# US 12,769,471 B2 · Access control lists for a storage network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,769,471 B2 - Document ID: US12769471B2 - Status: Granted - Kind: B2 - Application number: 18/942,201 - Filed: 2024-11-08 - Published: 2025-02-27 - Granted: 2026-10-20 - Earliest claimed: 2012-06-05 - Assignees: Everpure, Inc. - Applicants: Pure Storage, Inc. - Inventors: Jason K. Resch; Wesley B. Leggette; Sebastien Vas - Web page: https://patentgrep.com/patent/US12769471B2 ## CPC - G06F 3/0644: {Management of space entities, e.g. partitions, extents, pools} - G06F 3/0611: {in relation to response time} - G06F 3/0631: {by allocating resources to storage systems} - G06F 3/0659: {Command handling arrangements, e.g. command buffers, queues, command scheduling} - G06F 3/067: {Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]} - H04L 63/101: {Access control lists [ACL]} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods and apparatus for storage pool tiering in a storage network. In an embodiment, a method executed by one or more processing modules of a storage network includes maintaining a storage network access control list (ACL) registry. The ACL registry includes a storage network sub-registry and one or more vault sub-registries, and each of the sub-registries includes one or more ACLs. The method further includes receiving a storage network access request from a requesting entity, identifying a request type of the storage network access request, and identifying the one or more ACLs of a sub-registry associated with the request type. The method continues with retrieving the one or more ACLs, identifying an ACL of the one or more ACLs based on an identifier associated with the requesting entity, and comparing the storage network access request to permissions of the identified ACL to determine whether the access request is authorized. ## Claims ### Claim 1 A method for execution by one or more processing modules of a storage network, the method comprising: maintaining a storage network access control list (ACL) registry, the ACL registry including a storage network sub-registry and one or more vault sub-registries, wherein each of the sub-registries includes one or more ACLs; receiving a storage network access request from a requesting entity; identifying a request type of the storage network access request; identifying the one or more ACLs of a sub-registry associated with the request type; retrieving the one or more ACLs; identifying an ACL, of the one or more ACLs, based on an identifier associated with the requesting entity; comparing the storage network access request to permissions of the identified ACL; determining, based on the permissions, that the storage network access request is authorized; and processing the storage network access request that is authorized. ### Claim 2 (depends on 1) The method of claim 1, wherein the storage network sub-registry includes information for authorizing storage network access requests for one or more of: creating a vault; deleting a vault; creating a storage pool; deleting a storage pool; creating a realm; or deleting a realm. ### Claim 3 (depends on 1) The method of claim 1, wherein a vault sub-registry of the one or more vault sub-registries includes information for authorizing vault level access requests for one or more of: a delete object request; an add object request; a modify object request; or a modify permissions request. ### Claim 4 (depends on 1) The method of claim 1, wherein the ACL registry further includes one or more storage pool sub-registries, wherein each of the one or more storage pool sub-registries includes one or more ACLs. ### Claim 5 (depends on 4) The method of claim 4, wherein a storage pool sub-registry of the one or more storage pool sub-registries includes information for authorizing storage pool level access requests for modifying a storage pool. ### Claim 6 (depends on 1) The method of claim 1, wherein retrieving the one or more ACLs includes: retrieving at least a decode threshold number of encoded data slices corresponding to the one or more ACLs; and decoding the at least a decode threshold number of encoded data slices to produce the one or more ACLs. ### Claim 7 (depends on 1) The method of claim 1, wherein maintaining the storage network ACL registry includes: receiving a write request for storing a new data object; determining a write authority of the requesting entity based on information contained in an ACL; determining that the requesting entity is authorized to issue the write request for the new data object based on the write authority of the requesting entity; and updating a vault sub-registry of the one or more vault sub-registries with updated ACL information regarding the new data object. ### Claim 8 (depends on 7) The method of claim 7, wherein determining that the requesting entity is authorized to issue the write request for the new data object includes extracting a signed certificate from the write request and verifying the signed certificate to establish authorization to issue the write request for the new data object and to update the vault sub-registry with updated ACL information regarding the new data object. ### Claim 9 (depends on 1) The method of claim 1, wherein an ACL includes one or more of: a realm universally unique identifier field; a