# US 10,120,569 B2 · Dispersed storage system with identity unit selection and methods for use therewith

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,120,569 B2
- Document ID: US10120569B2
- Status: Granted
- Kind: B2
- Application number: 14/457,907
- Filed: 2014-08-12
- Published: 2015-04-09
- Granted: 2018-11-06
- Earliest claimed: 2013-10-03
- Assignees: International Business Machines Corporation
- Applicants: Cleversafe, Inc.
- Inventors: Wesley Leggette; Jason K. Resch; Eric Gunnar Smith
- Web page: https://patentgrep.com/patent/US10120569B2

## CPC

- G06F 3/0604: {Improving or facilitating administration, e.g. storage management}
- G06F 3/061: {Improving I/O performance}
- G06F 3/0611: {in relation to response time}
- G06F 3/0619: {in relation to data integrity, e.g. data losses, bit errors}
- G06F 3/0622: {in relation to access}
- G06F 3/0635: {by changing the path, e.g. traffic rerouting, path reconfiguration}
- G06F 3/0637: {Permissions}
- G06F 3/064: {Management of blocks}
- G06F 3/0647: {Migration mechanisms}
- G06F 3/0655: {Vertical data movement, i.e. input-output transfer; data movement between one or more hosts and one or more storage devices}
- G06F 3/0665: {at area level, e.g. provisioning of virtual or logical volumes}
- G06F 3/067: {Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]}
- G06F 3/0689: {Disk arrays, e.g. RAID, JBOD}
- G06F 9/4881: {Scheduling strategies for dispatcher, e.g. round robin, multi-level priority queues}
- G06F 11/1076: {Parity data used in redundant arrays of independent storages, e.g. in RAID systems}
- G06F 12/1458: {by checking the subject access rights}
- G06F 21/31: User authentication
- G06F 21/6272: {by registering files or documents with a third party}
- H04L 67/1001: for accessing one among a plurality of replicated servers
- H04L 67/1095: Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
- H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
- H04L 67/145: avoiding end of session, e.g. keep-alive, heartbeats, resumption message or wake-up for inactive or interrupted session
- G06F 3/0682: {Tape device}
- G06F 16/10: File systems; File servers
- G06F 16/182: Distributed file systems
- G06F 2211/1028: Distributed, i.e. distributed RAID systems with parity
- G06F 2212/1052: Security improvement
- G06F 2212/154: Networked environment
- G06F 2221/2149: Restricted operating environment
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method for execution by one or more processing modules of a dispersed storage network (DSN) includes receiving a data access request for at least one data segment stored in the DSN. One of a plurality of identity units is selected, based on the data access request. The method determines, via the selected one of the plurality of identity units, whether to allow the data access request. The data access request is processed, when the data access request is allowed via the selected one of the plurality of identity units.

## Claims

### Claim 1

A method for execution in a dispersed storage network (DSN), the method comprises:
receiving, by a first computing device of the DSN, a data access request relating to at least one set of encoded data slices stored in the DSN, the data access request including requesting entity credentials and a data request having an associated request type, wherein at least a threshold number of encoded data slices of the set of encoded data slices is required to recover a corresponding data segment;
selecting, by the first computing device, one of a plurality of identity units based on the requesting entity credentials;
determining, via the selected one of the plurality of identity units, whether to allow the data access request;
when the selected one of the plurality of identity units indicates that the data access request is allowed based on the requesting entity credentials, selecting, by the first computing device or a first storage unit of a set of storage units, another one of the plurality of identity units based on the data request;
determining, via the selected other one of the plurality of identity units, whether to allow the associated request type of the data request based on access control information for at least a portion of a vault identified by a vault identifier associated with the requesting entity credentials, wherein the at least a portion of the vault comprises a sub-vault associated with the requesting
entity credentials: and
when the associated request type of the data request is allowed by the selected other one of the plurality of identity units, performing, by the first storage unit, a first corresponding portion of the data access request.

### Claim 2 (depends on 1)

The method of claim 1 further comprises:
when the first computing device selects the another one of the plurality of identity units and when the associated request type of the data request is allowed by the selected other one of the plurality of identity units, issuing, by the first computing device, corresponding portions of the data access request to the set of storage units.

### Claim 3 (depends on 1)

The method of claim 1 further comprises:
receiving, by the first storage unit, the first corresponding portion of the data access request from the first computing device; and
in response to receiving the first corresponding portion of the data access request, selecting, by the first storage unit, the another one of the plurality of identity units.

