Methods and apparatus for secure modification of a retention period for data in a storage system

• US 7,249,251 B2
• Filed: 01/21/2004
• Issued: 07/24/2007
• Est. Priority Date: 01/21/2004
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Kilian, Michael, Todd, Stephen J.
• Primary Examiner(s): Peeso; Thomas R.
• Application Number:
  US10/762,043
• Publication Number:
  US 20050160481A1
• Time in Patent Office: 1,280 Days
• Field of Search: 713/1, 713/158, 713/161, 713/165, 713/166
• US Class Current: 713/1
• CPC Class Codes: G06F 12/0261 using reference counting
• CPC Class Codes: G06F 16/125 characterised by the use of retention policies retention policies for HSM systems G06F16/185
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0637 Permissions

Abstract

One embodiment is a method and apparatus for modifying retention periods in a storage system, in which previously defined retention periods for units of data may be reduced. In another embodiment, the retention period of a unit of data may be modified in response to the occurrence of an event by renewing previously defined retention periods until the occurrence of the event is detected. If the occurrence of the event is detected, a retention period associated with that event may be established for the unit of data. In yet another embodiment, retention classes are used to define retention periods for units of data so that the retention period of a unit of data may be modified without modifying the unit of data itself. In a further embodiment, a request to the storage system to reduce a retention period includes authentication information that the storage system may use to verify the request.

Claims

1. A method of processing data in a computer system comprising at least one host and at least one storage system, the method comprising acts of:

(A) receiving, at the at least one storage system, a request from the at least one host to reduce a length of a previously defined retention period for a unit of data stored on the at least one storage system, wherein the request is received before the retention period for the unit of data has expired and includes authentication information;

(B) determining if the request is authentic based, at least in part, on the authentication information; and

(C) when it is determined in the act (B) that the request is not authentic, denying the request to reduce the retention period.

2. The method of claim 1, further comprising an act (D) of, when it is determined in the act (B) that the request is authentic, granting the request to reduce the retention period.

3. The method of claim 1, wherein the act (B) comprises using the authentication information to authenticate the at least one host that transmitted the request to reduce the retention period.

4. The method of claim 1, wherein the request specifies that an event has occurred to trigger the request to reduce the retention period, and wherein the act (B) comprises an act of using the authentication information to authenticate that the event has occurred.

5. The method of claim 4, wherein the authentication information specifies a third party resource that can be consulted to authenticate that the event has occurred, and wherein the act (B) comprises an act of consulting the third party resource to authenticate that the event has occurred.

6. At least one computer readable medium encoded with instructions that, when executed on a computer system, perform a method of processing data, the computer system comprising at least one host and at least one storage system, the method comprising acts of:

(A) receiving, at the at least one storage system, a request from the at least one host to reduce a length of a previously defined retention period for a unit of data stored on the at least one storage system, wherein the request is received before the retention period for the unit of data has expired and includes authentication information;

(B) determining if the request is authentic based, at least in part, on the authentication information; and

(C) when it is determined in the act (B) that the request is not authentic, denying the request to reduce the retention period.

7. The at least one computer readable medium of claim 6, wherein the method further comprises an act (D) of, when it is determined in the act (B) that the request is authentic, granting the request to reduce the retention period.

8. The at least one computer readable medium of claim 6, wherein the act (B) comprises using the authentication information to authenticate the at least one host that transmitted the request to reduce the retention period.

9. The at least one computer readable medium of claim 6, wherein the request specifies that an event has occurred to trigger the request to reduce the retention period, and wherein the act (B) comprises an act of using the authentication information to authenticate that the event has occurred.

10. The at least one computer readable medium of claim 9, wherein the authentication information specifies a third party resource that can be consulted to authenticate that the event has occurred, and wherein the act (B) comprises an act of consulting the third party resource to authenticate that the event has occurred.

11. A storage system for use in a computer system, including the storage system and at least one host, the storage system comprising:

at least one storage device to store a unit of data received from the at least one host; and

at least one controller adapted to;

receive a request from the at least one host to reduce a length of a previously defined retention period for the unit of data before the retention period for the unit of data has expired, wherein the request includes authentication information;

determine if the request is authentic based, at least in part, on the authentication information; and

when it is determined that the request is not authentic, deny the request to reduce the retention period.

