International Business Machines Corporation

Amit H Lamba

Brian Frederick Ober

Mark Duane Seaborn

Akila Srinivasan

Jason K Resch

Praveen Viraraghavan

Andrew D Baptist

Ethan S Wozniak

Daniel J Scholl

Harsha Hegde

Michael E Lyons

Ying Zhao Guo

Shibhani Rai

Nicholas Georg Lange

A method for execution by a processing system includes determining to retrieve index data for a set of objects stored by an object storage system. An index type is selected from a plurality of index. A request message indicating a request for the index data of one of a plurality of indices stored by the object storage system corresponding to the index type is generated, and the request message is transmitted to the object storage system. The index data for the set of objects is received in a response message from the object storage system. The index data includes a plurality of pairs that each include a key and a value, where the keys correspond to the index type, and where the value of each pair includes metadata of one of the set of objects. The index data is stored in local memory in response to receiving the index data.

Retrieving index data from an object storage system

A data packet transits through a series of network nodes (a series of intermediate hops) while being transmitted from a source node to a destination node. A network node (router, gateway, server, or any network device) that handles the data packet, adds new information to the file header of the data packet. The new header information identifies the previous and next network nodes in the transmission path. The network node further validates information provided by a previous node, and generates further new header information that attests as to the validity of the information provided by the previous node. The network node secures and signs the new information cryptographically, and adds the new information to the file header. If a malicious actor attempts to tamper with the data packet, or routing thereof, the secured header information renders such tampering discoverable, enabling performance of a responsive action.

Network transmission path verification

A method includes: receiving, by a computing device, input defining a custom storage class in a first dispersed storage network; receiving, by the computing device, input defining a data management rule in the first dispersed storage network; determining, by the computing device, a data object in the first dispersed storage network satisfies the data management rule; and moving, by the computing device and in response to the determining, the data object to a second dispersed storage network according to the custom storage class.

User-defined custom storage classes for hybrid-cloud and multicloud data management

Methods and systems for data governance in a dispersed storage network using bucket templates are disclosed. A method includes: creating, by a computing device, a bucket template in a dispersed storage network (DSN) based on a first request, the bucket template including at least a first bucket parameter and at least one allowed value for the first bucket parameter; receiving, by the computing device, a second request to create a bucket in the DSN, the second request including at least a first value for the first bucket parameter; and creating, by the computing device, the bucket based on the first value for the first bucket parameter in the second request and the at least one allowed value for the first bucket parameter in the bucket template.

Data governance in a dispersed storage network using bucket templates

A computer-implemented method includes receiving a plurality of storage requests to store a plurality of objects in a dispersed storage network. The computer-implemented method further includes transforming each object in the plurality of objects into a set of error encoded slices. The computer-implemented method further includes dispersing each error encoded slice in each set of error encoded slices to a memory zone of a distinct storage unit. The computer-implemented method further includes co-locating two or more error encoded slices in a common memory zone of a storage unit based, at least in part, on an expiry time associated with the two or more encoded slices. The computer-implemented method further includes logically deleting the common memory zone of the storage unit after all error encoded slices stored in the common memory zone have expired.

Logical deletions in append only storage devices

A method for execution by a computing device includes determining a set of actor parties required to authorize a change of protection status of a stored resource from a protected status to an unprotected status. A minimum quorum is determined for each of the set of actor parties. A plurality of authorizations to change the protection status of the resource to the unprotected status are received from a plurality of requestors via the network. A plurality of subsets of the plurality of requestors corresponding to the set of actor parties are identified. The protection status of the resource is set to the unprotected status in response to determining, for every one of the set of actor parties, that a number of requestors in a corresponding one of the plurality of subsets is greater than or equal to the minimum quorum for the one of the set of actor parties.

Authorizing modification of resources

A computing device identifies and classify errors detected between the client application and the computing service, maintains service specific statistics across all communication points associated with the computing service, and stores the statistics within a metric data store. The computing device also provides an interface for introspecting the health of the computing service via metrics stored within the metric data store, monitors the health of the computing service via the metric data store, and assigns an operational state to the computing device based on metrics stored with the metric data store. The computing device then determines how to optimally route the client request based on the operational state of the computing service and routes the client request to the computing service via the optimal route.

Client-side service routing mechanism

A method for execution by a dispersed storage and task (DST) processing unit includes queuing authorization requests, corresponding to received operation requests, in response to determining that first system utilization data indicates a first utilization level that compares unfavorably to a normal utilization threshold. A first batched authorization request that includes the queued authorization requests is generated for transmission to an Identity and Access Management (IAM) system in response to determining that the first request queue compares unfavorably to a first queue limit condition. A second queue limit condition that is different from the first queue limit condition is determined based on second system utilization data. A second batched authorization request that includes a second plurality of authorization requests of a second request queue is generated in response to determining that the second request queue compares unfavorably to the second queue limit condition.

Dynamic authorization batching in a dispersed storage network

A method begins with a computing device of a distributed storage network (DSN) being designated to process a write request from a Decentralized, or Distributed, Agreement Protocol (DAP) and continues with the computing device retrieving a current policy for the storage units (SUs) associated with the write request, where the current policy specifies the current connectivity for the SUs. The method continues by using the current policy to configure a data structure to process the write request, where the data structure is based on scaling triggers and a load balancing scheme. The method continues with the data structure incorporating a primary queue and scaling the addition of secondary queues based on the scaling triggers and/or the load balancing scheme.

Scaling distributed queues in a distributed storage network

A processing module of a memory storage unit includes an interface configured to interface and communicate with a communication system, one or more memory devices, and processing circuitry operably coupled to the interface and to the memory that is configured to receive an access request from a distributed storage network (DSN) client and determine whether a quality of service (QoS) identity for the DSN client is associated with the access request. Based on a determination that a QoS identity is associated with the access request, the processing module determines a QoS level associated with the access request, where the QoS level is based at least in part on the QoS identity that is associated with the access request. The processing module maps the QoS level to a storage layer priority for the access request and transmits the storage layer priority for execution by at least one of the one or more memory devices.

Growing community of inventors

Buffalo Grove, IL, United States of America

Amit H Lamba