Improved UX for client initiated unsealing

[jacobheun]

Note: Unless significant demand for this arises, this is not something we're actively looking to implement in the near term. This issue is for exploratory discussions only.

Context

As part of discussions in #1002 to clarify the lifecycle of indexes so that we can improve retrievability of data through index integrity, the topic came up of client initiated unsealing of data. This post aims to discuss what a reasonable UX/flow for this might look like, as well as its feasibility. Support for retrieval initiated unsealing exists today, but the known challenges make it impractical and so it is effectively blocked (extremely high unseal prices, etc). Practically speaking, if I want my unsealed data back today, I need to directly contact my SP.

Is it feasible for us to support this dynamically, and what needs to be in place for it to be reasonable for both clients and SPs?

Scenario - Long term cold storage

Let's say I am a client interested in storing some backups of my data, and that I really don't want to retrieve the data unless something bad happens to the copies I have (disaster recovery). I would like to find a Storage Provider that is less expensive for storage but that might charge me a premium to recover my data. Fast forward to me losing my data:

• I connect to the SP through some client/ui and request request retrieval of my data
• SP responds back with the unseal price (maybe an SLA on unsealing time as well)
• I put up collateral/provide a payment voucher for the unsealing cost
• The SP accepts (ideally responding back with some SLA window of when it will be ready)
• I come back to the SP before the SLA (because maybe I'm lucky and it's ready) and check the status
• SP responds that it's not ready
• I come back after the SLA and the SP responds that my data is unsealed
• I retrieve the data (and pay any associated retrieval cost if applicable)

Known Challenges

• Unsealing is resource intensive both in terms of time and compute. For this to be automatic it would have to be heavily gated/rate limited to avoid overloading the system.
  • This could also present challenges to SLA's of recovery times if there is high demand on the system.
• Collateral/voucher/payment handling of unsealing versus retrieval - see open questions. A client may unseal and never retrieve, abuse of this (intended or not) needs to be prevented.

Open Questions

• I'm not sure how/if the collateral/voucher validation is supported today if I don't retrieve. Ideally the SP would be able to claim the voucher after an unseal in case the client never retrieves the data, but that would need some form of a proof of unseal.

References

• An evernote writeup on Filecoin payment channels