Method of assuring data integrity on storage volumes

• US 20060184764A1
• Filed: 02/15/2005
• Published: 08/17/2006
• Est. Priority Date: 02/15/2005
• Status: Active Grant

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Osaki, Nobuyuki
• Granted Patent: US 7,188,230 B2
• Time in Patent Office: Days
• US Class Current: 711/216
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures

Abstract

A method for assuring the integrity of stored data in a storage system is provided. At a specified time at which further writes to a desired portion of the stored data are to be precluded, a hash value is calculated for the desired portion of stored data. At a later time, retrieval of the stored data is performed and the hash value recalculated. A comparison of the former and present hash values reveals whether the data has remained unchanged.

Claims

1. A storage system comprising:

a storage volume for storing selected data; and

a storage controller coupled to the storage volume, the controller controlling access to the storage volume, and being receptive to a command for preventing write operations to data stored in at least one selected portion of the storage volume;

wherein

at a first time when the storage controller receives the command, a first hash value for the data is calculated.

2. A system as in claim 1 wherein at a second time later than the first time a second hash value for the data stored in at least the one selected portion of the storage volume is calculated and the second hash value is compared to the first hash value to determine if data stored in at least the selected portion of the storage volume has been changed between the first time and the second time.

3. A system as in claim 2 further comprising a hash value table for storing hash values for the stored data, the hash value table including information to identify the storage volume, the selected portion of the storage volume, and the hash value for data stored in that selected portion.

4. A system as in claim 3 wherein the hash values are calculated using secret keys before being stored in the hash value table, and the table further includes information about an encryption key.

5. A system as in claim 3 further comprising an additional storage volume for storing the hash value table.

6. A system as in claim 1 wherein the storage volume is divided into sections, each having a range of addresses, and the at least one selected portion of the storage volume comprises a plurality of sections.

7. A system as in claim 6 wherein upon receipt of the command, write operations to the sections are prevented, and the first hash value for each section is calculated.

8. A system as in claim 1 wherein the at least one selected portion is determined by a data range.

9. A system as in claim 1 wherein the at least one selected portion is determined by a file name.

10. A method of verifying data integrity of selected data stored on a storage volume comprising:

preventing write operations to the selected data;

calculating a first hash value for the selected data;

at a later time, receiving a request for verifying data integrity of the selected data;

calculating a second hash value for the selected data at the later time; and

comparing the first and second hash values to determine if the selected data has changed.

11. A method as in claim 10 further comprising storing the first hash value in a table for storing hash values, the table including information to identify the storage volume, an address of the selected data, and the first hash value.

12. A method as in claim 11 further comprising calculating the first hash value using a secret key before storing it in the table.

13. A method as in claim 11 further comprising storing the table in a different storage volume from the one storing the selected data.

14. A method as in claim 13 further comprising dividing the storage volume into sections, each section having a range of addresses, and the selected data is stored in the plurality of sections.

15. A method as in claim 14 wherein when the steps of preventing write operations to the selected data and calculating a first hash value for the selected data are performed, write operations to the plurality of sections are prevented, and the first hash value for each section is calculated.

16. A method as in claim 14 wherein the sections are determined by a range of addresses.

17. A method as in claim 14 wherein the sections are determined by file names.