12. The storage system of claim 11, wherein the at least one controller is adapted to, when it determines that the request is authentic, grant the request to reduce the retention period.

13. The storage system of claim 11, wherein the at least one controller is adapted to use the authentication information to authenticate the at least one host that transmitted the request to reduce the retention period.

14. The storage system of claim 11, wherein the request specifies that an event has occurred to trigger the request to reduce the retention period, and wherein the at least one controller is adapted to use the authentication information to authenticate that the event has occurred.

15. The storage system of claim 14, wherein the authentication information specifies a third party resource that can be consulted to authenticate that the event has occurred, and wherein the at least one controller is adapted to consult the third party resource to authenticate that the event has occurred.

16. The storage system of claim 15, wherein the at least one controller comprises:

first means for receiving a request from the at least one host to reduce a length of a previously defined retention period for a unit of data stored on the at least one storage system, wherein the request is received before the retention period for the unit of data has expired and includes authentication information;

second means for determining if the request is authentic based, at least in part, on the authentication information; and

third means for, when it is determined by the second means that the request is not authentic, denying the request to reduce the retention period.

17. A method of processing data in a computer system comprising at least one host and at least one storage system, wherein the at least one storage system stores a unit of data having a previously defined retention period during which the at least one unit of data is to be retained on the at least one storage system, the method comprising acts of:

(A) providing to the at least one storage system a request, from the at least one host, to reduce a length of the previously defined retention period for the unit of data, wherein the request is provided before the retention period for the unit of data has expired and includes authentication information to enable the at least one storage system to authenticate the request.

18. The method of claim 17, wherein the authentication information authenticates the identity of the at least one host that transmitted the request to reduce the previously-defined retention period.

19. The method of claim 17, wherein the request specifies that an event has occurred to trigger the request to reduce the retention period, and wherein the authentication information enables the storage system to authenticate that the event has occurred.

20. The method of claim 19, wherein the authentication information specifies a third party resource that can be consulted to authenticate that the event has occurred.

21. At least one computer readable medium encoded with instructions that, when executed on a computer system, perform a method of processing data, the computer system comprising at least one host and at least one storage system, wherein the at least one storage system stores a unit of data having a previously defined retention period during which the at least one unit of data is to be retained on the at least one storage system, the method comprising acts of:

(A) providing to the at least one storage system a request, from the at least one host, to reduce a length of the previously defined retention period for the unit of data, wherein the request is provided before the retention period for the unit of data has expired and includes authentication information to enable the at least one storage system to authenticate the request.

22. The at least one computer readable medium of claim 21, wherein the authentication information authenticates the identity of the at least one host that transmitted the request to reduce the previously-defined retention period.

23. The at least one computer readable medium of claim 21, wherein the request specifies that an event has occurred to trigger the request to reduce the retention period, and wherein the authentication information enables the storage system to authenticate that the event has occurred.

24. The at least one computer readable medium of claim 23, wherein the authentication information specifies a third party resource that can be consulted to authenticate that the event has occurred.

25. A host computer for use in a computer system that includes the host computer and at least one storage system that stores, for the host computer, a unit of data having a previously defined retention period during which the at least one unit of data is to be retained on the at least one storage system, the host computer comprising:

at least one storage device; and

at least one controller, coupled to the at least one storage device, that is adapted to provide to the at least one storage system a request to reduce a length of the previously defined retention period for the unit of data, wherein the request is provided before the retention period for the unit of data has expired and includes authentication information to enable the at least one storage system to authenticate the request.

26. The host computer of claim 25, wherein the authentication information authenticates the identity of the host computer that transmitted the request to reduce the previously-defined retention period.

27. The host computer of claim 25, wherein the request specifies that an event has occurred to trigger the request to reduce the retention period, and wherein the authentication information enables the storage system to authenticate that the event has occurred.

28. The host computer of claim 27, wherein the authentication information specifies a third party resource that can be consulted to authenticate that the event has occurred.

29. The host computer of claim 25, in combination with the at least one storage system.

30. The host computer of claim 25, wherein the at least one controller comprises:

means for providing to the at least one storage system a request to reduce a length of the previously defined retention period for the unit of data, wherein the request is provided before the retention period for the unit of data has expired and includes authentication information to enable the at least one storage system to authenticate the request.