Storing data integrity information utilizing dispersed storage

• US 9,274,977 B2
• Filed: 10/11/2011
• Issued: 03/01/2016
• Est. Priority Date: 11/01/2010
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Resch, Jason K.
• Primary Examiner(s): HO, DAO Q
• Application Number:
  US13/270,654
• Publication Number:
  US 20120110346A1
• Time in Patent Office: 1,603 Days
• Field of Search: 713/189
• US Class Current: 1/1
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 16/11 File system administration, e.g. details of archiving or snapshots file system backup G06F11/14
• CPC Class Codes: G06F 16/113 Details of archiving lifecycle management in storage systems G06F3/0649; backup systems G06F11/1446
• CPC Class Codes: G06F 16/1734 Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs
• CPC Class Codes: G06F 16/2365 Ensuring data consistency and integrity
• CPC Class Codes: G06F 16/50 of still image data
• CPC Class Codes: G06F 2212/7205 Cleaning, compaction, garbage collection, erase control
• CPC Class Codes: G06F 3/0652 Erasing, e.g. deleting, data cleaning, moving of data to a wastebasket
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A method begins by a processing module generating an integrity check value for each encoded data slice of a set of encoded data slices to produce a set of integrity check values. The method continues with the processing module encoding the set of integrity check values to produce encoded integrity check values. The method continues with the processing module sending the encoded integrity check values for storage in a memory system.

Claims

1. A method for execution by a processing module of a computing device, the method comprises:

generating a set of encoded data slices from a data segment in accordance with an error coding function, wherein X number of encoded data slices are produced when error coding the data segment and wherein at least a threshold number T of the X number of encoded data slices are needed to reconstruct the data segment, where T is less than X, in which the X number of encoded data slices are to be stored in X number of storage locations of a dispersed storage network;

generating an integrity check value for each of the encoded data slices to produce a set of integrity check values;

encrypting the set of integrity check values;

encoding the encrypted set of integrity check values in accordance with the error coding function to produce a set of encoded integrity check slices;

sending the set of encoded data slices to the dispersed storage network for storage at the X number of storage locations within a first set of dispersed storage (DS) units in the dispersed storage network; and

sending, separately from the sending of the set of encoded data slices, the set of encoded integrity check slices for storage at different locations within a second set of DS units in the dispersed storage network.

2. The method of claim 1,

wherein the first and second sets of DS units overlap such that the first and second sets of DS units are not mutually exclusive.

3. The method of claim 1, wherein the encrypting of the set of integrity check values comprises at least one of:

encrypting the set of integrity check values utilizing an all or nothing (AONT) transformation;

encrypting the set of integrity check values utilizing a public-key;

encrypting the set of integrity check values utilizing a private-key;

or

signing the set of integrity check values utilizing the private-key.

4. The method of claim 1 further comprises:

storing the integrity check values in a local memory.

5. The method of claim 1, wherein the generating of the integrity check values comprises:

applying an integrity check function on respective ones of the encoded data slices to generate the integrity check values, wherein the integrity check function includes at least one of a hashing function, a cyclic redundancy check function, a parity check function, or a mask generating function (MGF).

6. A computer comprises:

an interface;

a memory; and

a processing module operably coupled to the memory, wherein the processing module is configured to;

generate a set of encoded data slices from a data segment in accordance with an error coding function, wherein X number of encoded data slices are produced when error coding the data segment and wherein at least a threshold number T of the X number of encoded data slices are needed to reconstruct the data segment, where T is less than X, in which the X number of encoded data slices are to be stored in X number of storage locations of a dispersed storage network;

generate an integrity check value for each of the encoded data slices to produce a set of integrity check values;

encrypt the set of integrity check values;

encode the encrypted set of integrity check values in accordance with the error coding function to produce a set of encoded integrity check slices;

send, via the interface, the set of encoded data slices to the dispersed storage network for storage at the X number of storage locations within a first set of dispersed storage (DS) units in the dispersed storage network; and

send, via the interface and separately from the sending of the set of encoded data slices, the set of encoded integrity check slices for storage at different locations within a second set of DS units in the dispersed storage network.

7. The computer of claim 6,

wherein the first and second sets of DS units overlap such that the first and second sets of DS units are not mutually exclusive.

8. The computer of claim 6, wherein the processing module functions to encrypt the set of integrity check values by at least one of:

encrypting the set of integrity check values utilizing an all or nothing (AONT) transformation;

encrypting the set of integrity check values utilizing a public-key;

encrypting the set of integrity check values utilizing a private-key;

or

signing the set of integrity check values utilizing the private-key.

9. The computer of claim 6, wherein the processing module further functions to:

store the integrity check values in a local memory.

10. The computer of claim 6, wherein the processing module functions to generate the integrity check values by:

applying an integrity check function on respective ones of the encoded data slices to generate the integrity check values, wherein the integrity check function includes at least one of a hashing function, a cyclic redundancy check function, a parity check function, or a mask generating function (MGF).