Memory access using deterministic function and secure seed
A processing device implementing a storage unit is included in a distributed storage network (DSN) that uses employing one or more storage units to store encoded data slices. The storage unit receives an access request that includes a slice identifier associated with an encoded data slice stored in a particular distributed storage (DS) memory of the storage unit. The storage unit obtains a secure seed, and determines a memory range associated with the slice identifier by performing a deterministic function on the slice identifier using the secure seed as an input to the deterministic function. The storage unit identifies the particular DS memory as being associated with the memory range, and performs the access request using the particular DS memory.
1. A method for use in a processing device configured to implement a storage unit, the storage unit included in a distributed storage network (DSN) employing one or more storage units to store encoded data slices, the method comprising:
receiving, by the storage unit, an access request, the access request including a slice identifier associated with an encoded data slice stored in a particular distributed storage (DS) memory of the storage unit;
obtaining, by the storage unit, a secure seed;
determining, by the storage unit, a memory range associated with the slice identifier by performing a deterministic function on the slice identifier using the secure seed as an input to the deterministic function;
identifying, by the storage unit, the particular DS memory as being associated with the memory range; and
performing the access request using the particular DS memory.
2. The method of claim 1 , wherein obtaining the secure seed includes:
retrieving a previously generated secure seed from a secure memory in response to receiving the access request.
3. The method of claim 1 , wherein obtaining the secure seed includes:
generating the secure seed in response to receiving the access request; and
storing the secure seed in a secure memory.
4. The method of claim 1 , wherein obtaining the secure seed includes:
recovering the secure seed from a DS memory.
5. The method of claim 1 , further comprising:
performing the deterministic function on the slice identifier includes performing one of a hash based message authentication code function, a mask generating function, or a sponge function.
6. The method of claim 1 , further comprising:
selecting the deterministic function from a plurality of potential deterministic functions based on one or more of a predetermination, the slice identifier, a lookup, or a function identifier associated with the access request.
7. The method of claim 1 , wherein identifying the particular DS memory includes:
combining the memory range with a memory constant to produce a memory identifier identifying the particular DS memory.
8. A storage unit for use in a distributed storage network (DSN) employing one or more storage units to store encoded data slices, the storage unit comprising:
a processor and associated memory configured to implement a deterministic function module;
a plurality of distributed storage (DS) memories configured to store the encoded data slices;
an interface configured to receive an access request, the access request including a slice identifier associated with an encoded data slice stored in a particular DS memory of the storage unit;
the deterministic function module configured to:
obtain a secure seed;
determine a memory range associated with the slice identifier by performing a deterministic function on the slice identifier using the secure seed as an input to the deterministic function;
identify the particular DS memory as being associated with the memory range; and
the processor and associated memory further configured to:
perform the access request using the particular DS memory.
9. The storage unit of claim 8 , further comprising:
a secure memory; and
the deterministic function module being further configured to retrieve a previously generated secure seed from the secure memory.
10. The storage unit of claim 8 , further comprising:
a secure memory;
the deterministic function module being further configured to:
generate the secure seed in response to the access request; and
store the secure seed in a secure memory.
11. The storage unit of claim 8 , further comprising:
a secure memory; and
the deterministic function module being further configured to recover the secure seed from a DS memory included in the plurality of distributed storage (DS) memories.
12. The storage unit of claim 8 , the deterministic function module being further configured to:
perform the deterministic function on the slice identifier by using one of a hash based message authentication code function, a mask generating function, or a sponge function.
13. The storage unit of claim 8 , the deterministic function module being further configured to:
select the deterministic function from a plurality of potential deterministic functions based on one or more of a predetermination, the slice identifier, a lookup, or a function identifier associated with the access request.
14. The storage unit of claim 8 , wherein the deterministic function module is further configured to:
identify the particular DS memory by combining the memory range with a memory constant to produce a memory identifier identifying the particular DS memory.
15. A distributed storage network (DSN) memory for use in a distributed storage network (DSN), the DSN memory including:
a set of storage units storing encoded data slices, at least one storage unit included in a set of storage units includes:
a processor and associated memory configured to implement a deterministic function module;
a plurality of distributed storage (DS) memories configured to store the encoded data slices;
an interface configured to receive an access request, the access request including a slice identifier associated with an encoded data slice stored in a particular DS memory;
the deterministic function module configured to:
obtain a secure seed;
determine a memory range associated with the slice identifier by performing a deterministic function on the slice identifier using the secure seed as an input to the deterministic function;
identify the particular DS memory as being associated with the memory range; and
the processor and associated memory further configured to:
perform the access request using the particular DS memory.
16. The distributed storage network (DSN) memory of claim 15 , the at least one storage unit included in a set of storage units further including:
a secure memory;
the deterministic function module being further configured to:
generate the secure seed in response to the access request; and
store the secure seed in a secure memory.
17. The distributed storage network (DSN) memory of claim 15 , the at least one storage unit included in a set of storage units further including:
a secure memory; and
the deterministic function module being further configured to recover the secure seed from a DS memory included in the plurality of distributed storage (DS) memories.
18. The distributed storage network (DSN) memory of claim 15 , the deterministic function module being further configured to:
perform the deterministic function on the slice identifier by using one of a hash based message authentication code function, a mask generating function, or a sponge function.
19. The distributed storage network (DSN) memory of claim 15 , the deterministic function module being further configured to:
select the deterministic function from a plurality of potential deterministic functions based on one or more of a predetermination, the slice identifier, a lookup, or a function identifier associated with the access request.
20. The distributed storage network (DSN) memory of claim 15 , wherein the deterministic function module is further configured to:
identify the particular DS memory by combining the memory range with a memory constant to produce a memory identifier identifying the particular DS memory.