Security checks for proxied requests
View Patent ↗A computer readable storage device of a storage unit of a dispersed storage network (DSN) comprises a first memory section and a second memory section. The first memory section stores operational instructions that cause a processing module of the storage unit to transition storage of encoded data slices from storage based on a previous version of a distributed agreement protocol (DAP) to storage based on a new version of the DAP. The second memory section stores operational instructions that cause the processing module to, during the transitioning of storage of the encoded data slices, receive a proxied data access request from another storage unit, determine whether the other storage unit is an authentic storage unit, and when the other storage unit is the authentic storage unit, process the proxied data access request to produce a data access response.
1. A computer readable storage device comprises:
a first memory section for storing operational instructions that, when executed by a processing module of a storage unit of a dispersed storage network (DSN), causes the processing module to:
transition storage of one or more groups of encoded data slices from storage based on a previous version of a distributed agreement protocol to storage based on a new version of the distributed agreement protocol; and
a second memory section for storing operational instructions that, when executed by the processing module of the storage unit, causes the processing module to:
while transitioning storage of the one or more groups of encoded data slices:
receive a proxied data access request regarding an encoded data slice from another storage unit of the DSN;
determine whether the other storage unit is an authentic storage unit of the DSN based on at least one of: the encoded data slice, the previous version of the distributed agreement protocol, and the new version of the distributed agreement protocol;
when the other storage unit is the authentic storage unit, process the proxied data access request to produce a data access response; and
send the data access response to the other storage unit.
2. The computer readable storage device of claim 1 , wherein the second memory section stores operational instructions that, when executed by the processing module of the storage unit, causes the processing module to determine whether the other storage unit is the authentic storage unit by:
determining the other storage unit is part of the same vault as the storage unit.
3. The computer readable storage device of claim 1 , wherein the second memory section stores operational instructions that, when executed by the processing module of the storage unit, causes the processing module to determine whether the other storage unit is the authentic storage unit by:
determining the encoded data slice is mapped to the other storage unit based on the previous version of the distributed agreement protocol.
4. The computer readable storage device of claim 1 , wherein the second memory section stores operational instructions that, when executed by the processing module of the storage unit, causes the processing module to determine whether the other storage unit is the authentic storage unit by:
determining that an ongoing migration task from the other storage unit to the storage unit is active.
5. The computer readable storage device of claim 4 , wherein the second memory section stores further operational instructions that, when executed by the processing module of the storage unit, causes the processing module to determine the ongoing migration task by one or more of:
querying a DSN managing unit;
determining the storage unit is concurrently using both the old and new distributed agreement protocol; and
receiving a message indicating to use the new distributed agreement protocol for data access requests.
6. The computer readable storage device of claim 1 , wherein the second memory section stores operational instructions that, when executed by the processing module of the storage unit, causes the processing module to determine whether the other storage unit is the authentic storage unit by:
determining the encoded data slice is mapped to the storage unit based on the new version of the distributed agreement protocol.
7. The computer readable storage device of claim 1 further comprises:
a third memory section for storing operational instructions that, when executed by the processing module of the storage unit, causes the processing module to:
when the other storage unit is not the authentic storage unit:
deny the proxied data access request;
when the other storage unit is the authentic storage unit:
identify a second storage unit based on the encoded data slice and the previous distributed agreement protocol; and
send a request to the second storage unit to verify the proxied data access request;
when verified, process the request and send a response to the second storage unit.
8. The computer readable storage device of claim 1 further comprises:
a fourth memory section for storing operational instructions that, when executed by the processing module of the storage unit, causes the processing module to:
receive the new version of the distributed agreement protocol and maintain the previous version of a distributed agreement protocol for processing data access requests regarding the one or more groups of encoded data slices during the transition of storage; and
when the transition of storage is complete, utilize the new version of a distributed agreement protocol for processing data access requests regarding the one or more groups of encoded data slices.