as requested in the access request, identifying the first storage units of the set of storage units, and sending, by the storage unit, a message to disregard the access request to the first storage units of the set of storage units.

2. The method of claim 1 , wherein the interpreting comprises:

accessing a local copy of an access control list that includes a listing of user devices and their corresponding authorization to access data objects.

3. The method of claim 1 further comprises:

determining the storage unit in accordance with a predetermined assignment, as a first storage unit of the storage units to receive and process the access request, or a distributed allocation of interpreting requests based on type of requests or based on user device identifiers.

4. The method of claim 1 further comprises:

storing a copy of an access control list by n−k+1 storage units of the set of storage units, wherein “n” represents a total number of encoded data slices in the set of encoded data slices and “k” represents a decode threshold number of encoded data slices of the set of encoded data slices that are needed to decode and recover the data segment, wherein the storage unit is one of the n−k+1 storage units.

5. The method of claim 1 further comprises:

when neither of the message to proceed with responding to the access request and the message to disregard the access request is received within a given time period, discarding the access request.

6. The method of claim 1 further comprises:

determining, by the storage unit, how many other storage units have a copy of an access control list, wherein the storage unit has one copy of the access control list; and

when less than n−k+1 storage units of the set of storage units have the copy of the access control list, sending the copy of the access control list to a first other storage unit of the set of storage units, wherein “n” represents a total number of encoded data slices in the set of encoded data slices and “k” represents a decode threshold number of encoded data slices of the set of encoded data slices that are needed to decode and recover the data segment, wherein the storage unit is one of the n−k+1 storage units.

7. The method of claim 1 further comprises:

upon receiving the message to proceed with responding to the access request, verifying, by another storage unit of the set of storage units, that the user device is authorized to access the set of encoded data slices as requested in the access request;

when verified, processing, by the other storage unit, the access request; and

when the access is not verified, sending, by the other storage unit, a conflict message to the set of storage units.

8. The method of claim 7 further comprises:

receiving, by a second other storage unit of the set of storage units, the conflict message prior to responding to the access request; and

in response to the conflict message, discarding, by the second other storage unit, the access request.

9. A non-transitory computer readable storage medium comprises:

at least one memory section that stores operational instructions that, when executed by one or more processing modules of one or more computing devices of a dispersed storage network (DSN), causes the one or more computing devices to:

receive, by storage units of a set of storage units, an access request regarding a set of encoded data slices from a user device, wherein a data object is partitioned to produce a plurality of segments that includes a data segment and another data segment, wherein the data segment is dispersed storage error encoded to produce the set of encoded data slices that are stored in first storage units of the set of storage units, wherein the another data segment is dispersed storage error encoded to produce another set of encoded data that are stored in second storage units of the set of storage units that are different than the first storage units of the set of storage units;

process access control information associated with the access request to determine whether access to the data object is on a data segment by data segment basis;

based on a determination that access to the data object is on the data segment by data segment basis, interpret, by a storage unit of the storage units, to determine whether the user device is authorized to access the set of encoded data slices as requested in the access request;

when the storage unit determines that the user device is authorized to access the set of encoded data slices as requested in the access request, identify the first storage units of the set of storage units, and send, by the storage unit, a message to proceed with responding to the access request to the first storage units of the set of storage units; and

when the storage unit determines that the user device is not authorized to access the set of encoded data slices as requested in the access request, identify the first storage units of the set of storage units, and send, by the storage unit, a message to disregard the access request to the first storage units of the set of storage units.

10. The non-transitory computer readable storage medium of claim 9 , wherein the one or more processing modules functions to execute the operational instructions stored by the at least one memory section to cause the one or more computing devices of the DSN to interpret by:

accessing a local copy of an access control list that includes a listing of user devices and their corresponding authorization to access data objects.

11. The non-transitory computer readable storage medium of claim 9 further comprises:

the at least one memory section stores further operational instructions that, when executed by the one or more processing modules, causes the one or more computing devices of the DSN to: determine the storage unit in accordance with a predetermined assignment, as a first storage unit of the storage units to receive and process the access request, or a distributed allocation of interpreting requests based on type of requests or based on user device identifiers.

12. The non-transitory computer readable storage medium of claim 9 further comprises:

the at least one memory section stores further operational instructions that, when executed by the one or more processing modules, causes the one or more computing devices of the DSN to:

store a copy of an access control list by n−k+1 storage units of the set of storage units, wherein “n” represents a total number of encoded data slices in the set of encoded data slices and “k” represents a decode threshold number of encoded data slices of the set of encoded data slices that are needed to decode and recover the data segment, wherein the storage unit is one of the n−k+1 storage units.

13. The non-transitory computer readable storage medium of claim 9 further comprises:

the at least one memory section stores further operational instructions that, when executed by the one or more processing modules, causes the one or more computing devices of the DSN to:

when neither of the message to proceed with responding to the access request and the message to disregard the access request is received within a given time period, discard the access request.

14. The non-transitory computer readable storage medium of claim 9 further comprises:

the at least one memory section stores further operational instructions that, when executed by the one or more processing modules, causes the one or more computing devices of the DSN to:

determine, by the storage unit, how many other storage units have a copy of an access control list, wherein the storage unit has one copy of the access control list; and

when less than n−k+1 storage units of the set of storage units have the copy of the access control list, send the copy of the access control list to a first other storage unit of the set of storage units, wherein “n” represents a total number of encoded data slices in the set of encoded data slices and “k” represents a decode threshold number of encoded data slices of the set of encoded data slices that are needed to decode and recover the data segment, wherein the storage unit is one of the n−k+1 storage units.

15. The non-transitory computer readable storage medium of claim 9 further comprises:

the at least one memory section stores further operational instructions that, when executed by the one or more processing modules, causes the one or more computing devices of the DSN to:

upon receiving the message to proceed with responding to the access request, verify, by another storage unit of the set of storage units, that the user device is authorized to access the set of encoded data slices as requested in the access request;

when verified, process, by the other storage unit, the access request; and

when the access is not verified, send, by the other storage unit, a conflict message to the set of storage units.

16. The non-transitory computer readable storage medium of claim 15 further comprises:

the at least one memory section stores still further operational instructions that, when executed by the one or more processing modules, causes the one or more computing devices of the DSN to:

receive, by a second other storage unit of the set of storage units, the conflict message prior to responding to the access request; and

in response to the conflict message, discard, by the second other storage unit, the access request.