Data security for distributed file systems
First Claim
1. A computer-implemented method for controlling access by a plurality of client applications to file data in a distributed file system including a distributed file system interface coupled to the client applications and a storage server and a meta-data server coupled to the distributed file system interface, comprising:
- receiving at the meta-data server an open-file request, the open-file request specifying a name of a first file, wherein the first file includes a first set of blocks;
creating a security object at the meta-data server in response to the open-file request;
generating an encryption key at the meta-data server and the storage server and storing the encryption key in the security object;
encrypting a list that identifies the first set of blocks, whereby an encrypted block list is formed;
adding the encrypted block list to the security object; and
transmitting the security object to the distributed file interface.
2 Assignments
0 Petitions
Accused Products
Abstract
A method and apparatus for data security for a distributed file system. A distributed file system interface is coupled to the one or more client applications, and a storage server and a meta-data server are coupled to the distributed file system interface. The meta-data server receives open-file requests from the distributed file system interface and in response creates a security object. The meta-data server also generates an partial encryption key and stores the partial encryption key in the security object. The block storage server completes the encryption key, and the meta-data server encrypts the list of blocks that are in the file and stores the encrypted block list in the security object. The security object is then returned to the distributed file interface and used in subsequent file access requests.
-
Citations
16 Claims
-
1. A computer-implemented method for controlling access by a plurality of client applications to file data in a distributed file system including a distributed file system interface coupled to the client applications and a storage server and a meta-data server coupled to the distributed file system interface, comprising:
-
receiving at the meta-data server an open-file request, the open-file request specifying a name of a first file, wherein the first file includes a first set of blocks;
creating a security object at the meta-data server in response to the open-file request;
generating an encryption key at the meta-data server and the storage server and storing the encryption key in the security object;
encrypting a list that identifies the first set of blocks, whereby an encrypted block list is formed;
adding the encrypted block list to the security object; and
transmitting the security object to the distributed file interface. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 15, 16)
-
-
13. An apparatus for controlling access by a plurality of client applications to file data in a distributed file system including a distributed file system interface coupled to the client applications and a storage server and a meta-data server coupled to the distributed file system interface, comprising:
-
means for receiving at the meta-data server an open-file request, the open-file request specifying a name of a first file, wherein the first file includes a first set of blocks;
means for creating a security object at the meta-data server in response to the open-file request;
means for generating an encryption key at the meta-data server and the storage server and storing the encryption key in the security object;
means for encrypting a list that identifies the first set of blocks, whereby an encrypted block list is formed;
means for adding the encrypted block list to the security object; and
means for transmitting the security object to the distributed file interface.
-
-
14. A system for controlling access by a plurality of client applications to file data in a distributed file system, comprising:
-
a distributed file system interface coupled to the client applications, the interface configured to transmit open file requests to a meta-data server and file access requests to a block storage server;
the meta-data server coupled to the distributed file system interface and to the block storage server, the meta-data server configured to generate a partial encryption key, store the partial encryption key in a security object, transmit the security object to the block storage server for completion of the encryption key, encrypt a list of blocks in a file as an encrypted block list, and return the security object with the encrypted block list to the distributed file system interface; and
the block storage server coupled to the distributed file system interface, the block storage server configured to generate a complete encryption key from the partial encryption key in the security object, and return the security object with the complete encryption key to the meta-data server.
-
Specification