# US 11,909,418 B1 · Access authentication in a dispersed storage network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,418 B1 - Document ID: US11909418B1 - Status: Granted - Kind: B1 - Application number: 17/163,824 - Filed: 2021-02-01 - Granted: 2024-02-20 - Earliest claimed: 2005-09-30 - Assignees: Pure Storage, Inc. - Applicants: Pure Storage, Inc. - Inventors: Dustin M. Hendrickson; Manish Motwani - Web page: https://patentgrep.com/patent/US11909418B1 ## CPC - H03M 13/1515: {Reed-Solomon codes} - G06F 3/0608: {Saving storage space on storage systems} - G06F 3/0619: {in relation to data integrity, e.g. data losses, bit errors} - G06F 3/0622: {in relation to access} - G06F 3/064: {Management of blocks} - G06F 3/0644: {Management of space entities, e.g. partitions, extents, pools} - G06F 3/0652: {Erasing, e.g. deleting, data cleaning, moving of data to a wastebasket} - G06F 3/0659: {Command handling arrangements, e.g. command buffers, queues, command scheduling} - G06F 3/067: {Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]} - G06F 11/1076: {Parity data used in redundant arrays of independent storages, e.g. in RAID systems} - G06F 11/1092: {Rebuilding, e.g. when physically replacing a failing disk} - G06F 11/2094: {Redundant storage or storage space (G06F11/2056 takes precedence)} - H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - H04L 69/40: for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection (management of faults, events, alarms or notifications in data switching networks H04L41/06) - G06F 2201/805: Real-time - G06F 2211/1028: Distributed, i.e. distributed RAID systems with parity - H04L 2209/34: Encoding or coding, e.g. Huffman coding or error correction - H03M: CODING; DECODING; CODE CONVERSION IN GENERAL (using fluidic means F15C4/00; optical analogue/digital converters G02F7/00; coding, decoding or code conversion, specially adapted for particular applications, see the relevant subclasses, e.g. G01D, G01R, G06F, G06T, G09G, G10L, G11B, G11C, H04B, H04L, H04M, H04N; ciphering or deciphering for cryptography or other purposes involving the need for secrecy G09C) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computing device includes an interface configured to interface and communicate with a dispersed storage network (DSN), a memory that stores operational instructions, and a processing module operably coupled to the interface and memory such that the processing module, when operable within the computing device based on the operational instructions, is configured to perform various operations. The computing device is operable to receive a memory access request for a data object stored within the DSN, determine a realm for the memory access request, determine an authorization service for the realm and generate an authorization request for the memory access request. The computing device is further operable to transmit the authorization request to an authorization service, receive an authorization request response from the authorization service, determine whether the memory access request is authorized and process the memory access request. ## Claims ### Claim 1 A computing device comprising: an interface configured to interface and communicate with a storage network; memory that stores operational instructions; and a processing module operably coupled to the interface and to the memory, wherein the processing module, when operable within the computing device based on the operational instructions, is configured to: receive a memory access request for a data object stored within the storage network, wherein the data object is segmented into a plurality of data segments, wherein a data segment of the plurality of data segments is dispersed error encoded in accordance with dispersed error encoding parameters to produce a set of encoded data slices, wherein the set of encoded data slices are distributedly stored among a plurality of storage units, wherein a decode threshold number of encoded data slices are needed to recover the data segment; determine a realm for the memory access request, wherein a realm indicates an affiliation with one or more users; determine an authorization service for the realm, wherein the authorization service includes a third-party, wherein the third party is configured to provide authorization information for the realm; and for each storage unit of the plurality of storage units: generate an authorization request for the memory access request; transmit the authorization request to an authorization service; receive an authorization request response from the authorization service; determine, based on the authorization request response, whether the memory access request is authorized; and in response to a determination that the memory access request is authorized, process the memory access request. ### Claim 2 (depends on 1) The computing device of claim 1, wherein the memory access request includes at least one of: a user identifier (ID), an access type, a user password, a user realm indicator, a command, a data object name, a data object, a virtual storage network address, a performance indicator, a priority indicator, a security indicator, access request requirements, a vault ID, a storage network system element access request, a storage network resource request, a vault access request, and a record access request. ### Claim 3 (depends on 2) The computing device of claim 2, wherein, when the access type is at least one of a read access, a write access, a delete, a list, a list range and a check request. ### Claim 4 (depends on 2) The computing device of claim 2, wherein the command is at least one of a store command, a