SIMULTANEOUS STATE-BASED CRYPTOGRAPHIC SPLITTING IN A SECURE STORAGE APPLIANCE

• US 20100169661A1
• Filed: 12/30/2008
• Published: 07/01/2010
• Est. Priority Date: 12/30/2008
• Status: Active Grant

• Current Assignee: Unisys Corporation
• Original Assignee: Unisys Corporation
• Inventors: Summers, Scott, French, Albert
• Granted Patent: US 10,007,807 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 11/1456 Hardware arrangements for backup
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2201/815 Virtual middleware or OS functionality using virtual machines to implement generic software techniques for error detection or fault masking G06F11/1484
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

Methods and systems for managing I/O requests in a secure storage appliance are disclosed. One method includes receiving a plurality of I/O requests at the secure storage appliance, each I/O request associated with a block of data and a volume, each volume associated with a plurality of shares stored on a plurality of physical storage devices. The method further includes storing a plurality of blocks of data in buffers of the secure storage appliance, each of the blocks of data associated with one or more of the plurality of I/O requests. The method also includes associating a state with each of the blocks of data, the state selected from a plurality of states associated with processing of an I/O request. The method includes determining the availability of a resource in the secure storage appliance, the resource used to process an I/O request of a buffer, and, upon determining that the resource is available, applying the resource to a block of data in the buffer and updating the state associated with the block of data.

Claims

1. A method of managing I/O requests in a secure storage appliance, the method including:

receiving a plurality of I/O requests at the secure storage appliance, each I/O request associated with a block of data and a volume, each volume associated with a plurality of shares stored on a plurality of physical storage devices;

storing a plurality of blocks of data in buffers of the secure storage appliance, each of the blocks of data associated with one or more of the plurality of I/O requests;

associating a state with each of the blocks of data, the state selected from a plurality of states associated with processing of an I/O request;

determining the availability of a resource in the secure storage appliance, the resource used to process an I/O request of a buffer; and

upon determining that the resource is available, applying the resource to a block of data in the buffer and updating the state associated with the block of data.

2. The method of claim 1, wherein the resource includes a parser driver configured to perform a cryptographic splitting operation on the block of data to generate a plurality of secondary data blocks.

3. The method of claim 2, wherein the resource includes a storage resource configured to write the plurality of secondary data blocks to shares associated with the volume.

4. The method of claim 1, wherein the resource includes a parser driver configured to perform a reconstitution operation on a plurality of secondary data blocks to form the block of data.

5. The method of claim 1, wherein the plurality of states includes at least one of a read state, a decode state, an idle state, a transfer state, an encode state, or a write state.

6. The method of claim 1, wherein the block of data is received from a client device.

7. The method of claim 1, wherein at least one of the buffers is a direct buffer.

8. The method of claim 1, wherein the resource includes an entry in an outstanding write list.

9. The method of claim 1, further comprising, after processing the I/O request using the resource, releasing the buffer.

10. The method of claim 1, wherein the plurality of I/O requests are thereby processed concurrently.

11. The method of claim 1, further comprising receiving a plurality of I/O requests related to a block of data.

12. The method of claim 1, further comprising, upon detecting changed data in a buffer, marking the buffer to be written to the plurality of shares of the volume.

13. The method of claim 12, wherein the block of data in the buffer relates to a read I/O request and a write I/O request.

14. A secure storage appliance comprising:

a plurality of buffers;

a plurality of resources useable in processing I/O requests;

a programmable circuit configured to execute program instructions to;

receive a plurality of I/O requests at the secure storage appliance, each I/O request associated with a block of data and a volume, each volume associated with a plurality of shares stored on a plurality of physical storage devices;

store a plurality of blocks of data in buffers from among the plurality of buffers, each of the blocks of data associated with one or more of the plurality of I/O requests;

associate a state with each of the blocks of data, the state selected from a plurality of states associated with processing of an I/O request;

determine the availability of a resource from among the plurality of resources; and

apply the resource to a block of data in the buffer and updating the state associated with the block of data upon determining that the resource is available.

15. The secure storage appliance of claim 14, wherein the plurality of resources includes a parser driver configured to perform a cryptographic splitting operation on the block of data to generate a plurality of secondary data blocks.

16. The secure storage appliance of claim 14, wherein the plurality of resources includes a parser driver configured to perform a reconstitution operation on a plurality of secondary data blocks to form the block of data.

17. The secure storage appliance of claim 14, wherein the plurality of states includes at least one of a read state, a decode state, an idle state, a transfer state, an encode state, or a write state.

18. The secure storage appliance of claim 14, wherein the plurality of resources includes at least one resource selected from the group consisting of:

a parser driver;

a host bus adapter port; and

an entry in an outstanding write list.

19. The secure storage appliance of claim 14, wherein the programmable circuit is programmed to receive a plurality of I/O requests related to a block of data.

20. The secure storage appliance of claim 14, wherein the plurality of I/O requests are processed concurrently.

21. A method of managing I/O requests in a secure storage appliance, the method including:

receiving a plurality of I/O requests at the secure storage appliance, each I/O request associated with a block of data and a volume,

in response to at least one of the plurality of I/O requests, obtaining a block of data from a volume by reconstituting the block of data from a plurality of secondary blocks of data stored in a plurality of shares on a plurality of physical storage devices;

storing a plurality of blocks of data in buffers of the secure storage appliance, each of the blocks of data associated with one or more of the plurality of I/O requests, the plurality of blocks of data including the block of data obtained from the plurality of shares;

associating a state with each of the blocks of data, the state selected from a plurality of states associated with processing of an I/O request;

altering the block of data obtained from the plurality of shares in response to one of the plurality of I/O requests;

upon determining that a parser driver is available to be used to process the one of the plurality of I/O requests, applying the parser driver to the altered block of data to generate a plurality of altered secondary data blocks and updating the state associated with the block of data.

22. The method of claim 21, wherein altering the block of data includes altering a portion of the block of data.

23. The method of claim 21, further comprising, upon completing use of the parser driver to process the one of the plurality of I/O requests, freeing the parser driver to process a different one of the plurality of I/O requests prior to storing the altered secondary data blocks in the plurality of shares.