### Claim 4 (depends on 1)

The method of claim 1 further comprises:
when the selected one of the plurality of identity units indicates that the data access request is not allowed, denying, by the first computing device or the first storage unit, the data access request.

### Claim 5 (depends on 1)

The method of claim 1 further comprising:
denying the data access request, when the data access request is not allowed via the selected one of the plurality of identity units.

### Claim 6

A dispersed storage and task (DST) processing unit comprises:
one or more network interfaces; a memory comprising instructions; and
processing circuitry in communication with the memory, wherein the processing circuitry executes the instructions to:
receive, via the one or more network interfaces, a data access request relating to at least one set of encoded data slices stored in a dispersed storage network (DSN), the data access request including requesting entity credentials and a data request, wherein at least a threshold number of encoded data slices of the set of encoded data slices is required to recover a corresponding data segment;
select one of a plurality of identity units based on the requesting entity credentials;
receive, from the selected one of the plurality of identity units, a first indication allowing the data access request based on the requesting entity credentials;
in response to the first indication, select another one of the plurality of identity units based on the data request;
receive, from the selected other one of the plurality of identity units, a second indication allowing the data access request based on access control information for at least a portion of a vault identified by a vault identifier associated with the requesting entity credentials, wherein the at least a portion of the vault comprises a sub-vault associated with the requesting entity
credentials: and
issue, via the one or more network interfaces, corresponding portions of the data access request to a set of storage units.

### Claim 7 (depends on 6)

The DST processing unit of claim 6, wherein the processing circuitry further executes the instructions to:
receive, via the one or more network interfaces, a favorable indication when a first storage unit of the set of storage units successfully executed a corresponding portion of the data access request; and
receive, via the one or more network interfaces, a denial message when the first storage unit did not successfully execute the corresponding portion of the data access request.

### Claim 8 (depends on 6)

The DST processing unit of claim 6, wherein the processing circuitry further executes the instructions to:
deny the data access request when the first indication is not received.

### Claim 9 (depends on 6)

The DST processing unit of claim 6, wherein the processing circuitry further executes the instructions to:
deny the data access request when the second indication is not received.

### Claim 10

A non-transitory computer readable storage medium comprises:
a first memory section that stores operational instructions that, when executed by a computing device of a dispersed storage network (DSN), causes the computing device to:
receive a data access request relating to at least one set of encoded data slices stored in the DSN, wherein the data access request includes requesting entity credentials and a data request having an associated request type; and
select one of a plurality of identity units based on the requesting entity credentials;
a second memory section that stores operational instructions that, when executed by the selected one of the plurality of identity units, causes the selected one of the plurality of identity units to determine whether to allow the data access request based on the requesting entity credentials;
a third memory section that stores operational instructions that, when executed by the computing device or a storage unit of the DSN, causes the computing device or the storage unit to, when the selected one of the plurality of identity units indicates that the data access request is allowed based on the requesting entity credentials, select another one of the plurality of identity units based on the data request;
a fourth memory section that stores operation instructions that, when executed by selected other one of the plurality of identity units, causes selected other one of the plurality of identity units to determine whether to allow the associated request type of the data request based on access control information for at least a portion of a vault identified by a vault identifier associated with the requesting entity credentials, wherein the at least a portion of the vault comprises a sub-vault associated with the requesting entity credentials; and
a fifth memory section that stores operational instructions that, when executed by the storage unit, causes the storage unit to, when the associated request type of the data request is allowed by the selected other one of the plurality of identity units, perform a first corresponding portion of the data access request.

### Claim 11 (depends on 10)

The non-transitory computer readable storage medium of claim 10 further comprises:
when the computing device selects the another one of the plurality of identity units and when the associated request type of the data request is allowed by the selected other one of the plurality of identity units, the third memory section further stores operational instructions that, when executed by the computing device, causes the computing device to issue corresponding portions of the data access request to a set of storage units.

### Claim 12 (depends on 10)

The non-transitory computer readable storage medium of claim 10 further comprises:
the third memory section that further stores operational instructions that, when executed by the storage unit, causes the storage unit to:
receive the first corresponding portion of the data access request from the computing device; and
in response to receiving the first corresponding portion of the data access request, select the another one of the plurality of identity units.

### Claim 13 (depends on 10)

The non-transitory computer readable storage medium of claim 10 wherein the first memory section that further stores operational instructions that, when executed by the computing device, causes the computing device to:
deny the data access request, when the data access request is not allowed via the selected one of the plurality of identity units.