login name field; a subject distinguished name field; a permissions field; a signer identification field; or a signature field. ### Claim 10 A computing device, comprising: at least one interface; memory that stores operational instructions; and a processing module operably coupled to the memory, wherein the processing module is configured to execute the operational instructions to: maintain a storage network access control list (ACL) registry, the ACL registry including a storage network sub-registry and one or more vault sub-registries, wherein each of the sub-registries includes one or more ACLs; receive, via the at least one interface, a storage network access request from a requesting entity; identify a request type of the storage network access request; identify the one or more ACLs of a sub-registry associated with the request type; retrieve, via the at least one interface, the one or more ACLs; compare the storage network access request to permissions of the identified ACL; determine based on the permissions, that the storage network access request is authorized; and processing the storage network access request that is authorized. ### Claim 11 (depends on 10) The computing device of claim 10, wherein the storage network sub-registry includes information for authorizing storage network access requests for one or more of: creating a vault; deleting a vault; creating a storage pool; deleting a storage pool; creating a realm; or deleting a realm. ### Claim 12 (depends on 10) The computing device of claim 10, wherein a vault sub-registry of the one or more vault sub-registries includes information for authorizing vault level access requests for one or more of: a delete object request; an add object request; a modify object request; or a modify permissions request. ### Claim 13 (depends on 10) The computing device of claim 10, wherein the ACL registry further includes one or more storage pool sub-registries, wherein each of the one or more storage pool sub-registries includes one or more ACLs. ### Claim 14 (depends on 13) The computing device of claim 13, wherein a storage pool sub-registry of the one or more storage pool sub-registries includes information for authorizing storage pool level access requests for modifying a storage pool. ### Claim 15 (depends on 10) The computing device of claim 10, wherein retrieving the one or more ACLs includes: retrieving, via the at least one interface, at least a decode threshold number of encoded data slices corresponding to the one or more ACLs; and decoding the at least a decode threshold number of encoded data slices to produce the one or more ACLs. ### Claim 16 (depends on 10) The computing device of claim 10, wherein the processing module is configured to execute the operational instructions to maintain the storage network ACL registry by: receiving, via the at least one interface, a write request for storing a new data object; determining a write authority of the requesting entity based on information contained in an ACL; determining that the requesting entity is authorized to issue the write request for the new data object based on the write authority of the requesting entity; and updating a vault sub-registry of the one or more vault sub-registries with updated ACL information regarding the new data object. ### Claim 17 (depends on 16) The computing device of claim 16, wherein determining that the requesting entity is authorized to issue the write request for the new data object includes extracting a signed certificate from the write request and verifying the signed certificate to establish authorization to issue the write request for the new data object and to update the vault sub-registry with updated ACL information regarding the new data object. ### Claim 18 (depends on 10) The computing device of claim 10, wherein an ACL includes one or more of: a realm universally unique identifier field; a login name field; a subject distinguished name field; a permissions field; a signer identification field; or a signature field. ### Claim 19 A non-transitory computer readable storage medium, comprising: at least one memory section that stores operational instructions that, when executed by one or more processing modules of a computing device of a storage network, cause the computing device to: maintain a storage network access control list (ACL) registry, the ACL registry including a storage network sub-registry and one or more vault sub-registries, wherein each of the sub-registries includes one or more ACLs; receive a storage network access request from a requesting entity; identify a request type of the storage network access request; identify the one or more ACLs of a sub-registry associated with the request type; retrieve the one or more ACLs; compare the storage network access request to permissions of the identified ACL; determine based on the permissions, that the storage network access request is authorized; and processing the storage network access request that is authorized. ### Claim 20 (depends on 19) The non-transitory computer readable storage medium of claim 19, wherein the storage network sub-registry includes information for authorizing storage network access requests for one or more of: creating a vault; deleting a vault; creating a storage pool; deleting a storage pool; creating a realm; or deleting a realm.