Secure audit scheme in a distributed data storage system

    公开(公告)号:US11005663B2

    公开(公告)日:2021-05-11

    申请号:US16102201

    申请日:2018-08-13

    Abstract: Apparatus and method for managing data objects in a distributed data storage system, such as a cloud computing environment. In some embodiments, a data object is encrypted using a user encryption key to generate ciphertext. A first hash function is applied to the ciphertext and an audit encryption key to generate a first hash value. An audit value is formed by combining the ciphertext and the first hash value, and the audit value is locally encrypted and stored to non-volatile memory (NVM) of each of a plurality of storage nodes. An audit process is performed to confirm each of the encrypted replicas store identical copies of the ciphertext. This is carried out by decrypting the ciphertext and applying a second hash function to the ciphertext and the audit encryption key by each storage node to form a plurality of second hash values which are then compared by an audit processor.

    Seeding mechanism for error detection codes

    公开(公告)号:US10073735B1

    公开(公告)日:2018-09-11

    申请号:US14526184

    申请日:2014-10-28

    CPC classification number: G06F11/1048

    Abstract: Systems and methods are disclosed for a seeding mechanism for error detection codes. An error detection code may be generated using specifically modified seed input and stored to data sectors not containing valid data. A data storage device may determine if read attempts are directed to an invalid sector by analysis of the stored error detection code. In some embodiments, an apparatus may determine a first error detection code stored to a target data storage sector does not match a second error detection code calculated for the target data storage sector, compare the first error detection code to a modified error code value to determine whether the target data storage sector contains valid data, and return an indication that the target data storage sector does not contain valid data when the error detection code matches the modified error code value.

    Data reallocation upon detection of errors

    公开(公告)号:US09678864B2

    公开(公告)日:2017-06-13

    申请号:US14559327

    申请日:2014-12-03

    Abstract: A device includes one or more data storage media having a main storage area, and includes a non-volatile cache memory and a controller. The controller stores a plurality of data packets into a plurality of physical locations in the main storage area. Each of the data packets is associated with a different logical block address (LBA), and each of the physical locations is associated with a different physical location address (PLA). The controller generates mapping information that links the different LBAs to the different PLAs. Upon detecting a soft error when reading a data packet stored in a physical location, the controller relocates the data packet associated with the soft error to a physical location of the non-volatile cache memory. The controller also marks the physical location as a suspect location. The controller updates the mapping information to reflect the relocation of the data packet associated with the soft error.

    DATA REALLOCATION UPON DETECTION OF ERRORS
    5.
    发明申请
    DATA REALLOCATION UPON DETECTION OF ERRORS 有权
    数据重新检测错误

    公开(公告)号:US20160162208A1

    公开(公告)日:2016-06-09

    申请号:US14559327

    申请日:2014-12-03

    Abstract: A device includes one or more data storage media having a main storage area. The device also includes a non-volatile cache memory and a controller. The controller stores a plurality of data packets into a plurality of physical locations in the main storage area of the one or more data storage media. Each of the plurality of data packets is associated with a different logical block address (LBA), and each of the plurality of physical locations is associated with a different physical location address. The controller generates mapping information that links the different LBAs associated with the different data packets to the different physical location addresses associated with the different physical locations. Upon detecting a soft error when reading at least one data packet of the plurality of data packets stored in at least one physical location of the plurality of physical locations, the controller relocates the at least one data packet associated with the soft error to at least one physical location of a non-volatile cache memory. The controller also makes an indication that the at least one physical location of the plurality of physical locations is a suspect location. The controller updates the mapping information to reflect the relocation of the at least one data packet associated with the soft error to the at least one physical location in the non-volatile cache memory.

    Abstract translation: 一种设备包括具有主存储区域的一个或多个数据存储介质。 该设备还包括非易失性高速缓冲存储器和控制器。 控制器将多个数据分组存储到一个或多个数据存储介质的主存储区域中的多个物理位置。 多个数据分组中的每一个与不同的逻辑块地址(LBA)相关联,并且多个物理位置中的每一个与不同的物理位置地址相关联。 控制器生成将与不同数据分组相关联的不同的LBA链接到与不同物理位置相关联的不同物理位置地址的映射信息。 当读取存储在多个物理位置中的至少一个物理位置中的多个数据分组中的至少一个数据分组时检测到软错误,控制器将与软错误相关联的至少一个数据分组重新定位到至少一个 非易失性缓存的物理位置。 控制器还指示多个物理位置中的至少一个物理位置是可疑位置。 控制器更新映射信息以反映与软错误相关联的至少一个数据分组的重定位到非易失性高速缓冲存储器中的至少一个物理位置。

    SECURE AUDIT SCHEME IN A DISTRIBUTED DATA STORAGE SYSTEM

    公开(公告)号:US20200052901A1

    公开(公告)日:2020-02-13

    申请号:US16102201

    申请日:2018-08-13

    Abstract: Apparatus and method for managing data objects in a distributed data storage system, such as a cloud computing environment. In some embodiments, a data object is encrypted using a user encryption key to generate ciphertext. A first hash function is applied to the ciphertext and an audit encryption key to generate a first hash value. An audit value is formed by combining the ciphertext and the first hash value, and the audit value is locally encrypted and stored to non-volatile memory (NVM) of each of a plurality of storage nodes. An audit process is performed to confirm each of the encrypted replicas store identical copies of the ciphertext. This is carried out by decrypting the ciphertext and applying a second hash function to the ciphertext and the audit encryption key by each storage node to form a plurality of second hash values which are then compared by an audit processor.

    Securing information relating to data compression and encryption in a storage device

    公开(公告)号:US10095635B2

    公开(公告)日:2018-10-09

    申请号:US15084222

    申请日:2016-03-29

    Abstract: Apparatus and method for data security in a data storage environment. In some embodiments, input data from a host is received into a buffer memory. Data compression is applied to the input data to provide compressed data. Encryption is applied to the compressed data to generate encrypted data, and the encrypted data are stored in a main memory of a data storage device. A system parameter value associated with the storage of the encrypted data is generated and stored in a memory, such as the main memory of the storage device. The system parameter value may include information relating to the compression of the data. A trusted relationship is established to authenticate the host responsive to a request for the updated system parameter value. The system parameter value is transferred to the host responsive to the established trusted relationship.

Patent Agency Ranking