IP Library Granted Patent US 9,158,625
Granted Patent B2
US 9,158,625 · App. 14/480,882 · Granted Oct 13, 2015

Acquiring a trusted set of encoded data slices

View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 9,158,625
App. No.
14/480,882
Granted
Oct 13, 2015
Kind
B2
Abstract

A method for execution by a computing device, the method begins in response to a data segment access request, generating a set of access requests regarding a set of encoded data slices. The method continues by sending a subset of the access requests to storage units of a dispersed storage network (DSN) and sending an access request of the set of access requests to a trusted storage unit of the DSN. The method continues by receiving a trusted encoded data slice from the trusted storage unit and receiving a subset of encoded data slices from the storage units, wherein the trusted encoded data slice is utilized to authenticate the subset of encoded data slices and when the subset of encoded data slices are authenticated, the trusted encoded data slice and the subset of encoded data slices are decoded to recover the data segment.

Claims (59)

1. A method for execution by a computing device, the method comprises:

in response to a data segment access request, generating a set of access requests regarding a set of encoded data slices, wherein a data segment of data is encoded using a dispersed storage error coding function to produce a set of encoded data slices and wherein a decode threshold number of encoded data slices corresponds to a minimum number of encoded data slices required to recover the data segment;

sending a subset of the access requests to storage units of a dispersed storage network (DSN);

sending an access request of the set of access requests to a trusted storage unit of the DSN;

receiving a trusted encoded data slice from the trusted storage unit;

receiving a subset of encoded data slices from the storage units;

utilizing the trusted encoded data slice to authenticate the subset of encoded data slices; and

when the subset of encoded data slices are authenticated, decoding the trusted encoded data slice and the subset of encoded data slices to recover the data segment.

2. The method of claim 1 further comprises:

comparing an integrity value of the trusted encoded data slice with integrity values of encoded data slices of the subset of encoded data slices to authenticate the subset of encoded data slices.

3. The method of claim 1 further comprises:

decoding the threshold number of encoded data slices using different combinations of the subset of encoded data slices with the trusted encoded data slice to produce potential recovered data segments;

calculating integrity values for the potential recovered data segments; and

when the integrity values for at least some of the potential recovered data segments substantially match, indicating that corresponding potential recovered data segments are authenticated.

4. The method of claim 1 further comprises:

determining a trusted data segment integrity value based on the trusted encoded data slice; and

comparing the trusted data segment integrity value with a calculated data segment integrity value that is derived from decoding the decode threshold number of encoded data slices and the received subset of encoded data slices to indicate that the received subset of encoded data slices are authenticated.

5. A computing device comprises:

an interface;

memory;

a processing module operably coupled to the interface and the memory, wherein the processing module is operable to:

in response to a data segment access request, generate a set of access requests regarding a set of encoded data slices, wherein a data segment of data is encoded using a dispersed storage error coding function to produce a set of encoded data slices and wherein a decode threshold number of encoded data slices corresponds to a minimum number of encoded data slices required to recover the data segment;

send a subset of access requests to storage units of a dispersed storage network (DSN);

send an access request of the set of access requests to a trusted storage unit of the DSN;

receiving a trusted encoded data slice from the trusted storage unit;

receiving a subset of encoded data slices from the storage units;

utilizing the trusted encoded data slice to authenticate the subset of encoded data slices; and

when the subset of encoded data slices are authenticated, decoding the trusted encoded data slice and the subset of encoded data slices to recover the data segment.

6. The computing device of claim 5 , wherein the processing module is further operable to:

compare an integrity value of the trusted encoded data slice with integrity values of encoded data slices of the subset of encoded data slices to authenticate the subset of encoded data slices.

7. The computing device of claim 5 , wherein the processing module is further operable to:

decode the threshold number of encoded data slices using different combinations of the subset of encoded data slices with the trusted encoded data slice to produce potential recovered data segments;

calculate integrity values for the potential recovered data segments; and

when the integrity values for at least some of the potential recovered data segments substantially match, indicate that corresponding potential recovered data segments are authenticated.

8. The computing device of claim 5 , wherein the processing module is further operable to:

determine a trusted data segment integrity value based on the trusted encoded data slice; and

compare the trusted data segment integrity value with a calculated data segment integrity value that is derived from decoding the decode threshold number of encoded data slices and the received subset of encoded data slices to indicate that the received subset of encoded data slices are authenticated.

9. A computer readable storage device comprises;

a first memory section storing operational instructions that, when executed by a computing device, causes the computing device to:

in response to a data segment access request, generate a set of access requests regarding a set of encoded data slices, wherein a data segment of data is encoded using a dispersed storage error coding function to produce a set of encoded data slices and wherein a decode threshold number of encoded data slices corresponds to a minimum number of encoded data slices required to recover the data segment;

a second memory section storing operational instructions that, when executed by a computing device, causes the computing device to:

send a subset of the access requests to storage units of a dispersed storage network (DSN);

send an access request of the set of access requests to a trusted storage unit of the DSN;

a third memory section storing operational instructions that, when executed by a computing device, causes the computing device to:

receive a trusted encoded data slice from the trusted storage unit;

receive a subset of encoded data slices from the storage units;

a fourth memory section storing operational instructions that, when executed by a computing device, causes the computing device to:

utilize the trusted encoded data slice to authenticate the subset of encoded data slices; and

a fifth memory section storing operational instructions that, when executed by a computing device, causes the computing device to:

when the subset of encoded data slices are authenticated, decode the trusted encoded data slice and the subset of encoded data slices to recover the data segment.

10. The computer readable storage device of claim 9 further comprises:

comparing an integrity value of the trusted encoded data slice with integrity values of encoded data slices of the subset of encoded data slices to authenticate the subset of encoded data slices.

11. The computer readable storage device of claim 9 further comprises:

decoding the threshold number of encoded data slices using different combinations of the subset of encoded data slices with the trusted encoded data slice to produce potential recovered data segments;

calculating integrity values for the potential recovered data segments; and

when the integrity values for at least some of the potential recovered data segments substantially match, indicating that corresponding potential recovered data segments are authenticated.

12. The computer readable storage device of claim 9 further comprises:

determining a trusted data segment integrity value based on the trusted encoded data slice; and

comparing the trusted data segment integrity value with a calculated data segment integrity value that is derived from decoding the decode threshold number of encoded data slices and the received subset of encoded data slices to indicate that the received subset of encoded data slices are authenticated.

Assignments (4)
CORRECTIVE ASSIGNMENT TO CORRECT THE 9992063 AND 10334045 LISTED IN ERROR PREVIOUSLY RECORDED ON REEL 049556 FRAME 0012. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNOR HEREBY CONFIRMS THE ASSIGNMENT. Recorded Jan 14, 2020
From: INTERNATIONAL BUSINESS MACHINES CORPORATION
To: PURE STORAGE, INC.
Reel/Frame 052205/0705 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jun 21, 2019
From: INTERNATIONAL BUSINESS MACHINES CORPORATION
To: PURE STORAGE, INC.
Reel/Frame 049556/0012 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded May 13, 2016
From: CLEVERSAFE, INC.
To: INTERNATIONAL BUSINESS MACHINES CORPORATION
Reel/Frame 038687/0596 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Apr 18, 2016
From: GRUBE, GARY W.; MARKISON, TIMOTHY W.
To: CLEVERSAFE, INC.
Reel/Frame 038309/0327 →