Distributed Storage Access Control Update via Data Slice Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current distributed storage and task processing systems face challenges in securely and reliably storing and retrieving large amounts of data across multiple locations while ensuring data integrity and tolerating failures without the need for redundant copies.
Innovation Solution
A distributed computing system that employs dispersed error encoding and decoding to split data into encoded slices, which are then stored and processed across multiple geographically dispersed execution units, allowing for secure, reliable storage and retrieval, and fault tolerance through pillar-based encoding and decoding schemes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored across multiple geographically dispersed locations, then data availability and fault tolerance are improved, but data security and integrity management become more complex
Solution Approach 1:
The patent segments data into multiple slices that are independently stored across different DST execution units. Each slice is associated with specific access control information, allowing fine-grained control over distributed data without requiring centralized management of the entire data set. This segmentation enables fault tolerance while simplifying access control management at each location.
Solution Approach 2:
The patent introduces a new dimension of access control by associating access control information directly with data slices rather than managing access at the centralized level. This dimensional shift from centralized to distributed access control enables both improved fault tolerance and simplified management by pushing control capabilities to the edge of the distributed system.
2Reliability
If data is split into encoded slices and distributed across multiple units, then fault tolerance and data integrity are improved, but storage and retrieval complexity increase
Solution Approach 1:
The patent performs preliminary encoding of data into slices and pre-associates access control information with each slice before distribution. This preliminary action ensures that data integrity is built-in from the start, and access control mechanisms are already in place, reducing the complexity of real-time encoding and decoding operations during storage and retrieval.
Solution Approach 2:
The patent creates encoded copies of data slices that can be independently stored and retrieved. Each copy contains necessary access control information, eliminating the need for complex centralized verification during retrieval operations. This copying approach simplifies the decoding process while maintaining data integrity across distributed units.
3Reliability
If access control information is updated for distributed data slices, then data security is improved, but system overhead and processing time increase
Solution Approach 1:
The patent enables each DST execution unit to independently manage and update its own access control information for stored data slices. This self-service capability eliminates the need for centralized coordination during access control updates, significantly reducing system overhead and processing time while maintaining strong data security through distributed control.
Solution Approach 2:
The patent implements local access control management at each DST execution unit, allowing security updates to be performed independently at each location based on local requirements. This local quality approach enables parallel updates across multiple units, reducing overall update time while maintaining consistent security standards throughout the distributed system.
Data Source
AI summary
A method begins by a dispersed storage (DS) processing module of a storage unit receiving a write request for storing a data object that includes updated access control list (ACL) information. The method continues with the DS processing module determining whether the data object is a new data object or a revised version of an existing data object and determining write authority of the requesting entity based on information contained in a locally stored access control list. When the write request is regarding the revised version of the existing data object and the write authority includes authorization to issue the write request for the revised version of the existing data object and authorization to issue the updated ACL information, the method continues with the DS processing module storing the revised version of the existing data object and updating the access control list based on the updated ACL information.