# US 2019/0171394 A1 · Temporary enrollment in anonymously obtained credentials

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0171394 A1
- Document ID: US20190171394A1
- Status: Published application
- Kind: A1
- Application number: 16/256,012
- Filed: 2019-01-24
- Published: 2019-06-06
- Earliest claimed: 2016-03-29
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: Jason K. Resch; Mark D. Seaborn; Ilya Volvovski
- Web page: https://patentgrep.com/patent/US20190171394A1

## CPC

- G06F 3/0619: {in relation to data integrity, e.g. data losses, bit errors}
- G06F 3/0604: {Improving or facilitating administration, e.g. storage management}
- G06F 3/061: {Improving I/O performance}
- G06F 3/0611: {in relation to response time}
- G06F 3/0631: {by allocating resources to storage systems}
- G06F 3/0635: {by changing the path, e.g. traffic rerouting, path reconfiguration}
- G06F 3/064: {Management of blocks}
- G06F 3/0644: {Management of space entities, e.g. partitions, extents, pools}
- G06F 3/0647: {Migration mechanisms}
- G06F 3/0659: {Command handling arrangements, e.g. command buffers, queues, command scheduling}
- G06F 3/067: {Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]}
- G06F 8/65: Updates (security arrangements therefor G06F21/57)
- G06F 9/485: {Task life-cycle, e.g. stopping, restarting, resuming execution (G06F9/4881 takes precedence)}
- G06F 9/4881: {Scheduling strategies for dispatcher, e.g. round robin, multi-level priority queues}
- G06F 11/1076: {Parity data used in redundant arrays of independent storages, e.g. in RAID systems}
- G06F 11/1092: {Rebuilding, e.g. when physically replacing a failing disk}
- G06F 21/31: User authentication
- H03M 13/05: using block codes, i.e. a predetermined number of check bits joined to a predetermined number of information bits {(H03M13/2906 takes precedence)}
- H04L 61/10: of different types
- H04L 61/50: Address allocation
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/104: {Grouping of entities}
- H04L 63/108: {when the policy decisions are valid for a limited amount of time}
- H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
- H04L 67/56: Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54)
- G06F 2221/2133: Verifying human interaction, e.g., Captcha
- H03M 13/1515: {Reed-Solomon codes}
- H03M 13/373: {with erasure correction and erasure determination, e.g. for packet loss recovery or setting of erasures for the decoding of Reed-Solomon codes}
- H03M 13/616: {Matrix operations, especially for generator matrices or check matrices, e.g. column or row permutations}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H03M: CODING; DECODING; CODE CONVERSION IN GENERAL (using fluidic means F15C4/00; optical analogue/digital converters G02F7/00; coding, decoding or code conversion, specially adapted for particular applications, see the relevant subclasses, e.g. G01D, G01R, G06F, G06T, G09G, G10L, G11B, G11C, H04B, H04L, H04M, H04N; ciphering or deciphering for cryptography or other purposes involving the need for secrecy G09C)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method begins by determining, by an authenticated device of a dispersed storage network (DSN), whether an access request from a requesting device is affiliated with an anonymous user or an authenticated user. When the requesting device is affiliated with the anonymous user, the method continues by determining, by the authenticated device, status of the anonymous user where the status of the anonymous user includes one of minimal threat, non-minimal threat, and significant threat. The method continues by processing, by the authenticated device, the access request in accordance with the status of the anonymous user.

## Claims

### Claim 1

A method comprises:
determining, by an authenticated device of a dispersed storage network (DSN), whether an access request from a requesting device is affiliated with an anonymous user or an authenticated user;
when the requesting device is affiliated with the anonymous user, determining, by the authenticated device, status of the anonymous user, wherein the status of the anonymous user includes one of minimal threat, non-minimal threat, and significant threat; and
processing, by the authenticated device, the access request in accordance with the status of the anonymous user.

### Claim 2 (depends on 1)

The method of claim 1 further comprises:
when the requesting device is affiliated with the authenticated user, utilizing, by the authenticated device, trusted credentials of the authenticated user to process the access request.

### Claim 3 (depends on 1)

The method of claim 1, wherein when the status of the anonymous user is of the minimal threat to the DSN:
granting, by the authenticated device, temporary credentials and temporary access privileges to the anonymous user for use by the requesting device; and
processing, by the authenticated device, the access request in accordance with the temporary credentials and the temporary access privileges.

