Cluster storage system, process for secure erasure of data, and computer program product

• US 9,984,085 B2
• Filed: 01/17/2013
• Issued: 05/29/2018
• Est. Priority Date: 02/14/2012
• Status: Active Grant

• Current Assignee: Fujitsu Technology Solutions GmbH (Fujitsu Limited)
• Original Assignee: Fujitsu Technology Solutions Intellectual Property GmbH (Allgeier SE)
• Inventors: Hhnke, Thorsten
• Primary Examiner(s): Patel, Ashok
• Assistant Examiner(s): Farooqui, Quazi
• Application Number:
  US14/378,419
• Publication Number:
  US 20150012982A1
• Time in Patent Office: 1,958 Days
• Field of Search: 726 5, 726 2, 726 4, 726 18
• CPC Class Codes: G06F 16/162 Delete operations erasing in storage systems G06F3/0652
• CPC Class Codes: G06F 16/284 Relational databases
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A cluster storage system includes a plurality of mass storage systems that provide storage capacity to store data blocks, middleware that provides a plurality of virtual storage pools for a plurality of users of the cluster storage system, at least one user interface that accesses the storage pool allocated to a user, wherein the middleware includes at least one erase algorithm for secure erasure of data blocks, the at least one user interface provides an erase function to erase the storage pool allocated to the user, and the middleware is configured to erase all user-allocated data blocks of the plurality of mass storage systems using the at least one erase algorithm and report the successful erasure via the user interface when the user calls up the erase function.

Claims

1. A cluster storage system comprising:

a plurality of mass storage systems that provide storage capacity to store data blocks;

middleware that provides a plurality of virtual storage pools for a plurality of users of the cluster storage system;

at least one user interface configured to access the storage pool allocated to a user;

wherein

the middleware comprises at least one erase algorithm for secure erasure of data blocks;

the at least one user interface provides an erase function to erase the storage pool allocated to the user;

the middleware is configured to erase all user-allocated data blocks of the plurality of mass storage systems using the at least one erase algorithm and report the successful erasure via the user interface when the user calls up the erase function; and

the cluster storage system is connected to the Internet and configured as a cloud storage system.

2. The cluster storage system according to claim 1, further comprising a network file system that organizes a plurality of data blocks of the plurality of mass storage systems in storage areas, wherein each storage area is allocated to exactly one or to no storage pool of the plurality of storage pools.

3. The cluster storage system according to claim 2, wherein the network file system allocates the storage blocks to disjoint partitions and the middleware allocates to each user a dedicated partition of the network file system.

4. The cluster storage system according to claim 2, wherein the network file system is configured to provide the middleware with address information for the data blocks allocated to a storage area, and the middleware is configured upon call-up of the erase function to determine the storage areas allocated to the storage pool to be erased and to transmit to the erase algorithm the address information provided by the network file system for the data blocks allocated to the determined storage areas.

5. The cluster storage system according to claim 1, wherein the middleware is configured to create a certificate relating to the successful erasure.

6. The cluster storage system according to claim 5, wherein the middleware is configured to create a digitally signed ISO 27001/2 Lead Implementer Certificate.

7. The cluster storage system according to claim 1, comprising a plurality of secure erase algorithms, wherein the at least one user interface is configured to allow the user a choice of the erase algorithm to be used for erasure from the plurality of erase algorithms.

8. The cluster storage system according to claim 1, wherein the at least one erase algorithm corresponds to one of German standard BSI-TL 03420 of the German Federal Office for Information Security (BSI), standard DOD 5220.22-M or standard DOD 5220.22-M ECE of the US Department of Defense.

9. A process for secure erasure of data in a cluster storage system comprising:

authenticating a user in respect of the cluster storage system;

selecting via a user interface of the cluster storage system an erase function that erases at least one storage area allocated to the authenticated user;

determining storage blocks allocated to the at least one storage area of a plurality of mass storage systems by middleware of the cluster storage system;

erasing the storage blocks allocated to the at least one storage area by at least one predetermined secure erase algorithm; and

reporting the successful erasure of the at least one storage area to the authenticated user,

wherein the cluster storage system is connected to the Internet and configured as a cloud storage system.

10. The process according to claim 9, further comprising:

logging the erasure procedure;

creating a certificate on the basis of the logged erasure procedure; and

transmitting the certificate to the authenticated user.

11. The process according to claim 10, wherein, in creating a certificate, a digitally signed Lead Implementer Certificate according to ISO 27001/2 is created.

12. The process according to claim 9, wherein authenticating is performed collaboratively by an IT service provider and a customer of the IT service provider, selecting is performed under the control of the customer of the IT service provider and determining, erasing and reporting are performed under the control of the IT service provider.

13. A computer program product comprising executable program code stored in a non-transitive storage device, wherein upon execution of the program code by a cluster computer of a cluster storage system, the following steps are performed:

authenticating a user;

receiving via a user interface a request to select an erasure function for erasing at least one of the storage areas allocated to the authenticated user;

determining storage blocks, allocated to the at least one storage area, of a plurality of mass storage systems by middleware of the cluster storage system;

erasing the storage blocks allocated to the at least one storage area by at least one predetermined secure erase algorithm; and

reporting the successful erasure of the at least one storage area to the authenticated user,

wherein the cluster storage system is connected to the Internet and configured as a cloud storage system.