Method and apparatus for verifiably migrating WORM data

• US 20060126468A1
• Filed: 09/14/2005
• Published: 06/15/2006
• Est. Priority Date: 12/14/2004
• Status: Active Grant

• Current Assignee: NetApp, Inc.
• Original Assignee: Network Appliance Incorporated (NetApp, Inc.)
• Inventors: Merrick, Jeffrey D., McGovern, William P.
• Granted Patent: US 7,774,610 B2
• Time in Patent Office: Days
• US Class Current: 369/53.100
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00

Abstract

A file system in a storage system allows a user to designate data as write-once read-many (WORM) data. The WORM data are stored in a first set of storage media of the storage system. Signature data are generated from the WORM data. Using the signature data, the integrity of the WORM data can be verified.

Claims

1. A method comprising:

providing a file system in a storage system to allow a user to designate data as write-once read-many (WORM) data, the WORM data being stored in a first set of storage media of the storage system; and

generating signature data from the WORM data, using which the integrity of the WORM data can be verified.

2. A method as recited in claim 1, wherein the signature data are transportable independently of the WORM data.

3. A method as recited in claim 2, further comprising:

migrating the WORM data from the first set of storage media to a second set of storage media; and

using the signature data to verify that the WORM data migrated to the second set of storage media is identical to the WORM data from which the signature data was generated.

4. A method as recited in claim 3, wherein using the signature data to verify that the WORM data migrated to the second set of storage media is identical to the WORM data from which the signature data was generated comprises:

using a file system interface to verify the WORM data with the signature data.

5. A method as recited in claim 1, wherein the first set of storage media is managed by a first storage server and the second set of storage media are managed by a second storage server.

6. A method as recited in claim 5, wherein at least one of the first storage server and the second storage server comprises a file server.

7. A method as recited in claim 5, wherein at least one of the first storage server and the second storage server comprises a tape backup system.

8. A method as recited in claim 1, wherein the first set of storage media and the second set of storage media are managed by a single storage server.

9. A method as recited in claim 8, wherein the digital signature is created using a private key, of a public/private key pair, the method further comprising:

using a public key, of the public/private key pair, to verify the digital signature of the signature file.

10. A method as recited in claim 1, wherein generating signature data from the WORM data comprises:

creating the signature data in the form of a signature file that includes a specification of data items contained in the WORM data, the locations of all of the data items within the WORM data, and metadata associated with said data items.

11. A method as recited in claim 10, wherein generating the signature data further comprises:

generating a cryptographic hash for each data item of a predetermined type in the WORM data and including each said cryptographic hash in the signature file.

12. A method as recited in claim 11, wherein generating the signature data further comprises:

digitally signing the signature file.

13. A method as recited in claim 12, wherein digitally signing the signature file comprises using a private key of a public/private key pair to generate a digital signature of the signature file.

14. A method comprising:

using a file system of a storage server to provide a user with access to data stored by the storage server;

selecting a subset of the data stored by the storage server, the selected subset containing one or more data items, including at least one file;

creating a signature file for the selected subset, the signature file specifying the data items contained in the selected subset and the locations of said data items within the selected subset, the signature file further including metadata associated with each said data item, the metadata including a WORM state indication for at least one data item in the selected subset;

generating a cryptographic hash for each file in the selected subset and including each said cryptographic hash in the signature file in association with the corresponding file;

using a private key of a public-private key pair to generate a first digital signature of the signature file as a whole; and

associating the first digital signature with the signature file.

15. A method as recited in claim 14, wherein the signature file is in human-readable form.

16. A method as recited in claim 14, further comprising:

using the signature file to verify the integrity of the selected subset of the data.

17. A method as recited in claim 16, wherein using the signature file to verify the integrity of the selected subset of the data comprises:

generating a second digital signature for the signature file; and

comparing the first digital signature and the second digital signature to verify the integrity of the selected subset.

18. A method as recited in claim 14, further comprising:

using a public key associated with the private key to verify the signature file.

19. A method as recited in claim 14, wherein the storage server comprises a file server.

20. A method as recited in claim 14, further comprising:

migrating the selected subset from a source set of storage media to a destination set of storage media; and

using the signature file to verify the selected subset of the data, as stored in the destination set of storage media.

21. A method as recited in claim 20, wherein the source set of storage media is managed by said storage server, and wherein the destination set of storage media is managed by a destination storage server.

22. A method as recited in claim 20, wherein the destination set of storage media comprises a tape storage medium.

23. A method as recited in claim 22, wherein the destination storage system comprises a tape based backup system.

24. A method as recited in claim 20, wherein using the signature file to verify the integrity of the selected subset of the data comprises, in a destination storage system:

using a public key associated with the private key to verify the signature file;

generating a second signature file to represent the selected subset of data as stored in the destination set of storage media;

comparing the second signature file to said signature file;

verifying metadata in the second signature file against the selected subset of the data, as stored in the destination set of storage media;

using the private key to generate a digital signature for the second signature file; and

comparing the digital signature for the second signature file with the digital signature of said signature file.

25. A storage system comprising:

a processor;

a storage interface, coupled to the processor, through which to communicate with a set of mass storage media;

a file system to provide user access to data stored in the set of mass storage media; and

a memory storing instructions which, when executed by the processor, cause the storage system to perform a process which includes;

creating a signature file corresponding to a data set stored in the set of mass storage media, the signature file specifying data items contained in the data set, locations of each data item within the data set, and metadata associated with the data items;

generating a cryptographic hash for each data item of a predetermined type in the data set and including each cryptographic hash in the signature file;

generating a digital signature of the signature file as a whole; and

associating the digital signature with the signature file.

26. A storage system as recited in claim 25, wherein the signature file is in human-readable form.

27. A storage system as recited in claim 25, further comprising a network interface through which to communicate with a plurality of clients over a network, to allow the clients to access data stored by the storage system.

28. A storage system as recited in claim 25, wherein the process further comprises using the signature file to verify the integrity of the data set.

29. A storage system as recited in claim 28, wherein the data set comprises write-once read-many (WORM) data and wherein using the signature file to verify the integrity of the data set comprises using the signature file to verify a WORM state of the WORM data.

30. A storage system as recited in claim 29, wherein the process further comprises:

migrating the data set to another set of mass storage media, wherein the signature file is used to verify that the data set migrated to said other set of mass storage media is identical to the data set from which the signature file was created.

31. A storage system as recited in claim 25, wherein generating the digital signature of the signature file comprises using a private key of a public/private key pair to generate the digital signature.

32. A storage system as recited in claim 25, wherein said process is performed in response to user input applied through the file system interface.