retrieve command, a delete command, or a list command. ### Claim 5 (depends on 1) The computing device of claim 1, wherein the realm is determined based on at least one of user information, realm information, an authorization table lookup, a received realm indicator, a user ID, a user password, a vault lookup and a table lookup. ### Claim 6 (depends on 1) The computing device of claim 1, wherein the memory access request is received from at least one of a user device, a storage processing unit, a storage integrity processing unit, a storage managing unit and a storage unit. ### Claim 7 (depends on 1) The computing device of claim 1, wherein a realm further includes information sufficient to indicate one or more storage network user devices. ### Claim 8 (depends on 1) The computing device of claim 1, wherein a realm further includes information sufficient to indicate at least one of an affiliation with a company, a team, a family, a work group, a social group, a community and a geographic region. ### Claim 9 (depends on 1) The computing device of claim 1, wherein determining the authorization service includes determining an identity or an address for authorization of the access request. ### Claim 10 (depends on 1) The computing device of claim 1, wherein an authorization service is an entity capable of providing authorization for the access request, wherein the authorization is at least one of information associated with the realm, an authorization table lookup, a vault lookup, a user ID, a user password, and information received in the access request. ### Claim 11 (depends on 1) The computing device of claim 1, wherein the authorization request includes at least one of a user ID, a user password, user information, realm information associated with a user, a command, a data object name, a virtual storage network address and a storage network processing module ID. ### Claim 12 A method for execution by one or more modules of one or more computing devices of a dispersed or storage network, the method comprising: receiving a memory access request for a data object stored within the storage network, wherein the data object is segmented into a plurality of data segments, wherein a data segment of the plurality of data segments is dispersed error encoded in accordance with dispersed error encoding parameters to produce a set of encoded data slices, wherein the set of encoded data slices are distributedly stored among a plurality of storage units (SUs), wherein a decode threshold number of encoded data slices are needed to recover the data segment; determining a realm for the memory access request, wherein a realm indicates an affiliation with one or more users; determining an authorization service for the realm, wherein the authorization service includes a third-party, wherein the third party is configured to provide authorization information for the realm; and for each storage unit of the plurality of storage units: generating an authorization request for the memory access request; transmitting the authorization request to an authorization service; receiving an authorization request response from the authorization service; determining, based on the authorization request response, whether the memory access request is authorized; and in response to a determination that the memory access request is authorized, processing the memory access request. ### Claim 13 (depends on 12) The method of claim 12, wherein the memory access request includes at least one of: a user identifier (ID), an access type, a user password, a user realm indicator, a command, a data object name, a data object, a virtual storage network address, a performance indicator, a priority indicator, a security indicator, access request requirements, a vault ID, a storage network system element access request, a storage network resource request, a vault access request, and a record access request. ### Claim 14 (depends on 13) The method of claim 13, wherein, when the access type is at least one of a read access, a write access, a delete, a list, a list range and a check request. ### Claim 15 (depends on 12) The method of claim 12, wherein the realm is determined based on at least one of user information, realm information, an authorization table lookup, a received realm indicator, a user ID, a user password, a vault lookup and a table lookup. ### Claim 16 (depends on 12) The method of claim 12, wherein memory access request is received from at least one of a user device, a storage processing unit, a storage integrity processing unit, a storage managing unit and a storage unit. ### Claim 17 (depends on 12) The method of claim 12, wherein a realm further includes information sufficient to indicate an affiliation with at least one of a company, a team, a family, a work group, a social group, a community and a geographic region. ### Claim 18 (depends on 12) The method of claim 12, wherein an authorization service is an entity capable of providing authorization for the access request, wherein the authorization is at least one of information associated with the realm, an authorization table lookup, a vault lookup, a user ID, a user password, and information received in the access request. ### Claim 19 (depends on 12) The method of claim 12, wherein the authorization request includes at least one of a user ID, a user password, user information, realm information associated with a user, a command, a data object name, a virtual storage network address and a storage network processing module ID. ### Claim 20 (depends on 12) The method of claim 12, wherein a realm further includes information sufficient to indicate one or more user devices.