Method and apparatus for verifiably migrating WORM data

• US 7,774,610 B2
• Filed: 09/14/2005
• Issued: 08/10/2010
• Est. Priority Date: 12/14/2004
• Status: Active Grant

• Current Assignee: NetApp, Inc.
• Original Assignee: NetApp, Inc.
• Inventors: Merrick, Jeffrey D., McGovern, William P.
• Primary Examiner(s): Moise; Emmanuel L
• Assistant Examiner(s): Abyaneh; Ali S
• Application Number:
  US11/227,329
• Publication Number:
  US 20060126468A1
• Time in Patent Office: 1,791 Days
• Field of Search: 713/180, 714/6, 707/204, 711/161
• US Class Current: 713/180
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00

Abstract

A file system in a storage system allows a user to designate data as write-once read-many (WORM) data. The WORM data are stored in a first set of storage media of the storage system. Signature data are generated from the WORM data. Using the signature data, the integrity of the WORM data can be verified.

Claims

1. A method comprising:

using a file system of a storage server to provide a user with access to data stored by the storage server;

selecting a subset of the data stored by the storage server, the selected subset containing one or more data items, including at least one file;

creating a signature file for the selected subset, the signature file specifying the data items contained in the selected subset and locations of said data items within the selected subset, the signature file further including metadata associated with each said data item, the metadata including a write once, read many (WORM) state indication for at least one data item in the selected subset;

generating a cryptographic hash for each file in the selected subset and including each said cryptographic hash in the signature file in association with the corresponding file;

using a private key of a public-private key pair to generate a first digital signature of the signature file as a whole;

associating the first digital signature with the signature file;

migrating the selected subset from a source set of storage media to a destination set of storage media; and

using the signature file to verify the selected subset of the data, as stored in the destination set of storage media, including verifying a WORM state of the at least one data item.

2. A method as recited in claim 1, wherein the signature file is in human-readable form.

3. A method as recited in claim 1, further comprising:

using the signature file to verify the integrity of the selected subset of the data.

4. A method as recited in claim 3, wherein using the signature file to verify the integrity of the selected subset of the data comprises:

generating a second digital signature for the signature file; and

comparing the first digital signature and the second digital signature to verify the integrity of the selected subset.

5. A method as recited in claim 1, further comprising:

using a public key associated with the private key to verify the signature file.

6. A method as recited in claim 1, wherein the storage server comprises a file server.

7. A method as recited in claim 1, wherein the source set of storage media is managed by said storage server, and wherein the destination set of storage media is managed by a destination storage server.

8. A method as recited in claim 1, wherein the destination set of storage media comprises a tape storage medium.

9. A method as recited in claim 8, wherein the destination storage system comprises a tape based backup system.

10. A method as recited in claim 1, wherein using the signature file to verify the integrity of the selected subset of the data comprises, in a destination storage system:

using a public key associated with the private key to verify the signature file;

generating a second signature file to represent the selected subset of data as stored in the destination set of storage media;

comparing the second signature file to said signature file;

verifying metadata in the second signature file against the selected subset of the data, as stored in the destination set of storage media;

using the private key to generate a digital signature for the second signature file; and

comparing the digital signature for the second signature file with the digital signature of said signature file.

11. A storage system comprising:

a processor;

a storage interface, coupled to the processor, through which to communicate with a set of mass storage media;

a file system to provide user access to data stored in the set of mass storage media; and

a memory storing instructions which, when executed by the processor, cause the storage system to perform a process which includes;

creating a signature file corresponding to a data set stored in the set of mass storage media, the signature file specifying data items contained in the data set, locations of each data item within the data set, and metadata associated with the data items;

generating a cryptographic hash for each data item of a predetermined type in the data set and including each cryptographic hash in the signature file;

generating a digital signature of the signature file as a whole;

associating the digital signature with the signature file;

using the signature file to verify integrity of the data set, wherein the data set includes write once read many (WORM) data; and

migrating the data set to another set of mass storage media, wherein the signature file is used to verify a WORM state of the WORM data and that the data set migrated to said other set of mass storage media is identical to the data set from which the signature file was created.

12. A storage system as recited in claim 11, wherein the signature file is in human-readable form.

13. A storage system as recited in claim 11, further comprising a network interface through which to communicate with a plurality of clients over a network, to allow the clients to access data stored by the storage system.

14. A storage system as recited in claim 11, wherein generating the digital signature of the signature file comprises using a private key of a public/private key pair to generate the digital signature.

15. A storage system as recited in claim 11, wherein said process is performed in response to user input applied through the file system interface.

16. A method comprising:

using a directory-and-file based file system interface in a storage server to receive a selection by a user of a subset of data stored by the storage server, the selected subset including a plurality of files, the selection indicating that the plurality of files are to be protected;

in the storage server, creating a signature file for the plurality of files in the selected subset in response to the selection, the signature file specifying the files included in the selected subset and the locations of the files within the selected subset, the signature file further including metadata associated with each said file, the metadata including a write once, read many (WORM) state indication for at least one file in the selected subset;

in the storage server, generating a cryptographic hash for each file in the selected subset and including each said cryptographic hash in the signature file in association with the corresponding file;

in the storage server, using a private key of a public-private key pair to generate a first digital signature of the signature file as a whole;

associating the first digital signature with the signature file;

migrating the selected subset from a first set of storage media to a second set of storage media;

using the signature file to verify a WORM state of the selected subset; and

using the signature file to verify that the selected subset migrated to the second set of storage media is identical to the selected subset from which the signature data was generated.

17. A method as recited in claim 16, wherein the first set of storage media is managed by a first storage server and the second set of storage media are managed by a second storage server of a different type from the first storage server.

18. A method as recited in claim 17, wherein said using the signature file to verify that the selected subset migrated to the second set of storage media is identical to the selected subset from which the signature data was generated is performed by the second storage server.