### Claim 4 (depends on 1)

The method of claim 1, wherein when the status of the anonymous user is of non-minimal threat to the DSN:
denying the access request; and
reducing a rate of granting temporary credentials and temporary access privileges to anonymous users.

### Claim 5 (depends on 1)

The method of claim 1, wherein when the status of the anonymous user is of a significant threat to the DSN:
suspending non-authenticated users access to the DSN.

### Claim 6 (depends on 1)

The method of claim 1, wherein the determining the status comprises:
verifying possession of an Internet Protocol (IP) address;
verifying favorable execution of a computationally intensive challenge or memory intensive challenge; and
verifying anonymous user is human.

### Claim 7 (depends on 6)

The method of claim 6, wherein the verifying the possession of the Internet Protocol (IP) address comprises:
establishing a transmission control protocol (TCP) connection.

### Claim 8 (depends on 6)

The method of claim 6, wherein the verifying the anonymous user is human comprises:
successful execution of a completely automated public turing test to tell computers and humans apart (CAPTCHA) test.

### Claim 9 (depends on 1)

The method of claim 1 further comprises:
when the authenticated device is a dispersed storage (DS) processing unit, processing the access request by:
converting the access request into a set of storage unit requests;
signing each storage unit request of the set of storage unit requests using trusted credentials of the authenticated device to produce a set of signed requests; and
sending the set of signed requests to a set of storage units, wherein the set of storage units process the set of signed requests in accordance with trusted credential procedures.

### Claim 10

An authenticated device of a dispersed storage network (DSN) comprises:
memory;
an interface; and
a processing module operably coupled to the memory and the interface, wherein the processing module is operable to:
determine whether an access request from a requesting device is affiliated with an anonymous user or an authenticated user;
when the requesting device is affiliated with the anonymous user, determine status of the anonymous user, wherein the status of the anonymous user includes one of minimal threat, non-minimal threat, and significant threat; and
process the access request in accordance with the status of the anonymous user.

### Claim 11 (depends on 10)

The authenticated device of claim 10, wherein the processing module is operable to:
when the requesting device is affiliated with the authenticated user, utilize trusted credentials of the authenticated user to process the access request.

### Claim 12 (depends on 10)

The authenticated device of claim 10, wherein when the status of the anonymous user is of the minimal threat to the DSN, the processing module is operable to:
grant temporary credentials and temporary access privileges to the anonymous user for use by the requesting device; and
process the access request in accordance with the temporary credentials and the temporary access privileges.

### Claim 13 (depends on 10)

The authenticated device of claim 10, wherein when the status of the anonymous user is of non-minimal threat to the DSN, the processing module is operable to:
deny the access request; and
reduce a rate of granting temporary credentials and temporary access privileges to anonymous users.

### Claim 14 (depends on 10)

The authenticated device of claim 10, wherein when the status of the anonymous user is of a significant threat to the DSN, the processing module is operable to:
suspend non-authenticated users access to the DSN.

### Claim 15 (depends on 10)

The authenticated device of claim 10, wherein the processing module is operable to determine the status by:
verifying possession of an internet protocol (IP) address;
verifying favorable execution of a computationally intensive challenge or memory intensive challenge; and
verifying anonymous user is human.

### Claim 16 (depends on 15)

The authenticated device of claim 15, wherein the processing module is operable to verify possession of an internet protocol (IP) address by:
establishing a transmission control protocol (TCP) connection.

### Claim 17 (depends on 15)

The authenticated device of claim 15, wherein the processing module is operable to verify anonymous user is human by:
interpreting a successful execution of a completely automated public turing test to tell computers and humans apart (CAPTCHA) test.

### Claim 18 (depends on 10)

The authenticated device of claim 10 further comprises:
when the authenticated device is a dispersed storage (DS) processing unit, the processing module is operable to process the access request by:
converting the access request into a set of storage unit requests;
signing each storage unit request of the set of storage unit requests using trusted credentials of the authenticated device to produce a set of signed requests; and
sending, via the interface, the set of signed requests to a set of storage units, wherein the set of storage units process the set of signed requests in accordance with trusted credential procedures.